User avatar
Johann150 (🔜 eth0) ⁂ ipv6 open_access ☮ @Johann150@genau.qwertqwefsday.eu
1y
looking at the commits associated with the coordinated security release on sharkey's end and it looks like in foundkey i already fixed several of those when taking care of redirect stuff after that "misskey forkbomb" thing.

though there are some questions i have about some of the other changes. I'm not sure if some of the added checks make correct assumptions.
1
0
2
0
User avatar
Johann150 (🔜 eth0) ⁂ ipv6 open_access ☮ @Johann150@genau.qwertqwefsday.eu
1y
so the thing i'm especially not sure about:

checking that actor.id and actor.uri are from the same host. iirc there are mastodon instances which have a separate "presentation frontend" for example toot.kif.rocks and i think they have different ids and uris?
1
0
0
0
User avatar
Jeder neocat_floof_googly_woozy neocat_flag_agender @jeder@miau.jeder.pl
1y
@Johann150 isn't that just split domain setup
1
0
0
0
User avatar
Johann150 (🔜 eth0) ⁂ ipv6 open_access ☮ @Johann150@genau.qwertqwefsday.eu
1y
@jeder ye, thats what i said. i'm not sure if some of those additional checks handle that kind of setup properly.
1
0
0
0
User avatar
Jeder neocat_floof_googly_woozy neocat_flag_agender @jeder@miau.jeder.pl
1y
@Johann150 ngl I know jack shit about this kinda stuff but js iceshrimp has it implemented as prob the only misskey (12) fork so maybe that could be somehow helpful? (I am probably opposite of helpful here right now neocat_googly_woozy)
1
0
0
0
User avatar
Johann150 (🔜 eth0) ⁂ ipv6 open_access ☮ @Johann150@genau.qwertqwefsday.eu
1y
@jeder hmm well i guess then it should work bc zotan made that particular patch neofox_think_googly i hope she knows about iceshrimp stuff
1
0
1
0
User avatar
Jeder neocat_floof_googly_woozy neocat_flag_agender @jeder@miau.jeder.pl
1y
@Johann150 well she's the iceshrimp dev lol
1
0
0
0
User avatar
Jeder neocat_floof_googly_woozy neocat_flag_agender @jeder@miau.jeder.pl
1y
@Johann150 it should be good
1
0
0
0