Remote user impersonation and takeover via cache poisoning in Mastodon | Hacker News Reader

Remote user impersonation and takeover via cache poisoning in Mastodon

arcanican.is

59 pointstodsacerdoti17 comments

"But instead I get a response that there's "insuffient resources" to have any system of paying bounties. Well. Alright. I guess I'll just write-off my past 1-2 weeks of being sidetracked with this finding, and helping other smaller projects as well, as entirely a charity endeavor then."

reminds me of people who squeegee your windshield at an intersection and then get mad when you don't tip them

Theirs is an awful take. I've donated thousands of hours[0] over the years to finding and fixing bugs in FOSS. I didn't do it out of charity. I did it so the things I use will be nicer and work better for me, and as a bonus, for everyone else. No one owes me a penny for that work. My payment is having better software.

[0]Say, an hour a week over a bunch of years? That feels like it's on the low side.

Really rubs me the wrong way when a disclosure tries to attach some subjective, quasi-philosophical conclusions about the software (the three bullet points at the beginning). Author is of course entitled to their opinion but the existence of a vulnerability does not imply these things nor does it really have anything to do with them.

From your comment I was expecting something much different when I clicked in to the blog post than the author just sharing their grievances with the platform. This comes off as you just not liking that they hold those opinions because you like the thing they disparaged, and you’re masquerading it behind some demand of objectivity at all times on personal blogs.

I don't use the thing they disparage and have no opinions on it either way.

The next time you discover a critical vulnerability in software used by millions of people, you can write your own "objective" take.

The author is not a professional security researcher. Which just goes to show how dumb the bug was.

Serious question: Why should the author or anyone else care if the article rubs you the wrong way? Yes, the author has an axe to grind, and they're going to use the publicity to grind that axe. I would do the same thing in that position (and have done the same thing).

> The next time you discover a critical vulnerability in software used by millions of people, you can write your own "objective" take.

That's exactly what I (already) do. I present the facts of the vulnerability. Among other benefits, it's less work to do than to podium my own beliefs.

> Yes, the author has an axe to grind, and they're going to use the publicity to grind that axe. I would do the same thing in that position (and have done the same thing).

More of a difference of opinion of what's classy or not. Also the triviality of a bug means nothing here, neither does the fact the author isn't a "professional" security researcher.

Not sure what your point is, to be honest - I'm clearly an advocate for people having their own opinions yet you're implying I'm somehow wrong for having my own?

> I'm clearly an advocate for people having their own opinions

I disagree.

> Author is of course entitled to their opinion but

The "but" essentially negates "of course".

> yet you're implying I'm somehow wrong for having my own?

You're not just expressing "an opinion" about something. Your opinion is that the author should not have expressed their own opinions in the article. That's an opinion, but your opinion doesn't clearly make you an advocate for people having their own opinions. Ironically, the specific content of your opinion is that you're anti-opinion.

Almost every comment on this HN submission is tone policing the author. It's absurd.

Alright, argue individual words of my comment if you like. Clearly this isn't going anywhere.

So 3 days is not really that long for a honestly a pretty small team. They got the fix out and most servers updated right away. I fail to see the problem but the author acts as if they should have gotten an immediate response. Gotta chill there my dude.

Yeah, a lot of responsible disclosure policies give software maintainers 90 days to fix something. No point losing sleep over a bug report (assuming it is not being actively exploited).

> it wouldn't be too far of a leap if my instance was just blocked by mastodon.social and others entirely, especially when it's commonly confused as a single-user instance (which usually get silently/hidden blocked without notice instead).

Is this actually common practice? Seems kind of inimical to the idea of self-hosting.

I've rarely seen instances get blocked on large Mastodon servers for no reason at all. I've seen plenty of small ActivityPub server projects struggle to federate with Mastodon, though. Unfortunately, very few AP servers are spec-compliant.

It does make sense to defederate single-user instances instead of individually banning their account, though, because you can simply reject messages rather than processing them and then applying moderation status to the underlying account.

I've been writing my own ActivityPub implementation, and mastodon.social is stricter with HTTP signatures in particular, possibly with other areas of the protocol as well. There were several instances where mastodon.social would reject messages that a test server accepted.

This guy sounds insufferable.

mmm yeah, i appreciate finding something like this and that it's important but idk if its just his writing style or this is how he actually thinks but it rubs me the wrong way.

I'm really grateful that he found these bugs, and I'm sorry he feels badly about it, but that's all on him.

Reply on news.ycombinator.com