#bridgy 2017-01-18

2017-01-18 UTC
snarfed joined the channel
#
snarfed aaronpk: bridgy is sending w7apk wms to aaronparecki.com because https://twitter.com/w7apk has aaronparecki.com in its profile, so bridgy searches for and sends links to it
#
aaronpk interesting
#
aaronpk doesn't that mean anyone can "steal" bridgy webmentions by putting someone else's website in their twitter profile?
#
snarfed eh not really
#
snarfed as you saw, all the source mf2 properties are the same regardless of source twitter account, and target url is the same
#
snarfed you can make bridgy serve a source page with your own twitter username, yes, but mf2 u-url overrides that. (and even if not, seems pretty harmless)
#
snarfed right?
#
aaronpk oh right the bridgy HTML was the same regardless of which twitter username was used in the URL
#
aaronpk all that really does is switch which twitter credentials hit the api then right?
#
snarfed basically yes
#
snarfed heh the security implications of these protocols can be tricky and non-obvious to think through sometimes
#
snarfed like when bridgy publish was totally open, and you still could only publish things that person had already published on their site...but you could syndicate something to a silo they hadn't intended
#
aaronpk so the only threat really is a DoS attack where someone could get bridgy to use the attacker's twitter credentials which they could somehow manipulate into hitting twitter's rate limit
#
snarfed eh yeah but you can do that now by just DoSing someone's bridgy source urls, without messing with profile URLs
#
aaronpk yeah that seemed like a stretch while i was typing it :)
#
snarfed :P
snarfed and snarfed1 joined the channel