#dev 2026-04-12
2026-04-12 UTC
gRegorLove_, grufwub, NaomiAmethyst, WinnerWind, [KevinMarks], thegreekgeek__, barnaby, Pixi`, [pcarrier]1, [Al_Abut]1, xoxoxhimo, Pixi and [jeremycherfas] joined the channel
# 
[jeremycherfas] I seem to remember reading somewhere that sending some bots to a 404 is better than just blocking, because the bot might then learn not to keep trying. I’m thinking in particular of bots targeting any WordPress-related URL, since the site does not even use WP. Is that a worthwhile approach?
GuestZero joined the channel
# [jeremycherfas] I suppose not, even though it would enable them to move on to the next site a teeny bit quicker.
ZodiacalComet, barnaby, WinnerWind, Chin, proofreed, ax562 and rod joined the channel
# 
[Kupietz] Depends what you mean by “blocking” and the seriousness of the bot problem. A 404 response still consumes server resources. If you can block them at the firewall or Cloudflare level, before they reach your web server, so much the better.
ax562 and [dmitshur] joined the channel
# 
[dmitshur] Lately I've seen various discussions about how new-ish tooling is making it easier to uncover vulnerabilities (e.g., https://red.anthropic.com/2026/mythos-preview/, https://news.ycombinator.com/item?id=47679155) and I can't help but wonder how this'll interact with the desire to self-host, especially in the context of individuals having limited time and resources to do so. My confidence in my ability to secure a VM that's serving
# [dmitshur] traffic to the public internet is kinda waning, and increasingly relying on my personal website not being a very interesting target for anyone malicious doesn't feel great. 😕
# [dmitshur] Hello. 🙂 I've had increasingly little free time, and my personal website was kinda "done", so I was away a bit. I got into photography recently so I am motivated to find a better solution to hosting photos than dropping them into a https://dmitri.shuralyov.com/temp/_DSC2346.avif directory. Plus the topic I mentioned above is starting to feel like a (unwanted) priority. 😅
# 
[capjamesg] Oooh I love your website [dmitshur]!
# [capjamesg] I have been thinking too about how Mythos changes how we think about code security.
# [capjamesg] I went through the CodeQL suggestions that you can get with GitHub for two projects last week and made some fixes.
# [dmitshur] I'll have to play around with that stuff too, it'd be interesting what it might find in my code base. That said, I'm much more worried about everything external, such as the OS, ssh config, and so on. I'm kinda tied to having a local filesystem because it's kinda needed to be able to implement a git server, otherwise my site could run in a serverless environment where I can outsource more of the OS/misc dependency maintenance to
# [dmitshur] a cloud provider. Yeah, I am jealous of static sites, they're so much easier to secure. :)
barnaby and [snarfed] joined the channel
# [snarfed] most of our sites here (including mine) are probably sitting on multiple unpatched n-day vulnerabilities, we're all getting probed relentlessly by large scale, automated fingerprint/vuln scanners, and we all probably have weak points (weak passwords, phishable 2FA, tokens in poorly secured services, supply chain risks) in our various auth stacks
Ixsudo joined the channel
# [dmitshur] I agree with indie websites generally being low-value distributed targets and so high profile vulns aren't as directly relevant. The part that appears to be changing is how low the bar may become over time, without needing expertise, e.g., "the kind of findings that were previously only achievable by expert professionals." Anyway, maybe something useful I can do to see how much of a problem this is now is to allocate an hour next
# [dmitshur] weekend, and see if that's enough time to actually find any meaningful problems in my own site and its environment.
barnabywalters joined the channel
# [capjamesg] What is security?
# 
Loqi security in the context of the indieweb may refer to security concerns regarding personal domains, web hosting, https setup, private data, identity etc https://indieweb.org/security
# [Kupietz] I can’t pretend to be an authority, but I worry about our small personal sites being used as the middleman in bot and spam attacks. It actually happened to me once, it’s gotta be close to 10 years ago now, but my tiny professional site got infected with malware that was sending out spam. And I recently had to clean up a small nonprofit client’s site that had a particularly devious attack… Somebody got into their code injec
# [Kupietz] plug-in (a pretty common thing on WordPress unfortunately) so neither a site scan nor my manual search turned up anything, and inserted code that checked the referrer, looking for people coming from the search engines (i.e., not the site owner,) and injected ads.
NaomiAmethyst joined the channel