Bluesky Exploits

by shakna • 3 years ago

98 64 3 years ago

riffic2• 3 years ago

just throwing out there that ActivityPub has been given Recommendation status at the W3C (what is a recommendation? https://www.w3.org/standards/)

ATProto is a NIH reinvention of the wheel by a "public benefit LLC" of unclear ownership* that has demonstrated time and again its unwillingness to take a seat at the table within a group like the W3C or the IETF in protocol development.

What is ActivityPub, you may ask? https://en.wikipedia.org/wiki/ActivityPub

* EDIT: I completely missed there was Bluesky $8M seed round in July, lol. It's now a public benefit C Corp whatever that means.

https://techcrunch.com/2023/07/05/bluesky-announces-its-8m-s...

paxys• 3 years ago

"Public benefit" is simply a marketing term when applied to a private for-profit corporation. It operates like any other company, with an extra line in its mission statement that it will operate for the public good. What does that mean? Nothing. Who enforces it? No one.

its-summertime• 3 years ago

Jeremie and Bryan, at least, have interacted (and at least Jeremie has drafted multiple RFCs) with the IETF.

Current mailing list items specific to bluesky

https://mailarchive.ietf.org/arch/search/?q=bluesky&qdr=y

riffic2• 3 years ago

I am not on a first name basis with the people involved. If they're already involved in IETF processes I am sure they're familiar with the Independent Submission process for the RFC Editor (RFC 4846)

https://www.rfc-editor.org/about/independent/

olah_1• 3 years ago

ActivityPub is fine as long as you're okay with a specific server owning your account and all your data. Many people just want that not to be the case.

4lex_8• 3 years ago

I can’t be the only one who finds a lot of these new federated social networks to be a bit fishy… the whole idea is really great but bluesky & now metas “threads” are really only pseudo-federated. They both claim the future option to choose your instance but by default you start out on their centralized instance. This feels like a predatory tactic to be able to control the average user who doesn’t care about the value of decentralized networks.

orliesaurus• 3 years ago

I have a bluesky account but I am not active..yet - are a lot of people active? I need some people from HN to follow...anyone?

romesc2• 3 years ago

If you send me an invite, I pinky promise I will post something interesting and we can have a HN clique of at least 2. =D Email: {HNusername}@live.com

defatigable4• 3 years ago

Not OP, but I have an extra - I emailed it to you.

djbusby• 3 years ago

I'm not there I'd take an invite

defatigable4• 3 years ago

I've got a few extra, happy to send you one. What's the easiest way?

Hamuko• 3 years ago

I'm somewhat active on Bluesky. Managed to find a couple of people to follow and talk about video games. It's kinda nice.

(I have 3 invite codes available if people are still desperate for them)

vsgherzi2• 3 years ago

YES PLZ !

wrboyce• 3 years ago

Invite would be great if you still have one going; me at willboyce dot com, thanks.

mattl• 3 years ago

Been there a few weeks, approx 600 followers. What’s your handle?

matsemann2• 3 years ago

Most of the people in Norway I followed on Twitter did a mass exodus over there a month ago, and it seems to have gained critical mass in my circle, at least.

With Mastodon only a few people tried, and when it didn't get much traction they stopped posting there quickly.

TheAceOfHearts• 3 years ago

There doesn't seem to be any response to this from the Blue Sky team so far.

I can't help but think that Jack doesn't believe in Blue Sky that much. From what I can find, he doesn't seem to participate or even have an account. Meanwhile, at least Elon and Mark both post regularly on their social media sites.

wmf3• 3 years ago

Jack moved on to Nostr.

Uehreka• 3 years ago

While I’m guessing this is a joke, it would also be the most Jack thing ever if true.

ruined2• 3 years ago

these are pretty boring. we've been playing with them for months now. there was no response because people have beat the hell out of this particular horse already

if you consider it an exploit you should probably consider, say, github issues markdown to be exploitable

the tl;dr is the server shouldn't trust the client and the client shouldn't trust the server to supply accurate link cards or link metadata.

right now it's not a huge deal because there's only one instance and it is invite-only. consider it demo grade software.

pfraze3• 3 years ago

all media uploads live forever and are publicly retrievable even if you mark the associated post for deletion

I have no idea what this is referring to

ruined2• 3 years ago

hmmm, maybe i misunderstood. edited out

pfraze3• 3 years ago

We know about these. We have mitigations planned. We don’t think they’re cause for huge alarm.

Bluesky posts have a rich text system, which means links in posts are similar to anchor tags. It’s not a markup; it’s a way to annotate slices of a string with facets such as links or bold or etc. This means you can linkify any text, thus the first concern raised. We intend to create an interstitial warning if the linkified text doesn’t show the domain clearly.

The posts also have an embed system for images, links, and other posts. We currently naively accept the link cards as published, and we need to stop doing that and fetch the link cards on read instead.

Retr0id2• 3 years ago

As someone who's been following development and the situation in general, I just thought I'd pop in to say "I second this" - which normally wouldn't be a very useful reply, but I think people are (rightfully) skeptical of first-party claims when it comes to the significance of security issues.

evbogue7• 3 years ago

Paul, take a break and let your superiors answer for their design decisions.

Retr0id2• 3 years ago

afaik, Paul designed the rich text system.

wpietri• 3 years ago

And if they drop by, they could also address the poor handling of security reports as described in the fine article. Because if the only way to get a reply about security issues is to get it to the front page of HN, that's a sign to me that the security team, if there is one, is deeply underwater.

dang2• 3 years ago

Please don't cross into personal attack. It's not what this site is for, and destroys what it is for.

https://news.ycombinator.com/newsguidelines.html

hannob• 3 years ago

It's definitely a case for huge alarm.

Maybe not the vulns. But the interaction with a security researcher. Like this part: "Bluesky has responded to only one of these reports, one time, 4 days after submission, saying "We appreciate the report, and we'll be taking a closer look at the issue.". They did not follow up on that report and they have not responded to any of my other reports."

It shows all signs of a company without a working security process.

greyface-• 3 years ago

If a website accepts (safely sanitized) HTML input, and I report that it's a security issue that I'm allowed to post:

  <a href="https://evil.com/">good.com</a>

, how much of a response am I owed?

"Yes, thank you, we're aware" seems more than adequate to me. Engaging a full-blown vulnerability disclosure process for something like this seems like a waste of time for everyone involved.

jakebsky• 3 years ago

I'm one of the engineers at Bluesky that handles incoming security reports. We of course do take reported security issues very seriously. We have worked positively with a number of researchers.

The initial email in this case was received on a Friday afternoon, reviewed briefly for severity, and then acknowledged on the following Tuesday. There was a reply from another engineer on Wednesday to a reply by the reporter.

But we certainly could have followed-up better, and we could have been more clear. We're a very small team and the severity was deemed low, but even so we'll try to do better in the future for similar cases.

We do want to handle these kinds of reports better than most companies do. Creating a safe and secure system for users (which include our own families and friends) is something the team very genuinely cares deeply about.

Borgz• 3 years ago

I think it's better to just not allow custom text for links. It's the behavior people are accustomed to from years of using various social media platforms.

davidgerard2• 3 years ago

fetch the link cards on read instead.

do you mean, hitting a site every time someone loads a post?

that's going to lead to some obvious issues with hammering sites

soap-3• 3 years ago

These aren't really "exploits" in the traditional sense, it's just misrepresenting a link card.

BryantD• 3 years ago

Agreed. You can do this on Slack, mostly.

hn1986• 3 years ago

I was rickrolled on Slack last year. Not cool..

aidenn02• 3 years ago

What is Bluesky? https://bsky.app/ shows nothing but a sign-in page and wikipedia doesn't seem list it either.

sundaeofshock• 3 years ago

Really?

https://en.m.wikipedia.org/wiki/Bluesky_Social

aidenn02• 3 years ago

Ah, the "Social" was the part I was missing. Just searching for "Bluesky" takes you to https://en.wikipedia.org/wiki/Blue_Sky

housemusicfan• 3 years ago

If an exploit is used in a forest, and no one's around to hear it....

askiiart• 3 years ago

Author's Mastodon post: https://fosstodon.org/@north/111057335768073441

evbogue7• 3 years ago

The biggest Bluesky exploit is not mentioned in the article, which is they hold your private keys.

evbogue7• 3 years ago

Regarding the downvote. Am I wrong?

wmf3• 3 years ago

You've made your point; you don't need to keep posting the same thing. If the whole point of Bluesky is to be decentralized, should they have first released a centralized beta version? IMO no, but they had reasons that make sense. It looks like they are still planning to decentralize in good faith.

evbogue7• 3 years ago

I understand what you're saying here.

ctas• 3 years ago

Please take into account that Bluesky is still young and run by a small team which is moving fast. Ignoring a few reports that they consider non-critical is not a strong negative signal, especially not during a time of rapid growth and while they're in beta and invite-only. They just cracked the million users and are probably navigating through a lot of chaos on a daily basis. Those of us who've been in similar situations know that this is normal.

Bluesky Exploits

Related Stories