Nostr Web Client

Pleroma is full of security vulnerabilities because OnlyFans paid people on Upwork to implement a bunch of features nobody wants.

Have you ever tried downloading an emoji pack from a server? No? Well that's the vulnerable code.

Anyway, hopefully everyone is using s3 for uploads by now and has the dedupe filter enabled.

Patch is being merged into Rebased now: https://gitlab.com/soapbox-pub/rebased/-/merge_requests/263

A patch was ready yesterday but I figured I'd wait til after it landed upstream first.

nostr:note1ch09jq7ywc26h8jdprrd3k67ufllqy7fm5t3qd2lxeud9kvtrwnsc7p442

Reply to this note

Please Login to reply.

Discussion

Purple Cat with a PC-98 (and X68K) 2y ago

nostr:npub108pv4cg5ag52nq082kd5leu9ffrn2gdg6g4xdwatn73y36uzplmq9uyev6 nostr:npub12haw8lqt6g57r8zk9vc7w32cezuu2d5tcqpsarquntgfl5n0wrjq8nxxk6 >Pleroma is full of security vulnerabilities because OnlyFans paid people on Upwork to implement a bunch of features nobody wants.

Also there's nobody auditing it. As jank as Mastodon is, they have processes for dealing with this too and a bug bounty.

https://arstechnica.com/security/2023/07/mastodon-fixes-critical-tootroot-vulnerability-allowing-node-hijacking/

https://docs.joinmastodon.org/dev/disclosure/

Sayar Tyler :fediverse: 2y ago

nostr:npub108pv4cg5ag52nq082kd5leu9ffrn2gdg6g4xdwatn73y36uzplmq9uyev6 Wait... Is OF based on Pleroma?

dog's best friend 2y ago

> to implement a bunch of features nobody wants.

come on man, that's not fair. When federated instance emojis were first happening people wanted an easy way to download entire emoji packs from other servers. Don't rewrite history.

Lots of times users request features that nobody ever uses. That's the problem with having users. They always think they know what they want.

dog's best friend 2y ago

also Elixir is memory/thread safe, so no it's not "full of vulnerabilities".

Gay, loud and annoying ! :flag: :transdprk: 2y ago

nostr:npub108pv4cg5ag52nq082kd5leu9ffrn2gdg6g4xdwatn73y36uzplmq9uyev6 nostr:npub12haw8lqt6g57r8zk9vc7w32cezuu2d5tcqpsarquntgfl5n0wrjq8nxxk6 >Have you ever tried downloading an emoji pack from a server?

Yes I use it to sync emoji between sgsgb and ebinclub. It's also broken.

123ec005... 2y ago

nostr:npub108pv4cg5ag52nq082kd5leu9ffrn2gdg6g4xdwatn73y36uzplmq9uyev6 nostr:npub12haw8lqt6g57r8zk9vc7w32cezuu2d5tcqpsarquntgfl5n0wrjq8nxxk6 Nigger you flip-flop between begging for Pleroma commit access and calling Pleroma out for not adhering to your wife's blog. No wonder everyone ghosts you.