c-t-

C. T.

@c-t-

My name is initials, I'm cool

  • she/her

artist, bisexual menace, smol

log in
c-t-
@c-t-
slimelia
@slimelia
janederscore
@janederscore

no offense to the people making cute little widgets on cohost and i do believe them that they've all been pretty careful to prevent themselves from accidentally building ip scrapers and such. however the fact that ethics are the only thing that appears to be preventing someone from doing that Intentionally on their own funnie little poasts is uh, Concerning

Predstrogen
@Predstrogen
This page's posts are visible only to users who are logged in.
log in
jeady
@jeady
This page's posts are visible only to users who are logged in.
log in
minecraft
@minecraft

fun fact: these are made using PHP embedded as images (since cohost doesn't sanitize img src attributes, and the requests ignore CORS since they're inline images), and unlike when your browser fetches HTML documents, PHP files and the scripts within are processed entirely on their original server and only the result is sent to your machine, so these widgets are effectively closed-source and you can only take people's word for it that they're anonymizing your data!

loth-catgirl
@loth-catgirl

oh this is dangerous enough to kill the site

You must log in to comment.

in reply to @janederscore's post:

janederscore
@janederscore

so what i'm talking about are posts that log identifying user information in order to serve you a specific thing. the post i'm talking about rn is one that's going around that gives you a fake little "post viewing debt" counter that will update every time your computer loads the post. an older, more Blunt example is the "spongebob literally doxxes you" post, where it's a randomly-selected image from spongebob squarepants with a text element overlayed that reads out your physical location.

both of the authors of these posts have stated that they went through the effort of anonymizing the data, and the spongebob poster specifically said that the information is not logged. and again, i do believe them! the people who made those posts seem trustworthy and i don't really feel like there's anything malicious at play whatsoever.

However . the issue i have is that when users are empowered to that extent, when the only restriction on their power is their own model of ethics, what is stopping someone from building a much more sinister machine. who's to say someone hasn't Already built a much more sinister machine, hidden in a completely innocuous image post that is already circulating.

the question of "malware on cohost" is not an if but a when, and honestly there probably already Are pieces of malware circulating that no one has yet been made aware of. i'm not a compsci major, i don't know how to solve this problem without gutting the user-accessible css tools, but its something that i think would probably be an extremely high priority problem to solve if i was running the show here.

login to reply

in reply to @Predstrogen's post:

noa
@noa

btw, requests to images on external servers can do the same thing, the server can log the request. if you want to prevent any potential external ip logging, you have to prevent any requests that go off the cohost domain & cdn. cohost themselves could do this with a content security policy if they wanted, but it would break lots of posts.

login to reply