graham

@graham

from online

any / all

Making stuff to distract myself from existential dread

Art: @graham-illustrations
Dreams: @graham-dream-journal
Wizards: @make-up-a-wizard
Partner's Pottery: @kp-pottery

graham @graham11/14/2022, 4:28 AM

Osmose @Osmose

cohost dot org @staff11/14/2022, 3:54 AM

minor update to the post parsing code

hi folks! we've made a breaking change to how we parse posts

many of you are likely aware that we created a new Age Of Posting back in July to ban the use of position: fixed in CSS on posts. we became aware tonight of a way this restriction could be circumvented.

we prevented use of position: fixed to remove the risk of a poster covering site UI with potentially malicious content. because of this, and because the actual rule isn't changing, we have changed the system we use to filter it out without incrementing the current Age of Posting. we are aware this will break some posts. sorry about that.

IF YOU POSTED USING THE CIRCUMVENTION METHOD: you are not in trouble, but those posts won't work anymore.

IF YOU DISCOVERED THE CIRCUMVENTION METHOD: please email us next time. it sucks to go on cohost at 8pm on a sunday and discover this issue via Posts. thanks in advance.

that's enough work for sunday. thanks for using cohost! :eggbug:

Osmose @Osmose11/14/2022, 4:20 AM

for real though this was a security vuln please report instead of posting when you find this kinda stuff

You must log in to comment.

in reply to @staff's post:

Azzy @Snackteeth11/14/2022, 4:20 AM

Thank you for you hard work and quick action! As fun as the little projects were to see, it seems like moderating this site can feel like corralling a herd of cats sometimes. :>

Talen Lee @TalenLee11/14/2022, 4:31 AM

it's very funny how cohost's most visible problem is that cohost is appealing to the kind of people who will dick around with cohost for fun

easrng @easrng11/14/2022, 4:21 AM

aw :(

Heather @teabee11/14/2022, 4:21 AM

I wondered when I saw a couple of different posts, but just assumed they were allowed methods. 😅

Daniel Martin @fizbin11/14/2022, 2:38 PM

I have realized from the "look at the time" posts that it must be the case that images loaded via certain CSS constructs (possibly all images? I haven't checked) are pulled at post load time by the user's browser, and therefore the old "transparent 1x1 gif w/ cookies" trick should work as a way to get some basic cohost post analytics/reader tracking.

Of course, most browsers these days block third-party cookies, but they might not block them on all paths so that would require some experimentation. (And even if they did block cookies directly, the advances in browser fingerprinting are impressive)

Jill @JillKatze11/14/2022, 2:58 PM

my incorrect read on staff attitude toward this was that it would be met with amusement followed by a swift patch while muttering about “those wacky kids and their Posts”. i suppose the difference between this and the end of the first age is several tens of thousands of users and the stress that comes with that. sorry for piling on to the amount of contraband posts, and thank you for your work on the webbed site. may the toasters safeguard you from beyond

finny @finny11/14/2022, 5:44 PM

i reported this issue via "report a bug" two separate times since july, with repro steps and screenshots. just wondering what i should've done differently?

Pinned Tags