My website and its RSS feed were/are compromised. 😱
I’m working on fixing things up. Thank you to everyone who reported the problem to me. (And, I suppose, thanks for subscribing to my blog!)
2
Replies
0
Boosts
phew, glad you caught it early and good luck with the cleanup! :)
reading up on feed security got me down a rabbit hole a while ago, especially regarding how RSS clients handle external styles (like PortSwiggers breakdown on CSS exfiltration vectors):
https://portswigger.net/research/css-the-bomb-inside-your-inbox
it made me wonder: do you happen to know offhand which RSS readers aggressively strip or sand-box inline CSS/style tags for better security or do most desktop clients just trust the markup?
@rmondello ouch that sucks, good luck fixing
