My website and its RSS feed were/are compromised. 😱
I’m working on fixing things up. Thank you to everyone who reported the problem to me. (And, I suppose, thanks for subscribing to my blog!)
6
Replies
0
Boosts
@rmondello
I’m very sorry. The one-time code experience on iMessage had been getting some praise online in Japan, and when I mentioned your Mastodon in that context, it may have caused an unexpected surge of traffic to your server. I didn’t realize this until later. I’ve since deleted the post, so I hope this won’t happen again.
I’m truly sorry for the trouble I caused.
@rmondello this never would have happened with iWeb.
@rmondello are you going to do a (mini) writeup of what happened, just in case so others can avoid the same issue?
@rmondello Just saw this on your RSS feed - what a pain in the ass. Good luck!
phew, glad you caught it early and good luck with the cleanup! :)
reading up on feed security got me down a rabbit hole a while ago, especially regarding how RSS clients handle external styles (like PortSwiggers breakdown on CSS exfiltration vectors):
https://portswigger.net/research/css-the-bomb-inside-your-inbox
it made me wonder: do you happen to know offhand which RSS readers aggressively strip or sand-box inline CSS/style tags for better security or do most desktop clients just trust the markup?
@rmondello ouch that sucks, good luck fixing
