home.social

Search

1000 results for “href”

  1. Alexander Goeres 𒀯 @[email protected] ·
    mal eine interessante folge über wissenschaftsbücher. besonders florians klingt spannend,

    @Florian Freistetter : Die Farben des Universums #^https://amzn.to/3WThXDn

    hat auch eine gute begründung dafür, dass man das buch vorbestellen sollte ... :-)

    #wissenschaft #podcast #internet #HolgerKlein #FlorianFreistetter

    #^      wrint: gespräche zum runterladen    
    Eine Sammlung von Podcasts, die von Holger Klein produziert werden. Weil in jeder Sendung geredet wird, habe ich mir erlaubt, das Projekt nach einem Satz aus Gottfried Benns Gedicht “Kommt” zu benennen. Der Satz lautet “Wer redet ist nicht tot” und seine Anfangsbuchstaben bilden das Akronym WRINT.

    Wer hier auf "Abonnieren" klickt, bekommt einen Feed, in den sämtliche Wrint-Produktionen chronologisch einlaufen.

    Die Podcasts sind kostenlos. Eure <a href="https://holgerklein.de/support.html">Unterstützung</a> hält das Projekt am Leben.
    #florianfreistetter #wissenschaft #holgerklein #internet #podcast
  2. Alexander Goeres 𒀯 @[email protected] ·
    mal eine interessante folge über wissenschaftsbücher. besonders florians klingt spannend,

    @Florian Freistetter : Die Farben des Universums #^https://amzn.to/3WThXDn

    hat auch eine gute begründung dafür, dass man das buch vorbestellen sollte ... :-)

    #wissenschaft #podcast #internet #HolgerKlein #FlorianFreistetter

    #^      wrint: gespräche zum runterladen    
    Eine Sammlung von Podcasts, die von Holger Klein produziert werden. Weil in jeder Sendung geredet wird, habe ich mir erlaubt, das Projekt nach einem Satz aus Gottfried Benns Gedicht “Kommt” zu benennen. Der Satz lautet “Wer redet ist nicht tot” und seine Anfangsbuchstaben bilden das Akronym WRINT.

    Wer hier auf "Abonnieren" klickt, bekommt einen Feed, in den sämtliche Wrint-Produktionen chronologisch einlaufen.

    Die Podcasts sind kostenlos. Eure <a href="https://holgerklein.de/support.html">Unterstützung</a> hält das Projekt am Leben.
    #podcast #internet #holgerklein #wissenschaft #florianfreistetter
  3. ekari @[email protected] ·

    #yle #areena on mainio, mutta ei täydellinen. Podcastien tilauksissa täytyy käsin ährätä urlin kanssa. Erään kerran ärsytyskynnys ylittyi, ja väsäsin bookmarkletin.

    Toiminta: selaimella podcastin pääsivulle, ja sitten klikataan bookmarklettia, jolloin pitäisi löytyä palvelimelta haluttu rss-syöte.

    Käyttöönotto: lisää uusi kirjanmerkki, ja osoitekenttään alla oleva rimpsu:
    javascript:(() => {var l=location.href; var s=l.split("areena.yle.fi/"); location.href="feeds.yle.fi/areena/v1/series/)()

    Testattu: firefox ja librewolf.

    (Ylellä ei olisi suurikaan homma generoida tuota linkkiä itse, mutta vastaus on ollut "oivoi, ei pysty" kun olen tätä kysellyt. Parasta mitä yle-verolla tässä asiassa saa, on askarteluohje yle.fi/aihe/a/20-10006373 🤡 )

    #yle #areena
  4. Thomas Steiner :chrome: @[email protected] ·

    📢 New blog post! Using the Web Monetization API for fun 🤩
    and profit 🤑:

    🔗 blog.tomayac.com/2025/11/07/us

    Learn how I use the proposed #WebMonetization standard by the @Interledger Foundation on my blog to (hopefully) pay for my virtual private server! The whole secret is this tag:

    ```html
    <link rel="monetization" href="ilp.gatehub.net/348218105/eur" />
    ```

    #webmonetization
  5. de.hypotheses @[email protected] ·

    America's biggest classroom? Every year, hundreds of thousands of American schoolchildren visit Washington, D.C. on overnight trips as part of their school curriculum. Lauren Rever transforms the stories behind these trips into data-driven information using #ArcGIS #StoryMaps.

    Here are her lessons learned from embarking on a #DigitalHistory project. 👇

    href.hypotheses.org/5298

    #arcgis #storymaps #digitalhistory
  6. de.hypotheses @[email protected] ·

    America's biggest classroom? Every year, hundreds of thousands of American schoolchildren visit Washington, D.C. on overnight trips as part of their school curriculum. Lauren Rever transforms the stories behind these trips into data-driven information using #ArcGIS #StoryMaps.

    Here are her lessons learned from embarking on a #DigitalHistory project. 👇

    href.hypotheses.org/5298

    #arcgis #storymaps #digitalhistory
  7. de.hypotheses @[email protected] ·

    America's biggest classroom? Every year, hundreds of thousands of American schoolchildren visit Washington, D.C. on overnight trips as part of their school curriculum. Lauren Rever transforms the stories behind these trips into data-driven information using #ArcGIS #StoryMaps.

    Here are her lessons learned from embarking on a #DigitalHistory project. 👇

    href.hypotheses.org/5298

    #arcgis #storymaps #digitalhistory
  8. de.hypotheses @[email protected] ·

    America's biggest classroom? Every year, hundreds of thousands of American schoolchildren visit Washington, D.C. on overnight trips as part of their school curriculum. Lauren Rever transforms the stories behind these trips into data-driven information using #ArcGIS #StoryMaps.

    Here are her lessons learned from embarking on a #DigitalHistory project. 👇

    href.hypotheses.org/5298

    #digitalhistory #storymaps #arcgis
  9. de.hypotheses @[email protected] ·

    America's biggest classroom? Every year, hundreds of thousands of American schoolchildren visit Washington, D.C. on overnight trips as part of their school curriculum. Lauren Rever transforms the stories behind these trips into data-driven information using #ArcGIS #StoryMaps.

    Here are her lessons learned from embarking on a #DigitalHistory project. 👇

    href.hypotheses.org/5298

    #arcgis #storymaps #digitalhistory
  10. Morten Linderud @[email protected] ·

    I don't remember why, but apparently i scripted `/shrug` in my #irssi client to run `curl -s shrug.io`.

    Someone did not renew that domain and now redirecting to the godaddy landing page.

    I'm currently spamming people with "<!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>".

    #irssi
  11. surdfish @[email protected] ·

    Toot Around Crash Oou

    <blockquote class="mastodon-embed" data-embed-url="beige.party/@burritozen/115401" style="background: #FCF8FF; border-radius: 8px; border: 1px solid #C9C4DA; margin: 0; max-width: 540px; min-width: 270px; overflow: hidden; padding: 0;"> <a href="beige.party/@burritozen/115401" target="_blank" style="align-items: center; color: #1C1A25; display: flex; flex-direction: column; font-family: system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Oxygen, Ubuntu, Cantarell, 'Fira Sans', 'Droid Sans', 'Helvetica Neue', Roboto, sans-serif; font-size: 14px; justify-content: center; letter-spacing: 0.25px; line-height: 20px; padding: 24px; text-decoration: none;"> <svg xmlns="w3.org/2000/svg" xmlns:xlink="w3.org/1999/xlink" width="32" height="32" viewBox="0 0 79 75"><path d="M63 45.3v-20c0-4.1-1-7.3-3.2-9.7-2.1-2.4-5-3.7-8.5-3.7-4.1 0-7.2 1.6-9.3 4.7l-2 3.3-2-3.3c-2-3.1-5.1-4.7-9.2-4.7-3.5 0-6.4 1.3-8.6 3.7-2.1 2.4-3.1 5.6-3.1 9.7v20h8V25.9c0-4.1 1.7-6.2 5.2-6.2 3.8 0 5.8 2.5 5.8 7.4V37.7H44V27.1c0-4.9 1.9-7.4 5.8-7.4 3.5 0 5.2 2.1 5.2 6.2V45.3h8ZM74.7 16.6c.6 6 .1 15.7.1 17.3 0 .5-.1 4.8-.1 5.3-.7 11.5-8 16-15.6 17.5-.1 0-.2 0-.3 0-4.9 1-10 1.2-14.9 1.4-1.2 0-2.4 0-3.6 0-4.8 0-9.7-.6-14.4-1.7-.1 0-.1 0-.1 0s-.1 0-.1 0 0 .1 0 .1 0 0 0 0c.1 1.6.4 3.1 1 4.5.6 1.7 2.9 5.7 11.4 5.7 5 0 9.9-.6 14.8-1.7 0 0 0 0 0 0 .1 0 .1 0 .1 0 0 .1 0 .1 0 .1.1 0 .1 0 .1.1v5.6s0 .1-.1.1c0 0 0 0 0 .1-1.6 1.1-3.7 1.7-5.6 2.3-.8.3-1.6.5-2.4.7-7.5 1.7-15.4 1.3-22.7-1.2-6.8-2.4-13.8-8.2-15.5-15.2-.9-3.8-1.6-7.6-1.9-11.5-.6-5.8-.6-11.7-.8-17.5C3.9 24.5 4 20 4.9 16 6.7 7.9 14.1 2.2 22.3 1c1.4-.2 4.1-1 16.5-1h.1C51.4 0 56.7.8 58.1 1c8.4 1.2 15.5 7.5 16.6 15.6Z" fill="currentColor"/></svg> <div style="color: #787588; margin-top: 16px;">Post by @burritozen</div> <div style="font-weight: 500;">View on Mastodon</div> </a> </blockquote> <script data-allowed-prefixes="beige.party/" async src="beige.party/embed.js"></script>

    #fcf8ff #c9c4da #1c1a25
  12. mradcliffe @[email protected] ·

    @joachim I agree. Parsing that output gave me a headache. I would link to Issue Procedures & Etiquette > AI Generated Content in the future as part of your comment.

    I wonder if this might make a good community nudge template?

    <div class="nudge"><p>This discussion appears to include generative AI content that may easily be difficult to review or may contain inaccuracies without human intervention.</p><p>When using AI in the course of making a contribution to Drupal, we require you to:</p><ul><li>Disclose that AI was used in crafting the code or content.</li><li>Carefully review and test the output, to ensure it is relevant, and that it works.</li><li>Provide human intervention to correct inaccuracies, mistakes, or broken code.</li></ul><p>For more information, please refer to <a href="https://www.drupal.org/docs/develop/issues/issue-procedures-and-etiquette/issue-etiquette#s-ai-generated-content">AI Generated Content</a>.</p></div>

    Update: I created an issue for this after mistakenly using the nudge template issue above, and in the WIP template above I removed CWG mention.

    #drupal #ai #drupalcommunity
  13. mradcliffe @[email protected] ·

    @joachim I agree. Parsing that output gave me a headache. I would link to Issue Procedures & Etiquette > AI Generated Content in the future as part of your comment.

    I wonder if this might make a good community nudge template?

    <div class="nudge"><p>This discussion appears to include generative AI content that may easily be difficult to review or may contain inaccuracies without human intervention.</p><p>When using AI in the course of making a contribution to Drupal, we require you to:</p><ul><li>Disclose that AI was used in crafting the code or content.</li><li>Carefully review and test the output, to ensure it is relevant, and that it works.</li><li>Provide human intervention to correct inaccuracies, mistakes, or broken code.</li></ul><p>For more information, please refer to <a href="https://www.drupal.org/docs/develop/issues/issue-procedures-and-etiquette/issue-etiquette#s-ai-generated-content">AI Generated Content</a>.</p></div>

    Update: I created an issue for this after mistakenly using the nudge template issue above, and in the WIP template above I removed CWG mention.

    #drupalcommunity #ai #drupal
  14. jPoP Music - vTubes @[email protected] ·

    サザンオールスターズ様の【真夏の果実】を歌わせて頂きました。

    「今もこの胸に夏は巡る」

    ☾ご本家様
    youtu.be/0P1FloeKyF0?si=mukuBi

    ☾伴奏
    ✩entame rise様
    youtu.be/cfDVYESqBjI?si=5x3Zzj

    ☾Mix
    ✩アシタカ様
    Twitter.com/ashitaka_mix

    ☾Illustration.Movie
    ✩ねこぴー
    Twitter.com/nekopi_119

    ☾Vocal
    ✩睦月緋音
    youtube.com/@01hinari
    Twitter.com/h1nari01
    ✩ねこぴー
    href="Twitter.com/nekopi_119" target="_blank" rel="nofollow"&gt;Twitter.com/nekopi_119

    ※MVの背景はフリーのものをお借りしています。

    #歌ってみた #コラボ #真夏の果実 #サザンオールスターズ

    vtubes.tokyo/2008533/

    #歌ってみた #コラボ #真夏の果実 #サザンオールスターズ
  15. Ramin Honary @[email protected] ·
    the DuckDuckGo search engine has a “lite” version.

    https://start.duckduckgo.com/lite

    It’s even better than the original early 2000s-era Google front page, they don’t even have the “I’m feeling lucky” feature. It is precisely three elements: company name, query input field, search button.

    #tech #Internet #WebApps #smolweb #IndieWeb #DuckDuckGo #SearchEngine #Search #OnlineSearch

    Here, let me copy-paste the HTML source of this page here:

    <body>
<a name="top"></a>
<center id="lite_wrapper">
  <br>
  <span class="header">DuckDuckGo</span>
  <br><br>
  <form action="/lite/" method="post">
    <input class="query" type="text" size="40" name="q" autocomplete="off" value="" autofocus="">
    <input class="submit" type="submit" value="Search">
  </form>
  <br>
  <p class="html-only">
<!-- This is the Lite version.
     Get the full-JS version <a href="https://duckduckgo.com/">here</a>.
     //-->
  </p>
</center>
</body>
    #duckduckgo #indieweb #internet #onlinesearch #search #searchengine
  16. Ramin Honary @[email protected] ·
    the DuckDuckGo search engine has a “lite” version.

    https://start.duckduckgo.com/lite

    It’s even better than the original early 2000s-era Google front page, they don’t even have the “I’m feeling lucky” feature. It is precisely three elements: company name, query input field, search button.

    #tech #Internet #WebApps #smolweb #IndieWeb #DuckDuckGo #SearchEngine #Search #OnlineSearch

    Here, let me copy-paste the HTML source of this page here:

    <body>
<a name="top"></a>
<center id="lite_wrapper">
  <br>
  <span class="header">DuckDuckGo</span>
  <br><br>
  <form action="/lite/" method="post">
    <input class="query" type="text" size="40" name="q" autocomplete="off" value="" autofocus="">
    <input class="submit" type="submit" value="Search">
  </form>
  <br>
  <p class="html-only">
<!-- This is the Lite version.
     Get the full-JS version <a href="https://duckduckgo.com/">here</a>.
     //-->
  </p>
</center>
</body>
    #duckduckgo #indieweb #internet #onlinesearch #search #searchengine
  17. Ramin Honary @[email protected] ·
    the DuckDuckGo search engine has a “lite” version.

    https://start.duckduckgo.com/lite

    It’s even better than the original early 2000s-era Google front page, they don’t even have the “I’m feeling lucky” feature. It is precisely three elements: company name, query input field, search button.

    #tech #Internet #WebApps #smolweb #IndieWeb #DuckDuckGo #SearchEngine #Search #OnlineSearch

    Here, let me copy-paste the HTML source of this page here:

    <body>
<a name="top"></a>
<center id="lite_wrapper">
  <br>
  <span class="header">DuckDuckGo</span>
  <br><br>
  <form action="/lite/" method="post">
    <input class="query" type="text" size="40" name="q" autocomplete="off" value="" autofocus="">
    <input class="submit" type="submit" value="Search">
  </form>
  <br>
  <p class="html-only">
<!-- This is the Lite version.
     Get the full-JS version <a href="https://duckduckgo.com/">here</a>.
     //-->
  </p>
</center>
</body>
    #tech #smolweb #webapps #searchengine #search #onlinesearch
  18. Ramin Honary @[email protected] ·
    the DuckDuckGo search engine has a “lite” version.

    https://start.duckduckgo.com/lite

    It’s even better than the original early 2000s-era Google front page, they don’t even have the “I’m feeling lucky” feature. It is precisely three elements: company name, query input field, search button.

    #tech #Internet #WebApps #smolweb #IndieWeb #DuckDuckGo #SearchEngine #Search #OnlineSearch

    Here, let me copy-paste the HTML source of this page here:

    <body>
<a name="top"></a>
<center id="lite_wrapper">
  <br>
  <span class="header">DuckDuckGo</span>
  <br><br>
  <form action="/lite/" method="post">
    <input class="query" type="text" size="40" name="q" autocomplete="off" value="" autofocus="">
    <input class="submit" type="submit" value="Search">
  </form>
  <br>
  <p class="html-only">
<!-- This is the Lite version.
     Get the full-JS version <a href="https://duckduckgo.com/">here</a>.
     //-->
  </p>
</center>
</body>
    #duckduckgo #indieweb #internet #onlinesearch #search #searchengine
  19. 洪 民憙 (Hong Minhee) :nonbinary: @[email protected] ·

    Today I discovered an interesting inconsistency in Activity Streams specs while investigating a Fedify issue.

    The question: How should we interpret URLs like "icon": "https://example.com/avatar.png"?

    JSON-LD context (https://www.w3.org/ns/activitystreams): @type: "@id" → “This is an IRI reference, dereference it to fetch an ActivityStreams object.”

    Activity Streams Primer: “assume that a bare string is the href of a Link object, not an id” (no dereferencing)

    Result: JSON-LD processor-based implementations try to parse PNG files as JSON and fail.

    Turns out w3c/activitystreams#595 already discusses the same issue for href properties. I added a note that icon, image, etc. have the same problem.

    Once again reminded of how tricky spec work can be…

    #ActivityPub #Fedify #ActivityStreams #fedidev #specifications

    #fedify #fedidev #activitypub #specifications #activitystreams
  20. Ciourte Piaille @[email protected] ·

    No answere. Oh well. 🤷
    Meanwhile, I found and adapted a repository with CSS to hide most of #Kagi AI stuff.

    /* Hide most "AI" stuff */
    /* Inspired by codeberg.org/zerodogg/kagi-no- */
    #assistant,
    #accountContainer a[href^="/summarizer"],
    #accountContainer a[href="/fastgpt"],
    ._0_summarize_link,
    hr:has(+ ._0_summarize_page),
    ._0_summarize_page,
    ._0_discuss_document,
    .search_form_box:has(#searchBar:placeholder-shown) .newsRedirect,
    .auto_item:has([*|href="#bolt"])
    { display: none !important }

    I also found out there's an option to disable the assistant for children. So it seems very doable if only they wanted to give the option to all their customers.

    @pluralistic

    #kagi #assistant #accountcontainer #searchbar #bolt
  21. Ciourte Piaille @[email protected] ·

    No answere. Oh well. 🤷
    Meanwhile, I found and adapted a repository with CSS to hide most of #Kagi AI stuff.

    /* Hide most "AI" stuff */
    /* Inspired by codeberg.org/zerodogg/kagi-no- */
    #assistant,
    #accountContainer a[href^="/summarizer"],
    #accountContainer a[href="/fastgpt"],
    ._0_summarize_link,
    hr:has(+ ._0_summarize_page),
    ._0_summarize_page,
    ._0_discuss_document,
    .search_form_box:has(#searchBar:placeholder-shown) .newsRedirect,
    .auto_item:has([*|href="#bolt"])
    { display: none !important }

    I also found out there's an option to disable the assistant for children. So it seems very doable if only they wanted to give the option to all their customers.

    @pluralistic

    #kagi #assistant #accountcontainer #searchbar #bolt
  22. Ciourte Piaille @[email protected] ·

    No answere. Oh well. 🤷
    Meanwhile, I found and adapted a repository with CSS to hide most of #Kagi AI stuff.

    /* Hide most "AI" stuff */
    /* Inspired by codeberg.org/zerodogg/kagi-no- */
    #assistant,
    #accountContainer a[href^="/summarizer"],
    #accountContainer a[href="/fastgpt"],
    ._0_summarize_link,
    hr:has(+ ._0_summarize_page),
    ._0_summarize_page,
    ._0_discuss_document,
    .search_form_box:has(#searchBar:placeholder-shown) .newsRedirect,
    .auto_item:has([*|href="#bolt"])
    { display: none !important }

    I also found out there's an option to disable the assistant for children. So it seems very doable if only they wanted to give the option to all their customers.

    @pluralistic

    #kagi #assistant #accountcontainer #searchbar #bolt
  23. Ciourte Piaille @[email protected] ·

    No answere. Oh well. 🤷
    Meanwhile, I found and adapted a repository with CSS to hide most of #Kagi AI stuff.

    /* Hide most "AI" stuff */
    /* Inspired by codeberg.org/zerodogg/kagi-no- */
    #assistant,
    #accountContainer a[href^="/summarizer"],
    #accountContainer a[href="/fastgpt"],
    ._0_summarize_link,
    hr:has(+ ._0_summarize_page),
    ._0_summarize_page,
    ._0_discuss_document,
    .search_form_box:has(#searchBar:placeholder-shown) .newsRedirect,
    .auto_item:has([*|href="#bolt"])
    { display: none !important }

    I also found out there's an option to disable the assistant for children. So it seems very doable if only they wanted to give the option to all their customers.

    @pluralistic

    #bolt #searchbar #accountcontainer #assistant #kagi
  24. Dining and Cooking @[email protected] ·

    45 Best Finger Food Ideas and Appetizers for Parties

    1Spice-Rubbed Chicken Lettuce CupsMike Garten This flavorful, crunchy meal is made with a simple spice rub, chicken breast, and fresh lettuce leaves. T…
    #dining #cooking #diet #food #Christmas #christmas #ChristmasAppetizes #christmasdesserts #christmasdinner #christmasdinnerrecipes #christmasfood #christmasrecipes #christmassides #HreflangEvergreen
    diningandcooking.com/2262470/4

    #dining #cooking #diet #food #christmas #christmasappetizes
  25. Pietro di Caprio @[email protected] ·

    📣 Hello! We've formally sent a proposal to the GNOME Foundation and KDE e.V. leadership for a unified Linux App Summit (LAS) that would merge GUADEC, Akademy, and the current LAS into a single event.

    We're sharing it with you as an open letter. Our goal is to create a more efficient, cost-effective, and impactful conference for everyone. We invite you to read the full proposal and share your thoughts.

    🔗 href.tf/LAS2026

    #Linux #GNOME #KDE #FOSS #OpenSource #LAS2026 #GUADEC #Akademy

    #linux #gnome #kde #foss #opensource #las2026
  26. Terence Eden’s Blog @[email protected] ·

    Security Flaws in the WebMonetization Site

    shkspr.mobi/blog/2025/08/secur

    I've written before about the nascent WebMonetization Standard. It is a proposal which allows websites to ask users for passive payments when they visit. A visitor to this site could, if this standard is widely adopted, opt to send me cash for my very fine blog posts.

    All I need to do is add something like this into my site's source code:

    <link rel="monetization" href="https://wallet.example.com/edent">

    A user who has a WebMonetization plugin can then easily pay me for my content.

    But not every website is created by an individual or a single entity. Hence, the creation of the "Probabilistic Revenue Share Generator".

    Probabilistic revenue sharing is a way to share a portion of a web monetized page's earnings between multiple wallet addresses. Each time a web monetized user visits the page, a recipient will be chosen at random. Payments will go to the chosen recipient until the page is closed or reloaded.

    Nifty! But how does it work?

    Let's say a website is created by Alice and Bob. Alice does most of the work and is to receive 70% of the revenue. Bob is to get the remaining 30%. Within the web page's head, the following meta element is inserted:

    <link   rel="monetization"   href="https://webmonetization.org/api/revshare/pay/W1siaHR0cHM6Ly9leGFtcGxlLmNvbS8iLDcwLCJBbGljZSJdLFsiaHR0cHM6Ly93aGF0ZXZlci50ZXN0LyIsMzAsIkJvYiJdXQ"/>

    The visitor's WebMonetization plugin will visit that URl and be redirected to Alice's site 70% of time and Bob's 30%.

    If we Base64 decode that weird looking URl, we get:

    [   [      "https://example.com/",       70,      "Alice"   ],   [      "https://whatever.test/",       30,      "Bob"   ]]

    Rather than adding multiple URls in the head, the site points to one resource and lets that pick who receives the funds.

    There are two small problems with this.

    The first is that you have to trust the WebMonetization.org website. If it gets hijacked or goes rogue then all your visitors will be paying someone else. But let's assume they're secure and trustworthy. There's a slightly more insidious threat.

    Effectively, this allows an untrusted 3rd party to use the WebMonetization.org domain as an open redirect. That's useful for phishing and other abuses.

    For example, an attacker could send messages encouraging people to visit:

    https://webmonetization.org/api/revshare/pay/W1siaHR0cHM6Ly9leGFtcGxlLmNvbS8iLDk5LCJpbWciXV0

    Click that and you'll instantly be redirected to a domain under the attacker's control. This could be particularly bad if the domain encouraged users to share passwords or other sensitive information.

    If the Base64 data cannot be decoded to valid JSON, the API will echo back any Base64 encoded text sent to it. This means an attacker could use it to send obfuscated messages. Consider, tor example:

    https://webmonetization.org/api/revshare/pay/W1siUGxlYXNlIHZpc2l0IFJlYWxfZ29vZF9DYXNpbm9zLmJpeiBmb3IgbG90cyBvZiBDcnlwdG8gZnVuISEhIiwxMjM0NTYsImltZyJdXQ==

    Visit that and you'll see a message. With a bit of effort, it could be crafted to say something to encourage a visitor to enter their credentials elsewhere.

    When I originally reported this, the site could be used to to smuggle binary payloads. For example, this URl would display an image - however, it seems to have been fixed.

    Nevertheless, it is important to recognise that the WebMonetization.org domain contains an unvalidated redirect and forwarding vulnerability.

    I recommended that they ensured that the only URls which contain legitimate payment pointers should be returned. I also suggested setting a maximum limit for URl size.

    Timeline

    #BugBounty #CyberSecurity #ResponsibleDisclosure #WebMonetization #xss

    #bugbounty #cybersecurity #responsibledisclosure #webmonetization #xss
  27. @reiver ⊼ (Charles) :batman: @[email protected] ·

    I link to my personal web-site from my Mastodon account.

    On my Mastodon account, that link shows up with the "verification" checkmark and highlight.

    I did that by adding special HTML code to my personal web-site.

    If you want to do the same — add similar code your personal web-site.

    Just replace my URL with yours.

    Ex:

    <link rel="me" href="YOUR_PROFILE_URL_HERE" />

    And, add that to the <head> section of the home-page of your personal web-site.

    #Fediverse #Mastodon #SpreadFediverse

    #fediverse #mastodon #spreadfediverse
  28. jPoP Music - vTubes @[email protected] ·

    最高の誕生日でした。
    また来年もこの場所で。

    Original：サマータイムレコード - じん
    youtube.com/watch?v=qB4xRKllye

    ・vocal：Nue (twitter.com/xxx_N_02)
    ・mix：カタムチｻﾏ (twitter.com/pile_kuwa)
    ・illustration：柊 れれ子ｻﾏ (twitter.com/Hi_ragi_rere_co)
    ・movie：日々乃ねむりｻﾏ ( href="twitter.com/hibinonemuri" target="_blank" rel="nofollow"&gt;twitter.com/hibinonemuri)

    #サマータイムレコード #じん #歌ってみた #cover #オリジナルmv

    vtubes.tokyo/1959965/

    #サマータイムレコード #じん #歌ってみた #cover #オリジナルmv
  29. jPoP Music - vTubes @[email protected] ·

    『優しさを明け渡し奪われてきた あなたにはわかるでしょう？』

    本家様：youtube.com/watch?v=MQhd0ne_uYo

    【credit】
    Music：キタニタツヤ 様　@TatsuyaKitani_Official
    x.com/TatsuyaKitani

    Vocal：むぎちゃ
    x.com/mugitya0703

    illust：田中 様　@tnk119
    x.com/akiha__ia

    MIX：混音もる 様　@mazarine_moru
    href="x.com/mazarine_moru" target="_blank" rel="nofollow"&gt;x.com/mazarine_moru

    ※本家様より動画素材お借りしました。

    #あなたのことをおしえて #キタニタツヤ #歌ってみた #cover #オリジナルMV

    vtubes.tokyo/1931991/

    #あなたのことをおしえて #キタニタツヤ #歌ってみた #cover #オリジナルmv
  30. jPoP Music - vTubes @[email protected] ·

    本家：Ado様
    MV youtu.be/SbxR25brgoE?si=KohDd5

    カラオケ音源は本家様のものを使用させていただきました。

    歌ったキー：原曲キー

    Vocal/Mix/Movie：心奏 - Kanade -
    ニコニコ(nicovideo.jp/user/1311691...)
    X(x.com/Kanade_uta70)
    Instagram(instagram.com/kana_deofficial)
    TikTok(tiktok.com/@kanade2939)

    Illust：maruo_nya様
    X( href="coconala.com/services/901951" target="_blank" rel="nofollow"&gt;coconala.com/services/901951)

    お忙しい中ありがとうございました。

    #誕生日
    #エルフ
    #Ado
    #オリジナルMV
    #歌ってみた
    #心奏-Kanade-

    vtubes.tokyo/1917114/

    #誕生日 #エルフ #ado #オリジナルmv #歌ってみた #心奏
Next page