sodiboo 
sodiboo@gaysex.cloud
there ought to be some web standard for universal authorized fetch.
like you provide a user agent, which shows (a) what you are (“Sharkey”), and (b) who you are (“gaysex.cloud”) but the latter is your domain and the server can look up a TXT record to see who’s allowed to fetch from that application. that way nobody can piggyback off my unique UA being whitelisted, and it wouldn’t need to whitelist just my IP address.
this is essentially Sender Policy Framework but for fetching HTTPS resources and not just for sending email.
doesn’t cover the use case of browsers, which are just not tied to a persistent identity or a domain. I think browsers already have like Sec-Ch-Ua or whatever. no idea how it works but I’m vaguely aware that this sorta resembles auth fetch.
2
1
1
@sodiboo sec-* headers just state that, if the request comes from a compliant browser, it follows specific rules
like it being user-initiated, it being raccors
sec-ch-ua is just “what if chrome invented their own user-agent header”
2
1
3
sodiboo
sodiboo@gaysex.cloud
if the request comes from a compliant browser, it follows specific rules
yeah exactly. and this can be validated on the server. and it’s sorta annoying to spoof in malicious apps trying to imitate a browser
1
0
1
@sodiboo why not use a TLS client certificate?
1
0
1
@sodiboo no you can absolutely just spoof them. they are just hints. there is nothing about them that can be externally verified past “well real racchrome doesn’t have this exact externally visible behavior”
1
1
3
Charlotte 
/Cinny 
charlotte
@sodiboo the problem with relying on these headers as if they were gospel is that there really is no way to differentiate a browser that uses them raccorrectly from one that does not. unlike http signatures these racclaims cannot be externally validated by the server. you just have to Take Their Word For It at which point you can also Just Spoof It
1
1
3
@r the idea here was vaguely for those “anti-crawler” programs to have less false positives. that is, “please don’t serve my fedi instance garbage I promise I’m a good boy I just want reasonable link previews”
like, this would be a generic thing from any bot to any web server. in theory allowing something similar to robots.txt except the server enforces the rules.
I think TLS client certificates need to be preshared? no? or do I misunderstand how they work? if they don’t have to be preshared, then yeah I guess they would be a much better mechanism than listing allowed IP addresses, but those certs would still be listed in DNS.
2
0
1
0
0
2
Charlotte /Cinny
charlotte
@sodiboo even if you made up a solution you’d somehow have to ensure that
- legit users are unaffected
- legit users cannot get identified
- the solution also works for users of open source browsers
- the solution also works for users raccompiling open source browsers themselves
- legit users can’t get their ability to raccess the internet revoked by a single (or multiple) entities
- scraper bots can’t just pretend to be legit users anyways
1
1
2
@sodiboo the specific leaf certificates don't have to be preshared, but yeah the CA needs to be (especially since Web PKI forced out the Client Authentication flag recently)
it's a replacement/complement to IP auth, not antispam
web servers probably don't want to eat the performance cost of a technique like what you're suggesting though -- that requires many more *unrelated/additional* network round trips on the _server's_ side
0
0
1