• 7 Posts
  • 17 Comments
Joined 1 year ago
cake
Cake day: July 1st, 2023

help-circle
  • Looking at it from a pragmatic perspective, I see 2 reasons why incest was historically frowned upon.

    The first is the risk of genetic diseases, decrease in immune system performance, the likes. Children from incestuous relationships have worse genes, so the easiest way to prevent that was to prevent incestuous relationships to begin with.
    Now ofc, we have contraceptives, abortions, hell soon we will have gene editing of both embryos and full humans, meaning there are plenty enough other ways to stop inbred children. From that perspective I see no reason to have any specific laws at all, relationships should be legally treated all the same regardless of the genetic overlap of the participants. A ban on knowingly making and carrying inbred children would fulfil the same use and likely much more effectively.

    The second issue I see would be that strong bonds like family make it easier to be forced into a relationship. Authority can and does get abused to force sexual relationships, think of the Hollywood scandals to that length for just one example. You sometimes see companies banning relationships with someone’s superiors for example, under the assumption that it is just too likely such a relationship isn’t entirely for immaterial reasons (both down and up, though in the case of incest only down (think parent forcing their child to have sex or get no college money) would be an issue). Historically, given there where already other issues with incest (inbreeding), the interest for a proper detailed handling of those potential issues was low, a blanket ban was seen as acceptable. Given that the other issue is now no longer a problem, I think it is time to address this properly and look into how much regulation is necessary to achieve a reasonably low rate of those abuses occurring.
    Seeing that the law doesn’t generally care too much about positions of authority across sexual relationships, and the cases where it does are usually relatively vague (abusing a position as the “breadwinner” should be covered no matter if as a boss or a parent in countries that do cover it), I think you could get away with largely deregulating it and adding laws later as needed. Whether or not you should still keep direct parent-child relationships illegal initially I am not sure, this is very much out of my depth.






  • injection attacks on websites means that someone managed to add some unintended part to the website, as if the webserver had sent a different page. So it does allow all things the website could do, no more - no less.
    If I type <style>*{display:none}</style>, that is escaped. If this would get inserted into the website as “cleartext”, it would be valid html that would hide the entire page, turning it blank. Ofc a comment should not be able to do that, so a > in text is changed to something like &⁤gt;
    ![alt text]⁤(http⁤s://link⁤.to/an/image.png) is a syntax to insert an image into the comment, so it is parsed into an <img src="http⁤s://link⁤.to/an/image.png" alt="alt text"> html element. In that insertion the contained text was not properly escaped in some cases, so you could have the image contain valid html which would continue on writing into the website. Basically for the alt text ⁤ ⁤ ⁤ " other attribute="attribute val ⁤ ⁤ ⁤ you would get <img src="http⁤s://link⁤.to/an/image.png" alt="" other attribute="attribute val"> instead of <img src="http⁤s://link⁤.to/an/image.png" alt="&⁤quot; other attribute=&⁤quot;attribute val"> which it should have been. And one of the attributes you can add is javascript that is executed at certain times, so you can inject javascript into the page which can do pretty much everything at that point







  • yes, the webUI appends a ?format=webp to the image load request, but I assume the conversion fails. Clients that don’t try to get burggit to convert it but take the original image can load it just fine. .jpeg is treated weirdly in general, it is also cached on the instance even if the original source is elsewhere, and the links still get the ?format=webp as a result. So even uploading to shota.nu won’t fix it, but converting to png will








  • Can you please make http://shota.nu redirect to https? enabling hsts would also be nice.

    First experience I had was typing it out from memory, seeing the blank nginx page, and looking up the announcement post thinking I had misremembered.

    example nginx config
    server {
        listen 80;
        #server_name shota.nu;
        
        return 301 https://$server_name$request_uri;
    }
    
    server {
        #listen 443 ssl;
        #server_name shota.nu;
        
        # max-age of 15768000 and over will get hsts permanently compiled into some static lists!
        # If you're unsure about maybe disabling it later, reduce it to say 7884000
        add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
    }
    


    Also you may wanna add server_tokens off; to your html{} block if you don’t want to show off your 3 year old nginx that has been deprecated since 2021.