Show HN: How attractive is your website? Check using Visual Mind AI

Re:Show HN: How attractive is your website? Check using Visu... by stevekemp on Saturday September 19, 2020 @08:13AM (#24526903)

Hrm. Does it really fetch "local" resources?

Visual Mind summary report for http://169.254.169.254/latest/meta-data

38% of users are expected to like your site

Yup. That's a security hole:

http://13.232.106.1/thumbs/visualmind/aHR0cDovLzE2OS4yNTQuMT...

[ Parent | on HN ]

Re:Show HN: How attractive is your website? Check using Visu... by eat_veggies on Saturday September 19, 2020 @11:47AM (#24528221)

nice http://13.232.106.1/thumbs/visualmind/aHR0cDovLzE2OS4yNTQuMT...

[ Parent | on HN ]

Re:Show HN: How attractive is your website? Check using Visu... by vagab0nd on Saturday September 19, 2020 @09:35PM (#24531391)

That's interesting. How did you go from metadata to token?

[ Parent | on HN ]

Re:Show HN: How attractive is your website? Check using Visu... by eat_veggies on Saturday September 19, 2020 @10:08PM (#24531499)

the token is in the metadata haha. try creating a report for http://169.254.169.254/latest/meta-data/identity-credentials...

[ Parent | on HN ]

Re:Show HN: How attractive is your website? Check using Visu... by myraahio on Saturday September 19, 2020 @08:15AM (#24526909)

Thanks for pointing out. Shame on us. :)

[ Parent | on HN ]

Re:Show HN: How attractive is your website? Check using Visu... by pudsec on Monday September 21, 2020 @12:01AM (#24539676)

Be careful, there's ways around just blocking the IP address;

https://myraah.io/index.php/visualmind/report/aHR0cDovL2F3c2...

[ Parent | on HN ]

Re:Show HN: How attractive is your website? Check using Visu... by stevekemp on Monday September 21, 2020 @06:17AM (#24541666)

Agreed. I put together a little library to handle denying access to "local" resources, to abstract this a little and avoid overlooking common mistakes:

https://github.com/skx/remotehttp

[ Parent | on HN ]

Re:Show HN: How attractive is your website? Check using Visu... by jcims on Saturday September 19, 2020 @10:47AM (#24527767)

Good ol' metadata strikes again. I wish AWS would make a virtual block device for accessing this content instead of network (at least as an option). Much easier to protect at the OS level.

The v2 service helps with this but it doesn't beat awareness of the issue.

[ Parent | on HN ]