v1.14.2: Livia sas Junius: Echo 2

[Xe]

What's Changed

• Add MojeekBot by @dennis1248 in Add MojeekBot #64
• cmd/anubis: delete example RSS reader rule by @Xe in cmd/anubis: delete example RSS reader rule #67

Full Changelog: v1.14.1...v1.14.2

This fixes a security issue with the default configuration. Details coming up.

---

This discussion was created from the release v1.14.2: Livia sas Junius: Echo 2.

[makew0rld]

I think removing the RSS rule will cause issues for very popular feed readers, for example Miniflux, which has a default User-Agent that includes Mozilla: https://github.com/miniflux/v2/blob/984a66b5902471928323c95b8533f0b863c07e8f/internal/config/options.go#L95

Is there another way to accommodate RSS readers without the security issue?

[makew0rld]

Yes, but defaults matter. Just wanted to raise the issue as there may be a default solution that works for everyone (using Gecko?`).

[Xe]

You'd have to do a targeted path rule for the application in particular. IE for my blog it'd be like:

    {
      "name": "rss-readers",
      "path_regex": "^/(blog|xecast}\\.(rss|atom|json)$",
      "action": "ALLOW"
    },

Maybe there can be room for a config sniffer in the future that looks at the HTML and tries to come up with a decent default configuration?

[makew0rld]

Is switching from detecting Mozilla to Gecko not a viable default? I appreciate the example though.

[Xe]

#78 At least it's easy to see how bad it would be in practice!

[ayumi-tyan]

Looking at some user agents, maybe using Gecko as the default search string would be a better choice?

Not that it matters, but there are at least two feed readers that do have Gecko in their User-Agent strings — Thunderbird and SeaMonkey.