02:14 <kentonv> ugh, someone tried to host a Chase phishing site on Oasis.

02:33 <TimMc> kentonv: aw gross

02:34 <TimMc> A friend of mine ran a pastebin and had to shut it down because people were using it to post credit card dumps and he kept getting calls from law enforcement to remove them.

02:35 <TimMc> Wait, how did they make a phishing site, anyway? Is there an app that allows arbitrary HTML and has a datastore too?

02:36 <kentonv> they just used Davros to host some HTML that looked like a Chase account recovery form

02:36 <kentonv> only 23 unique IPs even saw it before I received an e-mail from Chase

02:37 <TimMc> Impressive!

02:38 <TimMc> Ohhh... and the HTML posted to... somewhere else?

02:38 <TimMc> I didn't know Davros would serve pages.

02:38 <kentonv> Davros lets you publish the contents as a web site

02:38 <kentonv> using the same web publishing feature that e.g. Wordpress uses

02:40 <kentonv> for some reason the attacker used Google login rather than a throw-away e-mail address. So I have their google account info and their IP and I'm not sure what I should do with it.

02:41 <samba_> haha, nice

02:42 <samba_> interesting the idea to use davros as file host, but I didn't get how he published that ..

02:43 <samba_> kentonv: what you mean when you say davros has the same web publishing feature as wordpress?

02:44 <kentonv> Sandstorm apps can arrange to publish static content as a web site

02:44 <kentonv> In Davros this is the "publish" feature in the right sidebar

02:46 <kentonv> You get an auto-assigned hostname like 6oex0egj6n1422juc9j2.oasis.sandstorm.io, or you can configure your own domain to point at the site.

02:46 <kentonv> the phisher here used the auto-assigned hostname

02:59 <TimMc> kentonv: Man, I'm all for privacy and whatnot, but this is a malicious actor; I'd send that email address and IP straight to Chase.

02:59 <TimMc> Maaaybe neither is even theirs, but a lot of crooks have terrible operational security.

03:01 <kentonv> TimMc: Yeah, our ToS actually says that if you launch a phishing attack from Oasis you forfeit all privacy guarantees. So I did send the info to Chase.

03:18 <TimMc> "If it didn't say it before, it sure does now." :-P

04:09 <asheesh> kentonv: I like the idea that since phishing is about getting other people's private info, it stands to reason that you're OK with us sharing your (the phishing site hoster's) private info.

04:36 <_habnabit> haha nice i just found https://github.com/sandstorm-io/capnproto/issues/350

05:39 <samba_> kentonv: thanks for the explaination, I didn't get the part about : In Davros this is the "publish" feature in the right sidebar. do you mean a directory with his file in davros has create automatically a subdomain in davros grain?

05:40 <samba_> anyway I don't know what to do ethically with this guy. was phishing yea, then what. he may had change email or use the email of someone else. lot of people are doing this I guess

05:41 <kentonv> samba_: Create a new Davros grain and then click on "publish" in the right sidebar and see what it does. It should make sense then.

05:41 <samba_> ah, ok now I got it

05:41 <kentonv> :)

05:41 <samba_> the publish create a subdomain

05:42 <kentonv> yes

05:42 <samba_> nice

05:42 <samba_> haha, that guy explored the davros feature very well

20:42 <isd> So, I'm trying to compile sandstorm from source again. I've basically given up on doing so on Arch, so I'm using an ubuntu VM. I did the `make` step, and it seems to have worked, but when I do `make install` or try to run shell/run-dev.sh, it starts the build again, rather than finding an existing build. Am I missing something? Why is it rebuilding every time?

23:39 <kentonv> isd: Ekam is weird. If you're doing active development, I recommend running "make continuous" in one terminal and let it just run in the background, then do other make commands from another terminal. Ekam will rebuild files when they change.

23:39 <kentonv> isd: May also be worth reading https://github.com/sandstorm-io/ekam

23:46 <isd> kentonv: I'll give that a shot

23:50 <isd> Might be worth mentioning the lack of incremental builds in https://docs.sandstorm.io/en/latest/install/#option-4-installing-from-source ; it says make/make install, no hint that the latter will completely restart the whole process.

23:52 <isd> Is there anything out there besides sandstorm/capnp/ekam itself that's using ekam?