Conversation

Notices

1. not a lot, just forever (nightpool@cybre.space)'s status on Wednesday, 14-Aug-2019 12:12:39 UTC not a lot, just forever

   • not a lot, just forever

   hey all, there's a rash of http2 vulnerabilities going around c/o Netflix today.

   the default mastodon nginx config has http2 enabled, and nginx is affected (in one form or another) by three of these attacks, so you should upgrade nginx as soon as possible:

   https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/

   • Ruby Rhod repeated this.
   • Ruby Rhod (feld@bikeshed.party)'s status on Wednesday, 14-Aug-2019 12:59:04 UTC Ruby Rhod

     in reply to

     • Ruby Rhod
     @nightpool interesting,
     So far it appears Varnish + Hitch aren't vulnerable, but still early days