Provisions for preventing misuse e.g. by malware distributors? about yogurl HOT 5 CLOSED

Hi @SilverWingedSeraph glad you asking this.

Do you mean somebody/bots who use this service to distribute malwares?

Could you explain a little more, thanks for asking.

from yogurl.

Here's an asciinema of an example, sorry for the slow typing (I'm in calc class and have to periodically stop to take notes): https://asciinema.org/a/1utsodso6jtdxk8fztt1z2o0i

Yes, technically you could do this with the yogurl.io service itself, but having a command line/JS utility makes it trivial for self-modifying malware to upload copies of modified versions and use it for distribution.

I'm not really concerned about this strategy in and of itself, but there is the potential for yogurl's domain to get blacklisted by IDS/IPS services if threat intel feeds start reporting malware coming from it.

from yogurl.

That's a good point, the domain ... but actually there is nothing we can do for that.

We trust people, specially devs, hoping for cooperation, you are the only responsible for what you upload and share of course.

If you have any advice just write down... 👍

from yogurl.

Absolutely. The only thing I would suggest is perhaps some type of rate limiting by IP (or perhaps have clients generate a token and limit on that, although then you end up trusting the client to some extent). Anyway, it's a great service, and I appreciate how easy having a CLI makes it.

from yogurl.

Great, of course, rate limit will be up soon!

Thanks you are welcome anytime 👍

from yogurl.