Damus
Jared Logan profile picture
Jared Logan
@jaredlogan
The codebase has a Google Cloud Storage backend? Synonym's production configuration (which backend they're actually running) is not public from what I can tell.

The entire storage configuration in google_bucket_config.rs (the file that controls where your data lives) is this:

rustlet builder = opendal::services::Gcs::default()
.bucket(&self.bucket_name)
.credential(&credential);

Bucket name. Credential. That's it. So user data goes to a Google Cloud Storage bucket that Synonym owns and controls?

https://github.com/pubky/pubky-core/blob/main/pubky-homeserver/src/data_directory/storage_config/google_bucket_config.rs

A sovereignty protocol that stores your data on Google Cloud is kind of hilarious at first glance.

@John Carvalho am I wrong here? Just looking for clarity.

291❤️1❤️1👀1👍️1🤙🏻1🤣1
Jared Logan · 5w
Hardcoded Synonym relay nodes? Default 'admin' password for homeserver operators? Rofl. https://github.com/pubky/pubky-core/blob/main/pubky-homeserver/src/data_directory/config.default.toml line 24: admin_password = "admin" line 34: dht_relay_nodes = ["https://pkarr.pubky.app", "https://pkarr.p...
Jared Logan · 5w
But wait there's more... Pubky Nexus is what makes content discoverable. Feeds, search, profiles — all run through it. Without Nexus, your content exists but nobody can find it. https://github.com/pubky/pubky-nexus/blob/main/nexus-common/src/config/watcher.rs line 23: pub const DEFAULT_MODERATI...
Jared Logan · 5w
Cloudflare binary is downloaded at runtime with no checksum for the Umbrel App. https://github.com/pubky/umbrel-app-store/blob/main/pubky-homeserver/docker-compose.yml line 117: wget -q -O /usr/local/bin/cloudflared "...github(dot)com/cloudflare/cloudflared/releases/latest/download/cloudflared-li...
Jared Logan · 5w
Neo4j social graph database ships with hardcoded password "12345678" lol https://github.com/pubky/pubky-docker/blob/main/neo4j.env line 9: NEO4J_AUTH=neo4j/12345678 line 5 shows # NEO4J_PASSWORD=12345678 commented out as the "default" hint, and line 9 shows it actually hardcoded active as NEO4J_...
Jared Logan · 5w
John Carvalho's own manifesto states: "Master keys are kept in cold storage, and access is delegated through revokable homeserver sessions, minimizing exposure and maximizing security." https://medium.com/pubky/pubky-the-next-web-3287b35408f1 Let's look at what the code actually does. The master...