Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x/website: talks.godoc.org's present server still relies on defunct RawGit service #46469

Open
jub0bs opened this issue May 31, 2021 · 2 comments
Open

Comments

@jub0bs
Copy link

@jub0bs jub0bs commented May 31, 2021

One can (and the likes of Dave Cheney do) point talks.godoc.org to one's present slideshow hosted on GitHub. The slideshow then runs on the server, which obviates the need for installing and running the present command on one's local machine. For instance, see https://talks.godoc.org/github.com/jub0bs/poc_present/main.slide.

However, I noticed that SVG assets hosted raw.githubusercontent.com see their URL's host rewritten to rawgithub.com. https://rawgithub.com permanently redirects to https://rawgit.com, which states that the RawGit project is reaching the end of its life:

RawGit is now in a sunset phase and will soon shut down. It's been a fun five years, but all things must end. [...] If you're currently using RawGit, please stop using it as soon as you can.

(my emphasis)

As a result of this URL rewrite and the RawGit project's status, such SVG assets fail to load (with a 403 response status) in present slides run on talks.godoc.org; for instance, see https://talks.godoc.org/github.com/jub0bs/poc_present/main.slide#2:

failure to load SVG in slideshow

Note: a WHOIS lookup confirms that godoc.org is owned by Google; talks.godoc.org is maintained by @dmitshur.

I tracked down the offending URL rewrite to the golang/gddo project, but that project is marked as archived and no longer accepts issues or pull requests. I privately reached out to @julieqiu for guidance on Gophers Slack, who suggested I open an issue about this here.

Relying on RawGit despite its sunset status may have security implications: when RawGit becomes truly defunct, its domain names may be acquired by a malevolent actor who could serve arbitrary SVGs in place of the slideshow's authors'. I've privately reached out to Ryan Grove (RawGit's author) on Twitter, who indicated he has no plans to let domain names rawgithub.com and rawgit.com lapse any time soon, but his plans may change, especially if the cost of ownership becomes prohibitive.

Moreover, the ability to run a slideshow on https://talks.godoc.org is valuable to the community, and isn't yet (AFAIK) supported on https://pkg.go.dev. Fixing this issue (by no longer relying on RawGit) would be a good thing.

@gopherbot gopherbot added this to the Unreleased milestone May 31, 2021
@seankhliao
Copy link
Contributor

@seankhliao seankhliao commented May 31, 2021

maybe the rewrite could just be removed since github now serves svgs with content-type: image/svg+xml

Loading

@jub0bs
Copy link
Author

@jub0bs jub0bs commented Jun 21, 2021

Is there anything I can do to help? Could I submit a patch somewhere (if not on the golang/gddo repo, since it's archived)?

Loading

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
3 participants