27/08/26 12:04
Never expected to make two blog posts in one day, but here we are.
Right after finishing the last post, I was checking if this site is being indexed, as part of my current effort to have a bit more of an online presence. So, I searched for myself, and quickly got distracted by all the results. When you've used the same handle everywhere for 14 years, cruft tends to accumulate. There are comments on various sites, steam reviews, accounts I'd forgotten I had. This is why it's good to have an online persona that doesn't tie back to your real self.
Then I found something weird - a result for a file, daily_user_summary.txt, with an excerpt containing my username. No domain, just an IP address. I followed the link - https wasn't working of course, so ignore the big scary warning - and found a tiny little open directory. Just three files - the aforementioned daily_user_summary.txt, as well as users.csv, and in a directory called 'stats', users.gz. All dated midnight today.
I started to think I'd found some kind of data breach. The first file was 63MB, containing tens of thousands of usernames, alongside some indecipherable numbers. I ran dig against the IP - it returned all thirteen top-level DNS servers, A through K of root-servers.net. This last point would turn out to be nothing, turns I just don't know enough about DNS. But I got very excited for a few minutes, thinking I'd found a significant and technically interesting data breach.
A quick investigation of the user_summary_file.txt file soon revealed what was going on. Despite being .txt, it was a CSV, and the column titles - name, score, wu, team - showed this was data for foldingathome. That's a project where volunteers contribute computing power to simulate protein folding to help research various diseases like cancer and alzheimers. It has a leaderboard, where you can earn point for solving 'work units' - the 'wu' heading in the file I'd found. All this leaderboard data is public, which just left the question of why a copy of it was being hosted from some random IP.
I clumsily investigated for a little while, getting tripped up on curl syntax as I poked at the site. I discovered the servers clock was six minutes slow. Eventually I figured it out and ran curl -vk https://1.1.1.1/daily_user_summary.txt -o /dev/null (1.1.1.1 is cloudflare DNS, not the real IP - I'll explain why I've redacted it in a bit).
This returned the details of the (invalid cert), including, crucially, a domain name!
I'd figured that since the cert was invalid, the domain would be expired, but nope, it worked. foldingathome.redacted.domain (again, not the real domain) returned the same site as the raw IP, just with working HTTPS. I checked the main site rather than the subdomain - and found somebodies cool little personal website! It was just like so many of the small/indie sites I'd exploring on webrings and neocities for the last few days. The coincidences kept mounting, with the site linking to various webcomics and sites that I've enjoyed, and of course, the inclusion of 88x31 web badges - several of them the same as I have on my own site.
I really wanted to let this person know of the convoluted way I'd found their site, though here I ran into a dead end - no contact information, not even a name. I did manage to find their github account, and a possible email address and Matrix ID by inspecting some git commits. But given that they were clearly privacy conscious - they'd discussed as much in their blog, and the TXT records on their domain showed they were using protonmail - I took the hint and decided to drop it, and redact any identifying info from this blog post.
It's a shame they'll never know about this weird rabbit hole they sent me down, but c'est la vie.