splitbrain.org

Now that I actually try it, I think you're right.

I had assumed that the browser would load the external JavaScript, parse it and execute the code. I understood that the code in the page (the src built by the coder) was not going to be compromised. I should have realized that the browser would treat data loaded through an img src tag differently than it would data loaded through a script src tag.

Some versions of IE can be fooled into executing JavaScript contained in an image file, but the image has to be loaded on its own (in an iframe or a new window), so it wouldn't apply to my original comment. (http://www.splitbrain.org/blog/2007-02/12-internet_explorer_facilitates_cross_site_scripting)

This site does still seem like it could lead to security issues.

Couldn't they return a 302 redirect header to a private resource?

HTTP/1.1 302 Found
Location: http://www.yoursite.com/blog/entries/delete/123

You can achieve this without exposing any service. Let's Encrypt allows you to prove ownership of a domain through DNS 01 hooks.

I personally use Duck DNS [1] for main internal domains, so I can have a certificate that most tools will recognize as valid. This saves me from adding my cert in every machine that will use that service.

I use dehydrated [2] to get a Let's Encrypt certificate using Duck DNS. There is a good article explaining that by Andreas Gohr [3].

[1] - https://www.duckdns.org/

[2] - https://github.com/lukas2511/dehydrated

[3] - https://www.splitbrain.org/blog/2017-08/10-homeassistant_duckdns_letsencrypt#set_up_duckdns

It's development has stalled long ago, but you could try OpenTextSummarizer [0]. It is available on the Debian repos [1] and you can try a web interface [2] to see if it fulfills your expectations.

[0] https://github.com/neopunisher/Open-Text-Summarizer/

[1] https://packages.debian.org/search?keywords=libots

[2] https://www.splitbrain.org/services/ots