Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

blog.checkpoint.com

Post reply on HN
Print view View original

191–200 of 234 posts

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#191

Post by lawl »

easuter wrote: post #177
ConfucianNardin wrote: post #23

Was annoying to find the details. Looks like PopcornTime was rendering subtitle text as HTML, inside their app (html/js-based), creating an XSS vector (looking at https://github.com/popcorn-official/popcorn-desktop/commit/a... , https://github.com/butterproject/butter-desktop/pull/602 ). Likely the javascript runtime they're using allows file access and execution of arbitrary executables, enabling the metasploit shel…

If only VLC had been re-written in rust this would never have happened. For shame.

Oh look, it's the Rust Evangelism Strike Force at work again.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#192

Post by nradov »

easuter wrote: post #177
ConfucianNardin wrote: post #23

Was annoying to find the details. Looks like PopcornTime was rendering subtitle text as HTML, inside their app (html/js-based), creating an XSS vector (looking at https://github.com/popcorn-official/popcorn-desktop/commit/a... , https://github.com/butterproject/butter-desktop/pull/602 ). Likely the javascript runtime they're using allows file access and execution of arbitrary executables, enabling the metasploit shel…

If only VLC had been re-written in rust this would never have happened. For shame.

Feel free to rewrite VLC in Rust. No one is stopping you.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#193

Post by O5vYtytb »

easuter wrote: post #177
ConfucianNardin wrote: post #23

Was annoying to find the details. Looks like PopcornTime was rendering subtitle text as HTML, inside their app (html/js-based), creating an XSS vector (looking at https://github.com/popcorn-official/popcorn-desktop/commit/a... , https://github.com/butterproject/butter-desktop/pull/602 ). Likely the javascript runtime they're using allows file access and execution of arbitrary executables, enabling the metasploit shel…

If only VLC had been re-written in rust this would never have happened. For shame.

Yes but it would also not have nearly as many features as it does right now.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#194

Post by usefulcat »

nradov wrote: post #192
easuter wrote: post #177

Earlier quoted context omitted.

If only VLC had been re-written in rust this would never have happened. For shame.

Feel free to rewrite VLC in Rust. No one is stopping you.

Pretty sure that was sarcasm.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#195

Post by easuter »

nradov wrote: post #192
easuter wrote: post #177

Earlier quoted context omitted.

If only VLC had been re-written in rust this would never have happened. For shame.

Feel free to rewrite VLC in Rust. No one is stopping you.

No. That would require becoming familiar with a massive codebase that has accrued contributions from thousands of developers over the years.

It is far more effective to sit on my high horse and instruct unenlightened plebs on the one true path to memory-safety.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#196

Post by eth_hero_12 »

jbk wrote: post #164
eth_hero_12 wrote: post #110

Earlier quoted context omitted.

vlc has a bug and yet you talk shit about well developed and fuzzed by google projects. thats why vlc will never be better than mpv.

FFmpeg, VLC, MPlayer, libdvd*, libxvid, x264, libflac, libvorbis and all the other have multimedia library codebases started in the late 90s/early 2000. Noone cared much about security at that times. All those projects are under-funded, done by volunteers, on countless platforms, doing very low-level stuff, and supporting many formats. This has nothing to do with one project or another.

thats sad to hear, I didn't know volunteers did so much

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#198

Post by weberc2 »

nebabyte wrote: post #186
weberc2 wrote: post #184

Earlier quoted context omitted.

Those are valid reasons not to improve a project, but it doesn't make your project immune to criticism. If you're not going to take the time to make your project better, that's fine, but other people are still free to point out that your project isn't very good or that your project could be much better if you managed your time differently.

Tepix's point was about entitlement, not criticism. "There is no excuse for ___" definitely crosses the line from criticism to entitlement. :^)

I can't figure out how anyone could read entitlement into that statement.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#199

Post by dang »

easuter wrote: post #177
ConfucianNardin wrote: post #23

Was annoying to find the details. Looks like PopcornTime was rendering subtitle text as HTML, inside their app (html/js-based), creating an XSS vector (looking at https://github.com/popcorn-official/popcorn-desktop/commit/a... , https://github.com/butterproject/butter-desktop/pull/602 ). Likely the javascript runtime they're using allows file access and execution of arbitrary executables, enabling the metasploit shel…

If only VLC had been re-written in rust this would never have happened. For shame.

We ban accounts for trolling, so please don't do that here.

Also, you've posted many uncivil and/or unsubstantive comments. We ban accounts for that too, so please don't do that either.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#200

Post by dang »

lawl wrote: post #191
easuter wrote: post #177

Earlier quoted context omitted.

If only VLC had been re-written in rust this would never have happened. For shame.

Oh look, it's the Rust Evangelism Strike Force at work again.

Please don't react to provocation by making the thread worse (a.k.a. please don't feed the trolls).
Post reply on HN