Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gitlab servers are being exploited in DDoS attacks

therecord.media

Post reply on HN
Print view View original

101–110 of 177 posts

Re: Gitlab servers are being exploited in DDoS attacks

#101

Post by gnramires »

nightfly wrote: post #53
charcircuit wrote: post #49

Earlier quoted context omitted.

Not him, but how are you supposed to know about the update? Do you need to check some page every day if there's an update? Why can't security updates just autoupdate like apps on phones or at least email the admin saying there is an important update.

Depending on how you have it installed you could have your package management system automatically install the updates. They aren't always perfect though, I've had at least one Gitlab update that required manually running migrations commands since the ones in the update script failed for some reason. I wouldn't trust doing it automatically. And I'm not sure about gitlab, but their are often mailing lists for security…

I highly recommend debian's auto update feature (works on derivatives):

https://www.linode.com/docs/guides/how-to-configure-automate...

I've never had any problems with it, although I just run a couple of servers :).

If everyone enabled this one thing I'm sure the Internet would be significantly safer.

Obs: You can select security updates only which I believe are unlikely to break anything!

Re: Gitlab servers are being exploited in DDoS attacks

#102

Post by Gigachad »

mdoms wrote: post #91
Gigachad wrote: post #65

Earlier quoted context omitted.

There is very little reason to even self host Gitlab unless you are insanely paranoid or for philosophy reasons like debian/gnome.

Sorry but this comment strikes me as incredibly ignorant. There are lots of good reasons to self host, chief among them reasons which can't be worked around - compliance and data sovereignty.

Already covered those under paranoid. There is nothing wrong with self hosting and being paranoid. But that comes with the responsibility to have someone dedicated to keeping up with the latest news on the software they run. Leaving gitlab unpatched for 6 months shows that the company is not capable of running it themselves and should not be self hosting.

Re: Gitlab servers are being exploited in DDoS attacks

#103

Post by Gigachad »

kibwen wrote: post #77
majou wrote: post #69

Earlier quoted context omitted.

2014 was very much that era, I'd accept this excuse maybe for 2007

The line wasn't written in 2014, that's just the earliest that the history goes back. Presumably it's no newer than the early 2000s.

Considering that initial commit contains 400k lines, I would say there is a very long history before git was used.

Re: Gitlab servers are being exploited in DDoS attacks

#104

Post by JeremyNT »

wheresmycraisin wrote: post #84
JoshTriplett wrote: post #33

Earlier quoted context omitted.

If you have to process it at all, do it in a WebAssembly sandbox on the server. Or, alternatively, in a seccomp-secured sandbox that isn't allowed to make any system calls whatsoever, just read data from one file descriptor and write processed data to another.

.... why webassembly?

Yeah, I don't see the value here either. You don't need wasm or chrome or any of that stuff.

Linux itself has several features that can be used to isolate processes, and there are use friendly tools like bwrap [0] that make configuration easy.

It should be entirely possible to sandbox something like ExifTool itself such that it has no network access and is limited to reading and writing files in a particular directory.

https://wiki.archlinux.org/title/Bubblewrap

Re: Gitlab servers are being exploited in DDoS attacks

#105

Post by aurelianito »

jeffbee wrote: post #72
djbusby wrote: post #64

Earlier quoted context omitted.

It's clearly not complete shit, else it wouldn't be used by literally millions of people/systems. ExifTool is so far away from shit that in fact it was chosen by a highly respected company with a very good team. A hackjob usually has less deploys than my own stuff (which, outside of Windows 2000 components, is less than a few millions)

By this reasoning "Baywatch" was a great TV show because lots of people saw it.

Baywatch was a great TV show. Maybe you don't like it. Millions all over the world do.

Re: Gitlab servers are being exploited in DDoS attacks

#106

Post by smashed »

Gigachad wrote: post #63
ed25519FUUU wrote: post #50

Earlier quoted context omitted.

Public facing? Handles user input data?? Uses ‘eval’???

The line existed in the 2014 commit which migrated the repo to git. It wasn't designed in the current era of mass automated abuse and internet connected everything.

That line is in a Perl metadata cleaning library. Not in Gitlab itself. Gitlab, who prides themselves and sell the gospel of improving security, willfully chose to use that library which was obviously never designed for their use case.

I looked at the front-page of that library. It says it cleans metadata from a huge number of file format. Frankly it looks more like something you would use on your own, known safe, files before sharing them online.

I'm not sure the tool is presented as a sanitizer for untrusted input. At least, it does not claim to be.

Why does Gitlab need to clean metadata from DjVu files? Wtf are DjVu files?!

Re: Gitlab servers are being exploited in DDoS attacks

#107

Post by rsj_hn »

aurelianito wrote: post #105
jeffbee wrote: post #72

Earlier quoted context omitted.

By this reasoning "Baywatch" was a great TV show because lots of people saw it.

Baywatch was a great TV show. Maybe you don't like it. Millions all over the world do.

I have never seen it, but am aware of the low brow reputation. If you genuinely like it, could you tell me what you like about it? I recently saw some old episodes of Knight Rider and admit that the show was fun.

Re: Gitlab servers are being exploited in DDoS attacks

#108

Post by willbudd »

Spivak wrote: post #86
cozzyd wrote: post #85

Earlier quoted context omitted.

You have system("gcc uploaded.c && ./a.out") too!

But that code doesn’t run in the memory space of the process.

Then compile it as a library, and dlopen() it after all. (I'm just guessing the gp's point was that JIT isn't really an essential modality.)

Re: Gitlab servers are being exploited in DDoS attacks

#109

Post by mxrlkn »

zmmmmm wrote: post #100
mxrlkn wrote: post #88

Earlier quoted context omitted.

I was once tasked with creating a new frontend on an old project that had an API endpoint return something like this: var array = ["foo", "bar"] I was expecting xml or json (like the rest of the endpoints), but I realized that they just served this as text, and then eval'd it on the frontend...

it was literally a pseudo "standard": https://en.wikipedia.org/wiki/JSONP

Right, but for it to be JSONP, the response should be injected into a script tag, I believe.

Re: Gitlab servers are being exploited in DDoS attacks

#110

Post by tfigment »

relaunched wrote: post #96
jodoherty wrote: post #37

Earlier quoted context omitted.

It would dramatically limit your attack surface to those who could gain access to your VPN. I prefer requiring TLS mutual authentication with a corporate PKI and issuing employees client certificates. Doing both wouldn't be a bad idea either.

The number of software products, SaaS and on-prem, that don't support mutual tls is a disgrace.

I frequently do mTLS with a reverse proxy (httpd, nginx, caddy, ...). Not perfect but you can tighten the connection security a lot without touching the other service. But by outsourcing it you lose some control.
Post reply on HN