In a sense Microsoft forgot its own learnings. Because of exactly things like this they prevent UWP apps from connecting to localhost by default and make it very annoying to circumvent and from my experience, the circumvention is not exactly a stable setup. So they really don't want you to do that, and somebody thought enough to make it extra difficult. So, they have UWP, all those well thought-out policies, then make an editor ecosystem out of web technology and throw everything out of the window. No surprise from a $T company with more teams than countries on Earth that not everything is coordinated, but they should have a guy with the required knowledge and sensibilities on any major product team. Apps installed from their "store" are relatively safe, but then they put a (extension) store inside their app again, which is unsafe :/
RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
41–50 of 109 posts
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#42What is the best alternative for TypeScript development? My favorite light-weight editor is Kakoune, but it really doesn't have enough plugins for the kind of work I do.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#43If I'm reading this right, it assumes the machine's IP is publicly accessible over the internet; which I'm guessing -even with IPv6- is not the case in 99.999% of cases; who just exposes their development machine directly to the internet with a public IP? Still bad, but not quite as bad as owning from the browser via localhost GET.
[deleted]
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#44Microsoft has the best bounty hunter program: go fuck yourself. If you find a way to take over MS accounts, or force email swaps, or even gamertag shanaigans, there is too much money to be made, there is not even a point for a bug bounty. It's like a $40 reward for returning a purse filled with $250k. I agree with OP: no more free bugs.
It's not just Microsoft. What most bug bounties pay isn't even close to the amount you can get from selling it on the black market (assuming you have the right connections). It's why selling exploits to nation states and vendors who work with them is so lucrative.
I do agree that bug bounties are too small, but isn't selling bugs on the black market illegal?
I would much rather get $40 dollars for a bug and some public acknowledgement (which I could use to get a better paying job) than to sell it for criminal use.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#45Microsoft has the best bounty hunter program: go fuck yourself. If you find a way to take over MS accounts, or force email swaps, or even gamertag shanaigans, there is too much money to be made, there is not even a point for a bug bounty. It's like a $40 reward for returning a purse filled with $250k. I agree with OP: no more free bugs.
It's not just Microsoft. What most bug bounties pay isn't even close to the amount you can get from selling it on the black market (assuming you have the right connections). It's why selling exploits to nation states and vendors who work with them is so lucrative.
It's probably illegal in many jurisdictions, no? Not to mention unethical. You are not just harming Microsoft here in this instance, but potentially millions of people.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#46Microsoft has the best bounty hunter program: go fuck yourself. If you find a way to take over MS accounts, or force email swaps, or even gamertag shanaigans, there is too much money to be made, there is not even a point for a bug bounty. It's like a $40 reward for returning a purse filled with $250k. I agree with OP: no more free bugs.
It's not just Microsoft. What most bug bounties pay isn't even close to the amount you can get from selling it on the black market (assuming you have the right connections). It's why selling exploits to nation states and vendors who work with them is so lucrative.
Bug bounties probably act as a price discovery mechanism on the part of bug finders. They should also have a negative price premium bye to decreased risk.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#47Earlier quoted context omitted.
Not really all that troubling, all the author is saying is that he wants to get paid for their work. Either Microsoft or other future vendors can actually honor an established bug bounty program, or the author can sell his findings to the highest bidder. Or the author can simply not spend time and energy finding bugs in the first place.
Highest bidder is unethical and illegal. But does not change the monetary reality
Pass a law that requires companies to pay black market value for bug bounties. It’s also unethical for big corporations to exploit the US oligarchy to get these fixes for free.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#48If I'm reading this right, it assumes the machine's IP is publicly accessible over the internet; which I'm guessing -even with IPv6- is not the case in 99.999% of cases; who just exposes their development machine directly to the internet with a public IP? Still bad, but not quite as bad as owning from the browser via localhost GET.
No, JavaScript running in your browser can connect to it. No remote access required. Of course, if you do allow remote access it is even worse.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#49Earlier quoted context omitted.
It's not just Microsoft. What most bug bounties pay isn't even close to the amount you can get from selling it on the black market (assuming you have the right connections). It's why selling exploits to nation states and vendors who work with them is so lucrative.
I do agree that bug bounties are too small, but isn't selling bugs on the black market illegal? I would much rather get $40 dollars for a bug and some public acknowledgement (which I could use to get a better paying job) than to sell it for criminal use.
Assuming you live in a place where you can get a high paying job and/or leave the country to get one.
Taking a US centric view on this is a great way to ensure nation states have compromised your security.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#50Earlier quoted context omitted.
It's not just Microsoft. What most bug bounties pay isn't even close to the amount you can get from selling it on the black market (assuming you have the right connections). It's why selling exploits to nation states and vendors who work with them is so lucrative.
I do agree that bug bounties are too small, but isn't selling bugs on the black market illegal? I would much rather get $40 dollars for a bug and some public acknowledgement (which I could use to get a better paying job) than to sell it for criminal use.
> but isn't selling bugs on the black market illegal?
Noob question: is there any specific law that punishes describing how to get into a software/electronic system but not actually doing it? Something that is just not purely US-centric.