131–140 of 513 posts
If you view this page in Safari, it’s just a text document
If you can't view the images then it means you are likely using an outdated browser, all current versions of browsers support it (afaik) except Internet Explorer.[0]
...And if you are using Internet Explorer, then god help you.
At the time of writing, accessing the link returns a bunch of prometheus metrics... interesting.
> Timeline (DD/MM) > 06/01 - Vulnerability Discovered > 09/01 - Write-up completed & Emailed to them > 10/01 - Vulnerability patched Note those dates are DAY-MONTH. At least they patched it within a single day. I find it funny that the author found a massive vulnerability but chose to wait a couple days to report it so they could finish a nice write-up. Reminds me of my experience with HackerOne: We had some particip…
In what year was this? January 10 is tomorrow, even on the east coast, at the time of writing this comment.
Earlier quoted context omitted.
In what year was this? January 10 is tomorrow, even on the east coast, at the time of writing this comment.
Someone living beyond the US's east coast? Impossible!
Firebase is a shitshow. I say this as someone who really tried to like it and sadly built a project for a client using it. Other than this security vuln, the issues vs. just using postgres are: * It is more work! Despite being a backend as a service it is much less code to just write a simple API backend for your thing both in time to do it and time to learn how to do it. Think of Firebase as being on the abstraction…
Maybe I'm like a Luddite or something, but I feel like I keep hearing about Firebase but still have no idea what it really is or why/how I would use it in a project. I'm just sitting here on my own building projects with mostly Postgresql DBs, once in a while MySQL, and not suffering massive security breaches. Thanks I suppose for giving me a data point that I'm most likely not missing anything.
When mobile apps started out, most had little to no online features.
As the mobile apps market grew, more and more of these apps started requiring account persistence, sharing content with other users, real-time online interactions, etc.
That's when Backend as a Service became a thing (eg Parse), targeting developers with little to no server-side experience. And that's when Firebase popped up.
It's not clear if the author was hired to do this pentest or is a guerilla/good samaritan. If it is indeed the latter, I wonder how they are so brazen about it. Does chattr.ai have a responsible disclosure policy? In my eyes people should be free to pentest whatever as long as there is no intent to cause harm and any findings are reported. Sadly, many companies will freak out and get the law involved, even if you are…
Do you feel the same about physical security? It's fine for people to walk around your building, peak in the windows, maybe pick the lock on the door, maybe even take a little walk inside, as long as they don't steal anything?
Earlier quoted context omitted.
I just checked, and newly created tables without RLS are accessible to anyone: After running `CREATE TABLE x` in my SQL client (which succeeds with no warning), if I go back to the table UI on Supabase it says "WARNING: You are allowing anonymous access to your table". (It's good that there's a warning in the official interface, at least, but what if I use my own SQL client? What if my ORM is creating tables?) Your c…
I don’t understand the RLS is disabled warning thing. I also have that warning on a project where I migrated to Supabase from a sql dump/restore from another PG instance. I’m using supabase as “just Postgres” at the moment and the only access to the data comes from a server I control. Could you explain how my data is being “blasted to the internet”? Genuinely concerned if I’m grossly overlooking something.
Earlier quoted context omitted.
Why, you’d never catch a black hat hacker again. The authorities would ust reeling in one Good Samaritan after another!
There is a big difference between discovering a vulnerability that allows you to forge tokens and immediately reporting it versus dumping terabytes of data on the darknet for sale.
It's not clear if the author was hired to do this pentest or is a guerilla/good samaritan. If it is indeed the latter, I wonder how they are so brazen about it. Does chattr.ai have a responsible disclosure policy? In my eyes people should be free to pentest whatever as long as there is no intent to cause harm and any findings are reported. Sadly, many companies will freak out and get the law involved, even if you are…
> It's not clear if the author was hired to do this pentest or is a guerilla/good samaritan Pretty clear to me, "it was searching for exposed Firebase credentials on any of the hundreds of recent AI startups.", running a script to scan hundreds of startups > Sadly, many companies will freak out and get the law involved, even if you are a good samaritan. Yeah, but that also ends with that company being shamed a lot of…