Related:
We pwned X, Vercel, Cursor, and Discord through a supply-chain attack
How to hack Discord, Vercel and more with one easy trick
11–20 of 39 posts
Re: How to hack Discord, Vercel and more with one easy trick
#12[deleted]
Re: How to hack Discord, Vercel and more with one easy trick
#13How is a company like mintlify getting so many big name customers for what appears to be a static site generator + hosting? Is there some secret sauce I'm missing, what is the value proposition?
Re: How to hack Discord, Vercel and more with one easy trick
#14How is a company like mintlify getting so many big name customers for what appears to be a static site generator + hosting? Is there some secret sauce I'm missing, what is the value proposition?
Convenience and developer uncertainty. I fall pray to the "it's paid, so it must be better" fallacy, and the "they know what they are doing, they are pros" illogicality.
Re: How to hack Discord, Vercel and more with one easy trick
#15This feels so emblematic of our current era. VC funded vibe coded AI documentation startup somehow gets big name customers who don't properly vet the security of the platform, ship a massive vulnerability that could pwn millions of users and the person who reports the vulnerability gets...$5k. If I recall last week Mintlify wrote a blog post showcasing their impressive(ly complicated) caching architecture. Pretending…
You bet not all THW vulnerabilities are reported to the vendors. Not with 5k bounty for THAT.
THW?
Re: How to hack Discord, Vercel and more with one easy trick
#16This feels so emblematic of our current era. VC funded vibe coded AI documentation startup somehow gets big name customers who don't properly vet the security of the platform, ship a massive vulnerability that could pwn millions of users and the person who reports the vulnerability gets...$5k. If I recall last week Mintlify wrote a blog post showcasing their impressive(ly complicated) caching architecture. Pretending…
Chill - just because someone got hacked doesn't mean their product is trash. Easily every mass adopted product created prior to 2023 has been hacked at some point.
Re: How to hack Discord, Vercel and more with one easy trick
#17Earlier quoted context omitted.
> This feels so emblematic of our current era. VC funded vibe coded AI documentation startup somehow ... Is there any indication Mintify was "vibe coded"?
I'm giving them the benefit of the doubt, as the alternative would be that their developers are completely incompetent. The vulnerability is the equivalent to letting a user save HTML to a database and then injecting it into every page completely unsanitized.
Mintlify had a blacklist in place to not allow them to do this with most file types. Someone failed to add SVG to it. It's not like they weren't thinking about security. The challenge with security, as you know, is it's only as strong as it's weakest link. It only takes one ignorant/incompetent person in an entire organization to jeopordize the org. But even a competent person can make a crucial mistake.
Re: How to hack Discord, Vercel and more with one easy trick
#18Earlier quoted context omitted.
I'm giving them the benefit of the doubt, as the alternative would be that their developers are completely incompetent. The vulnerability is the equivalent to letting a user save HTML to a database and then injecting it into every page completely unsanitized.
Mintlify had a blacklist in place to not allow them to do this with most file types. Someone failed to add SVG to it. It's not like they weren't thinking about security. The challenge with security, as you know, is it's only as strong as it's weakest link. It only takes one ignorant/incompetent person in an entire organization to jeopordize the org. But even a competent person can make a crucial mistake.
The challenge with security, as you know, is it's only as strong as it's weakest link. It only takes one ignorant/incompetent person in an entire organization to jeopordize the org.
Re: How to hack Discord, Vercel and more with one easy trick
#19This feels so emblematic of our current era. VC funded vibe coded AI documentation startup somehow gets big name customers who don't properly vet the security of the platform, ship a massive vulnerability that could pwn millions of users and the person who reports the vulnerability gets...$5k. If I recall last week Mintlify wrote a blog post showcasing their impressive(ly complicated) caching architecture. Pretending…
Chill - just because someone got hacked doesn't mean their product is trash. Easily every mass adopted product created prior to 2023 has been hacked at some point.
That makes it worse, not better. Because for those applications the code was audited and not hallucinated.
Re: How to hack Discord, Vercel and more with one easy trick
#20Earlier quoted context omitted.
I'm giving them the benefit of the doubt, as the alternative would be that their developers are completely incompetent. The vulnerability is the equivalent to letting a user save HTML to a database and then injecting it into every page completely unsanitized.
Mintlify had a blacklist in place to not allow them to do this with most file types. Someone failed to add SVG to it. It's not like they weren't thinking about security. The challenge with security, as you know, is it's only as strong as it's weakest link. It only takes one ignorant/incompetent person in an entire organization to jeopordize the org. But even a competent person can make a crucial mistake.
A whitelist is safer than a blacklist. Unfortunately you risk losing those customers that won't be able to load their media, won't contact support, will use a different service.