Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Roblox cheat and one AI tool brought down Vercel's platform

webmatrices.com

Post reply on HN
Print view View original

131–140 of 186 posts

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#131

Post by inetknght »

nippoo wrote: post #124

"I went through about a dozen AI tools I've personally authorized in the last year after reading this. Nine of them have Google Workspace OAuth permissions that include reading all emails and accessing all Drive files. Nine. I authorized every one of them without reading the permissions because the onboarding flow asked and I was in a hurry." Do other (tech-literate) people do this?! Giving anything access to my emai…

> *Nine of them have Google Workspace OAuth permissions that include reading all emails and accessing all Drive files. Nine. I authorized every one of them without reading the permissions because the onboarding flow asked and I was in a hurry."

No, you didn't authorize every one of them without reading the permissions because the onboarding flow asked and you were in a hurry.

You authorized it because the onboarding flow asked, and you weren't given an opportunity to say no. What are you to do: say no, and then not use the app?

This whole concept is just wrong. Instead of saying "no" and the app seeing that you didn't grant permission: you should be able to say "no", and the app shouldn't see any denial at all. It should just see empty data when requesting it. Problem fucking solved. You get to use whatever apps you want, apps get to ask for whatever permissions they want, and you get to deny that permission without the app fucking you over.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#132

Post by watchful_moose »

inetknght wrote: post #131
nippoo wrote: post #124

"I went through about a dozen AI tools I've personally authorized in the last year after reading this. Nine of them have Google Workspace OAuth permissions that include reading all emails and accessing all Drive files. Nine. I authorized every one of them without reading the permissions because the onboarding flow asked and I was in a hurry." Do other (tech-literate) people do this?! Giving anything access to my emai…

> *Nine of them have Google Workspace OAuth permissions that include reading all emails and accessing all Drive files. Nine. I authorized every one of them without reading the permissions because the onboarding flow asked and I was in a hurry." No, you didn't authorize every one of them without reading the permissions because the onboarding flow asked and you were in a hurry. You authorized it because the onboarding…

This just moves the problem to support. The app doesn't work for users, they don't remember clicking no, and then some CSR has to hand-hold them through clicking "yes".

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#133

Post by postalcoder »

nippoo wrote: post #124

"I went through about a dozen AI tools I've personally authorized in the last year after reading this. Nine of them have Google Workspace OAuth permissions that include reading all emails and accessing all Drive files. Nine. I authorized every one of them without reading the permissions because the onboarding flow asked and I was in a hurry." Do other (tech-literate) people do this?! Giving anything access to my emai…

Personally, no. This comment from the other day has been stuck in my head: "Anyone trying to stay safe will be on the gradient to a Stallmanesque monastic computing existence."[0]

It's both hilarious and true. As much I want to reap the gains of having an openclaw agent going ham on my personal data, I abstain. I shed a tear at all the cool stuff I'm missing out on, but permissions are never about now. Once they have it, they'll always have it.

0: https://news.ycombinator.com/item?id=47796469#47797330

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#134

Post by lesuorac »

inetknght wrote: post #131
nippoo wrote: post #124

"I went through about a dozen AI tools I've personally authorized in the last year after reading this. Nine of them have Google Workspace OAuth permissions that include reading all emails and accessing all Drive files. Nine. I authorized every one of them without reading the permissions because the onboarding flow asked and I was in a hurry." Do other (tech-literate) people do this?! Giving anything access to my emai…

> *Nine of them have Google Workspace OAuth permissions that include reading all emails and accessing all Drive files. Nine. I authorized every one of them without reading the permissions because the onboarding flow asked and I was in a hurry." No, you didn't authorize every one of them without reading the permissions because the onboarding flow asked and you were in a hurry. You authorized it because the onboarding…

I think it's a bit easier to add a "Some" option so that then the App is unaware to the effective "No" answer.

But also a lot of the permissions are just bad. Like I think it's reasonable for somebody to make a web-app that uses my Google Drive as a backend for storing data. I don't think its reasonable that it should be able to open files it didn't create though.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#135

Post by SAI_Peregrinus »

inetknght wrote: post #131
nippoo wrote: post #124

"I went through about a dozen AI tools I've personally authorized in the last year after reading this. Nine of them have Google Workspace OAuth permissions that include reading all emails and accessing all Drive files. Nine. I authorized every one of them without reading the permissions because the onboarding flow asked and I was in a hurry." Do other (tech-literate) people do this?! Giving anything access to my emai…

> *Nine of them have Google Workspace OAuth permissions that include reading all emails and accessing all Drive files. Nine. I authorized every one of them without reading the permissions because the onboarding flow asked and I was in a hurry." No, you didn't authorize every one of them without reading the permissions because the onboarding flow asked and you were in a hurry. You authorized it because the onboarding…

The app shouldn't see empty data, it should see statistically likely fake data.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#136

Post by inetknght »

SAI_Peregrinus wrote: post #135
inetknght wrote: post #131

Earlier quoted context omitted.

> *Nine of them have Google Workspace OAuth permissions that include reading all emails and accessing all Drive files. Nine. I authorized every one of them without reading the permissions because the onboarding flow asked and I was in a hurry." No, you didn't authorize every one of them without reading the permissions because the onboarding flow asked and you were in a hurry. You authorized it because the onboarding…

The app shouldn't see empty data, it should see statistically likely fake data.

While you're right, I'll be happy with just empty data for now. Generating statistically-likely false data is only recently available generally and turns out to be rather expensive.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#137

Post by inetknght »

watchful_moose wrote: post #132
inetknght wrote: post #131

Earlier quoted context omitted.

> *Nine of them have Google Workspace OAuth permissions that include reading all emails and accessing all Drive files. Nine. I authorized every one of them without reading the permissions because the onboarding flow asked and I was in a hurry." No, you didn't authorize every one of them without reading the permissions because the onboarding flow asked and you were in a hurry. You authorized it because the onboarding…

This just moves the problem to support. The app doesn't work for users, they don't remember clicking no, and then some CSR has to hand-hold them through clicking "yes".

> This just moves the problem to support.

Boo-hoo. Support should exist. Support should be trained. Support should help educate the customer. If your business isn't doing that then your business is trashy anyway.

Many companies don't have support. That's a major problem. We have a lot of trashy businesses.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#139

Post by lelanthran »

ErroneousBosh wrote: post #60
rcxdude wrote: post #58

Earlier quoted context omitted.

You always get people screaming about 'it should have been encrypted!' when there's a leak without understanding what encryption can and can't do in principle and in practice (it most certainly isn't a synonym for 'secure' or 'safe').

Whenever someone says "But it should have been encrypted!" about things like configs on a server, I ask them how they'd implement that in practice. PoC or GTFO. I think you'll find it's a bit harder to do than you expect.

> Whenever someone says "But it should have been encrypted!" about things like configs on a server, I ask them how they'd implement that in practice.

Short practical answer: Use a USB HSM plugged into your server and acknowledge that it is an imperfect solution.

For configs, I used to setuid the executable so that it starts up as a user that can read the file, it reads the file into RAM in the first 5 lines in `main` then drops privs immediately to a user that can't read the file, and then continues as normal.

This was to ensure that if the application was compromised, the config could not be changed by the application itself, nor could it be read once the program was running.

If you wanted to keep it encrypted without leaking the key, you could do the same, except that the key would also be read at startup (or, preferably, get a data key from the USB HSM, and use that for decryption).

Of course, that moves the problem of "read the first key from disk" to "read the HSM pin from disk".

You can have your supervising program, like a K8 cluster, inject the correct keys into the pod as it's created, but that cluster itself needs a root key to decrypt those correct keys, and that has to come from somewhere too.

There is, at the end of the day, only one perfect solution: when the program starts up it waits for user input - either the decryption key or the HSM pin - that it uses as a root key to decrypt everything else.

There is no other way that isn't "store some root key, credential, token, etc on the computer".

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#140

Post by ErroneousBosh »

otabdeveloper4 wrote: post #114
ErroneousBosh wrote: post #61

Earlier quoted context omitted.

How often do you log in as root, or use sudo to become root, when you're working with Docker containers? Because I never do, unless I'm down in the depths of /var/lib/docker doing stuff I shouldn't.

That just means you outsourced the `sudo` invocations to some other person. (Which is even worse.)

No, it means I understand how Unix permissions work.
Post reply on HN