Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Incident Report: CVE-2024-YIKES

nesbitt.io

Post reply on HN
Print view View original

81–90 of 187 posts

Re: Incident Report: CVE-2024-YIKES

#81

Post by mmastrac »

hacker_homie wrote: post #22
hacker_homie wrote: post #7

Earlier quoted context omitted.

Move high value crates into the standard library?

Maybe give crates a gold star if they have no external dependencies?

It's hard to have zero deps - I put many hours into one to have no required deps in the end but it was not easy, and writing declarative macros to do anything complex takes work (and a proc macro often means a minimum of two crates). Both of the crates it requires are part of the same project, however.

One of my other crates (getaddrinfo) requires windows-sys and libc which would be challenging to get rid of.

I like the idea of low deps but zero is tough

https://crates.io/crates/ctor/1.0.4/dependencies

Re: Incident Report: CVE-2024-YIKES

#82

Post by rectang »

jerhewet wrote: post #78
saint_yossarian wrote: post #23

Earlier quoted context omitted.

> But for a long time (and maybe even still), a hacker creed was "move fast and break things." Was it? I thought Zuckerberg coined this horrible phrase.

Joel Spolsky. https://www.joelonsoftware.com/2000/04/06/things-you-should-...

I love that article, but the words "move", "fast", and "break" don't appear in it.

Re: Incident Report: CVE-2024-YIKES

#83

Post by ineedasername »

>"The legitimate maintainer has won €2.3 million in the EuroMillions and is researching goat farming in Portugal..."

>"Root Cause: A dog named Kubernets ate a Yubikey

Ah, yes, irresponsible to get taken in by one of the well-known classic exploits. The 'ol "distract someone with a lottery windfall & make a dongle irresistibly tasty to another person's pet". When will people learn.

Re: Incident Report: CVE-2024-YIKES

#84

Post by EdwardDiego »

As a Fish aficionado (Afishionado?) - I feel both attacked and seen by this:

> who asked us to clarify that the fish shell is not malware, it just feels that way sometimes.

And unrelated to shells...

> The author would like to remind stakeholders that the security team’s headcount request has been in the backlog since Q1 2023.

I also feel seen by this.

Re: Incident Report: CVE-2024-YIKES

#85

Post by walrus01 »

sdenton4 wrote: post #55
ObiKenobi wrote: post #40

The maintainer of left-justify receives his YubiKey from yubikey-official-store.net. It is a $4 USB drive containing a README that says “lol.” Got me seriously laughing... Such a troll.

Yeah that's great. I love that plugging in the USB device from the phishing site is, itself, another attack vector...

I actually wonder if somebody used a fake identity to set up an account with a warehousing/shipment fulfillment company that stocks things and ships them, then set up the appropriate EDI pipeline to send shipping orders to it... What would be the results if a decently budgeted adversary made something attractive looking that shipped malicious USB flash drives to anyone that requested one.

I know we're not in the era when a windows pc will happily run any autorun.inf and .EXE file found on an inserted flash drive or DVD anymore. But even so. What if it didn't even have any malicious data payload but somebody was shipping USB-A interface capacitor based usb killers?

https://www.slashgear.com/1819672/usb-killer-explained-kill-...

What if it did have data on it and came with a slick color brochure walking people through how to run the binary, or in a linux or developer specific audience, how to 'sudo' the ELF binary that lives on its filesystem?

Re: Incident Report: CVE-2024-YIKES

#87

Post by walrus01 »

EdwardDiego wrote: post #84

As a Fish aficionado (Afishionado?) - I feel both attacked and seen by this: > who asked us to clarify that the fish shell is not malware, it just feels that way sometimes. And unrelated to shells... > The author would like to remind stakeholders that the security team’s headcount request has been in the backlog since Q1 2023. I also feel seen by this.

> As a Fish aficionado (Afishionado?) - I feel both attacked and seen by this:

As an alternative, it could apt-get or dnf install 'figlet' and then overwrite the contents of /etc/motd with 'all your base are belong to us' in extremely large ASCII art font.

Re: Incident Report: CVE-2024-YIKES

#88

Post by SAI_Peregrinus »

hacker_homie wrote: post #7
vsgherzi wrote: post #2

Supply chain incidents suck and we need to do better. Personally for rust I’m a proponent of the foundation supporting a few core crates that go under the same audit procedure as the main rust language and give funding to the project to limit supply chain vulns. I don’t think the right answer is to remove systems like crates or npm. Crate and npm are a boon for many developers.

Move high value crates into the standard library?

An extra tier of standard library which can make breaking changes, perhaps. Rust's stability guarantee for std means cryptography really shouldn't go in there, since sometimes algorithms & protocols get broken (DES, MD5, SHA1, etc.) and need to be removable. Without breaking changes you get stuck with security vulnerabilities, if not from cryptography then from other poorly-designed APIs.

Re: Incident Report: CVE-2024-YIKES

#89

Post by OhMeadhbh »

adastra22 wrote: post #50
lynndotpy wrote: post #12

For anyone confused, this is (very good imo) fiction about supply-chain incidents. It had me very worried during a brief scan that it was real though, which made me read it more attentively :)

I couldn't tell at first, tbh. It had this vibe: https://github.com/bitcoin/bips/blob/master/bip-0042.mediawi...

Yeah. Me too. It looked like a spoof when I started reading, but as I went on it didn't seem to be increasing in it's implausibility.

Re: Incident Report: CVE-2024-YIKES

#90

Post by krautsauer »

philipwhiuk wrote: post #20
lynndotpy wrote: post #12

For anyone confused, this is (very good imo) fiction about supply-chain incidents. It had me very worried during a brief scan that it was real though, which made me read it more attentively :)

'nmp'

I only noticed at goat farming. But anyway, what would a left-justify package do?
Post reply on HN