Live data from Hacker News

Incident Report: CVE-2024-YIKES

nesbitt.io

101–110 of 187 posts

Re: Incident Report: CVE-2024-YIKES

#101
post #68

Earlier quoted context omitted.

You will have lots of dead code in your build. That dead code might have "dead dependencies" - transitive dependencies of its own, that it pulls in even though they are not actually used in the parts of the crate you care about. In the worst case, you can also have "undead code" - event handlers, hooks, background workers etc that the framework automatically registers and runs and that will do something at runtime, w…

Libraries like Guava and Commons don't have transitive dependencies - they are self contained except for other parts of the same library.

The same issue occurs whether you bundle all the code together or not, it's just that if you bundle it together you don't see what's happening and you can't use only part of it easily.

Re: Incident Report: CVE-2024-YIKES

#102

Earlier quoted context omitted.

Move high value crates into the standard library?

Maybe give crates a gold star if they have no external dependencies?

This only encourages rewriting perfectly fine libraries badly. There's no simple metric to actually optimize here.

Re: Incident Report: CVE-2024-YIKES

#103

Earlier quoted context omitted.

To be really sure it downloads, curl -k | sudo bash

`curl -k | sudo bash | yes` for good measure, otherwise it might hang.

If you really want to make sure that it's the right thing (because piping to sudo bash is risky), make sure the URL starts with "pastebin", or ends in ".tk", or is an IP address.

Re: Incident Report: CVE-2024-YIKES

#104

Earlier quoted context omitted.

> But for a long time (and maybe even still), a hacker creed was "move fast and break things." Was it? I thought Zuckerberg coined this horrible phrase.

Joel Spolsky. https://www.joelonsoftware.com/2000/04/06/things-you-should-...

https://www.google.com/search?q=sposky%27s+worst+essay&sclie...

Re: Incident Report: CVE-2024-YIKES

#106

Earlier quoted context omitted.

Yeah that's great. I love that plugging in the USB device from the phishing site is, itself, another attack vector...

I actually wonder if somebody used a fake identity to set up an account with a warehousing/shipment fulfillment company that stocks things and ships them, then set up the appropriate EDI pipeline to send shipping orders to it... What would be the results if a decently budgeted adversary made something attractive looking that shipped malicious USB flash drives to anyone that requested one. I know we're not in the era…

A USB that was both storage and a keyboard, that executed the keystrokes to download malware, was demo'd at a DefCon a few years back.

Re: Incident Report: CVE-2024-YIKES

#107

Earlier quoted context omitted.

`curl -k | sudo bash | yes` for good measure, otherwise it might hang.

If you really want to make sure that it's the right thing (because piping to sudo bash is risky), make sure the URL starts with "pastebin", or ends in ".tk", or is an IP address.

To be absolutely positively certain, be sure that the IP address is also in the same /24 as the same net blocks and hosted on the same AS that appear in every DNS based mail RBL possible.

Re: Incident Report: CVE-2024-YIKES

#108
post #43
post #35

Earlier quoted context omitted.

Ya, latest is a mess. I don't care about latest, I want the version with no known security flaws.

Latest has no known security flaws.

Well, other than the one where the developer allowed someone hawking malware to upload instead.

Re: Incident Report: CVE-2024-YIKES

#109
post #61
post #3

Earlier quoted context omitted.

Crates has also been making efforts to include rust sec, but in addition to the above I would like the community to shy away from many small dependencies to a few larger ones just as tokio has

Contrary to what the article here presents, Rust does not have a culture of microlibraries like NPM does. The author and their LLM are cargo-culting a criticism of Rust made by people whose only experience is with the Node ecosystem. The Rust stdlib may not be especially "wide" compared to languages like Python, but it is quite deep, with the objective of making it so that you don't feel the need to publish single-pu…

What are you talking about? Every Rust project I see seems to have 5 dependencies that do some simple thing that should be in the standard library, or at least in some centrally-audited monolibrary of utilities.
Post reply on HN