Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anonymous GitHub account mass-dropping undisclosed 0-days

github.com

Post reply on HN
Print view View original

181–190 of 407 posts

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#181

Post by hamburglar »

theK wrote: post #161
rogerrogerr wrote: post #86

Earlier quoted context omitted.

I used to be an em-dash user, but now my opinion is that I’d rather be perceived as someone who does not want to be confused with an LLM. So I’ve changed my writing style.

What is the typical motivation to start using em-dashes? Why go the extra way to have a slightly elongated dash when a normal one would just as well do the job? I might be conpletely off here but I've never seen a situation where using a normal dash where a long one should be causes any sort of syntactic trouble.

I think people who care about correctness and also read a lot automatically see the difference and it seems (and is) technically incorrect to use a hyphen where an em dash belongs. That’s really it. Kind of like you wouldn’t just leave out the apostrophes in your writing even though in most contexts they are not strictly necessary for comprehension.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#182

Post by a-dub »

cool to see rustdesk. low level memory bugs were long mysterious and i think often received most of the attention for this reason, but always fun to see reminders that "nope, good ol' fashioned logic bugs in high level languages have security implications too." if anything, i think they sometimes are more clever as they require deeper understanding of what the code actually does, intends to do and what was overlooked rather than the common set of bookkeeping errors that are often the root of the memory bugs.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#184

Post by tialaramex »

GTP wrote: post #73
tyre wrote: post #52

Earlier quoted context omitted.

> Please do not abuse these. Reminds me of Jamie Wolf's joke about bestiality laws. Who are those for? What stops most people from bestiality is… not wanting to have sex with animals! For people who do want to, what, they won't because of… the law?? Who will this comment stop??

Well, it's a joke because the problem becomes apparent after you think a bit about it. The exact same reasonig can be applied to anything illegal, criminals are criminals because they don't respect the law, so you could try to say that laws are useless. Reality is, if something is illegal not only someone can be punished after the fact, but in some cases also preventive measures can be taken. Regarding the comment, i…

Technically there are distinct crimes where we know that shifting penalties changes what happens but the impact tends to be on organised crime.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#185

Post by athrowaway3z »

Retr0id wrote: post #17

I took a look at the Ghidra ones (because I use Ghidra), and I'm unimpressed: https://github.com/bikini/exploitarium/blob/main/ghidra-12.1... The first requires being able to overwrite binaries in the Swift tool directory. Yes, if you overwrite binaries executed by ghidra, you can trigger code execution. This is not a surprise. The second, idk, I'm not familiar with TraceRMI (but it's probably worth noting that "RMI"…

A glance at the nmap one seems potentially high severity. It might be a nothing in practice, but it being around parser code means the chances of preparing something to jump around are pretty high.

There'd be a certain irony being able to reverse shell anyone doing an nmap scan. If i had infinite tokens i'd throw claude on writing an exploit and dig through the history who made it possible because - if we take a moment to wildly speculate and assume it can ACE - this is the kind of bug an intelligence agency would love to have: Add a few ipv6 packets that then edit the trace being observed if the observer uses nmap / get access to any researcher pc who uses nmap.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#186

Post by rogerrogerr »

DrewADesign wrote: post #176
rogerrogerr wrote: post #86

Earlier quoted context omitted.

I used to be an em-dash user, but now my opinion is that I’d rather be perceived as someone who does not want to be confused with an LLM. So I’ve changed my writing style.

I don’t give a flying fuck what people think. Most colleges copied or adopted my (for a few semesters) school’s style guide, so LLMs are essentially copying me , and I won’t change my punctuation usage because they suck.

Yeah, I get it, they do suck. It all sucks.

But people at work who are copying responses from LLMs into emails to others also suck, and I want to distance myself from them as much as possible. I'm kinda hoping we will eventually have a wave of "what the fuck are we paying you for if you're just copying stuff from an LLM to Slack" firings.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#187

Post by asadotzler »

merelydev wrote: post #113
grayhatter wrote: post #98

Earlier quoted context omitted.

If you believe this, then why did you say? > starting to think security through obscurity might not be a bad thing

Because of asymmetric differences, I don't have access to powerful LLMs but attackers might. And also the complexities of software dependencies (supply chain vulnerabilities), my software depends on packages not in my control and I don't have time to audit the entire stack.

Perhaps the answer is to depend only on packages that come from people that are more competent than you so you can know if or when your program is compromised that it'll most likely be your fault and not theirs.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#188

Post by Valodim »

utopiah wrote: post #55
tyre wrote: post #52

Earlier quoted context omitted.

> Please do not abuse these. Reminds me of Jamie Wolf's joke about bestiality laws. Who are those for? What stops most people from bestiality is… not wanting to have sex with animals! For people who do want to, what, they won't because of… the law?? Who will this comment stop??

If it stops even just 1 person once, isn't it already worth it?

We slaughter animals millions by the day in an industrialized fashion. I'm sure they'll feel much better that even singular instances of sexual harassment are officially not ok on paper.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#189

Post by Wowfunhappy »

jeffbee wrote: post #152
dvt wrote: post #117

Went over a few of these with a pretty keen eye, and they aren't that particularly interesting. The Docker one is just a weird bug, it's not a vulnerability, and certainly not a "0-day" (which is a pretty loaded term and people expect bad stuff to happen). The nghttp2 nghttpx one is more interesting, and could potentially be used for phishing, but it's very hard to line up properly because the request queue is non-de…

I mean, that's how people get hacked. If vlc crashed on my computer, and every day I should raise thanks to my gods that I do not use vlc, I would immediately unplug it and thoughtfully consider the circumstances under which it would be safe to turn it back on.

> I mean, that's how people get hacked.

...when was the last documented case of an in-the-wild hack targeting VNC?

Post reply on HN