All your OpenCodes belong to us
johncodes.com
All your OpenCodes belong to us
1–10 of 16 posts
Re: All your OpenCodes belong to us
#2The one thing here confusing to me is the past tense used throughout. This CVE seems presented as both past and present, yet the present evidence isn't... Presented.
Re: All your OpenCodes belong to us
#3I don't know if I missed something, but this CVE isn't that major as it was suggested to be? For one it had to originate from app.opencode.com and even if it didn't most (good) browsers block websites from probing localhost. Yes it is still a pretty bad CVE, but not as critical as some might suggest.
Re: All your OpenCodes belong to us
#4I don't know if I missed something, but this CVE isn't that major as it was suggested to be? For one it had to originate from app.opencode.com and even if it didn't most (good) browsers block websites from probing localhost. Yes it is still a pretty bad CVE, but not as critical as some might suggest.
> For one it had to originate from app.opencode.com
No, that was the initial mitigation! Before the vulnerability was reported, the server was accessible to the entire world with a wide-open CORS policy.
https://github.com/anomalyco/opencode/commit/7d2d87fa2c44e32...
Re: All your OpenCodes belong to us
#5I don't know if I missed something, but this CVE isn't that major as it was suggested to be? For one it had to originate from app.opencode.com and even if it didn't most (good) browsers block websites from probing localhost. Yes it is still a pretty bad CVE, but not as critical as some might suggest.
> For one it had to originate from app.opencode.com No, that was the initial mitigation ! Before the vulnerability was reported, the server was accessible to the entire world with a wide-open CORS policy. https://github.com/anomalyco/opencode/commit/7d2d87fa2c44e32...
[deleted]
Re: All your OpenCodes belong to us
#6Great write up.
These local agents that you spawn and give access to your drive are kind of insane to me.
It's at the level of
/bin/bash -c "$(curl -fsSL https://somescriptofftheinternet
As per usual, being at the forefront of the tech world is leaving behind privacy and security in the dust... until something bad happens.
Re: All your OpenCodes belong to us
#7Great write up. These local agents that you spawn and give access to your drive are kind of insane to me. It's at the level of /bin/bash -c "$(curl -fsSL https://somescriptofftheinternet which you cannot inspect, and may be well different every time you interact with it! As per usual, being at the forefront of the tech world is leaving behind privacy and security in the dust... until something bad happens.
Historically at least there have been some established high trust projects for which curl | bash made sense. But with AI the scene is full of grifters and vibe coders so we can't have nice things.
Re: All your OpenCodes belong to us
#8I don't know if I missed something, but this CVE isn't that major as it was suggested to be? For one it had to originate from app.opencode.com and even if it didn't most (good) browsers block websites from probing localhost. Yes it is still a pretty bad CVE, but not as critical as some might suggest.
> For one it had to originate from app.opencode.com No, that was the initial mitigation ! Before the vulnerability was reported, the server was accessible to the entire world with a wide-open CORS policy. https://github.com/anomalyco/opencode/commit/7d2d87fa2c44e32...
How is it wide open? Does everything go through a localhost proxy?
Re: All your OpenCodes belong to us
#9Great write up. These local agents that you spawn and give access to your drive are kind of insane to me. It's at the level of /bin/bash -c "$(curl -fsSL https://somescriptofftheinternet which you cannot inspect, and may be well different every time you interact with it! As per usual, being at the forefront of the tech world is leaving behind privacy and security in the dust... until something bad happens.
Not for me. I was running these things in sandboxes from the start. Couldn't believe people were running this stuff straight up.
Re: All your OpenCodes belong to us
#10> a RCE vulnerability is the type of thing that nation state actors in Russia and North Korea dream of
Does this mean other state actors are beyond needs of RCE vulns as their tools belt and North Korea and Russia lagging behind? Some other interpretation from security-involved practitioners here - like, I don't know - we already have Pegasus, phew on OpenCode RCE?