Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to gain code execution on hundreds of millions of people and popular apps

kibty.town

Post reply on HN
Print view View original

171–180 of 350 posts

Re: How to gain code execution on hundreds of millions of people and popular apps

#171

Post by cdmyrm »

floydnoel wrote: post #76
stefan_ wrote: post #33

Earlier quoted context omitted.

Yeah, it is their fault. I don't download "todesktop" (to-exploit), I download Cursor. Don't give 3rd parties push access to all your clients, that's crazy. How can this crappy startup build server sign a build for you? That's insane.

it blows me away that this is even a product. it's like a half day of dev time, and they don’t appear to have over-engineered it or even done basic things given the exploit here.

Software developers don't actually write software anymore, they glue together VC-funded security nightmares every 1-3 years, before moving on to the next thing. This goes on and on until society collapses under its own weight.

Re: How to gain code execution on hundreds of millions of people and popular apps

#172

Post by cdmyrm »

vekatimest wrote: post #27

The cat is cute but I'd rather not have it running in front of the text while I'm trying to read and use my cursor.

There are plenty of other websites that don't do that. Perhaps one of those would work better for you?

Re: How to gain code execution on hundreds of millions of people and popular apps

#174

Post by hofrogs »

rvz wrote: post #6

My goodness. So much third-party risk upon risk and lots of external services opening up this massive attack surface and introducing this RCE vulnerability. From an Electron bundler service, to sourcemap extraction and now an exposed package.json with the container keys to deploy any app update to anyone's machine. This isn't the only one, the other day Claude CLI got a full source code leak via the same method from…

The issue here is not sourcemaps being available. The issue is admin credentials being shipped to clients for no reason.

Re: How to gain code execution on hundreds of millions of people and popular apps

#176

Post by cdmyrm »

gamedever wrote: post #49
rvz wrote: post #6

My goodness. So much third-party risk upon risk and lots of external services opening up this massive attack surface and introducing this RCE vulnerability. From an Electron bundler service, to sourcemap extraction and now an exposed package.json with the container keys to deploy any app update to anyone's machine. This isn't the only one, the other day Claude CLI got a full source code leak via the same method from…

Blaming Js/Ts is ridiculous. All those same problems exist in all environments. Js/Ts is the biggest so it gets the most attention but if you think it's different in any other environment you're fooling yourself.

[flagged]
Post reply on HN