"range of hundreds of millions of people in tech environments, other hackers, programmers, executives, etc. making this exploit deadly if used." Bit too hyperbolic or whatever... Otherwise thrilling read!
[flagged]
How to gain code execution on hundreds of millions of people and popular apps
181–190 of 350 posts
Re: How to gain code execution on hundreds of millions of people and popular apps
#182Dave here, founder of ToDesktop. I've shared a write-up: https://www.todesktop.com/blog/posts/security-incident-at-to... This vulnerability was genuinely embarrassing, and I'm sorry we let it happen. After thorough internal and third-party audits, we've fundamentally restructured our security practices to ensure this scenario can't recur. Full details are covered in the linked write-up. Special thanks to Eva for resp…
[flagged]
Re: How to gain code execution on hundreds of millions of people and popular apps
#183The javascript world has a culture of lots of small dependencies that end up becoming a huge tree no one could reasonable vendor or audit changes for. Worse these small dependencies churn much faster than for other languages.
With that culture supply chain attacks and this kind of vulnerability will keep happening a lot.
You want few dependencies, you want them to be widely used and you want them to be stable. Pulling in a tree of modules to check if something is odd or even isn't a good idea.
Re: How to gain code execution on hundreds of millions of people and popular apps
#184This is the second big attack found by this individual in what... 6 months? The previous exploit (which was in Arc browser), also leveraged a poorly configured firebase db: https://kibty.town/blog/arc/ So this is to say, at what point should we start pointing the finger at Google for allowing developers to shoot themselves in the foot so easily? Granted, I don't have much experience with firebase, but to me this just…
I'm sorry, but when will we hold the writers of crappy code responsible for their own bad decisions? Let's start there.
I always find unbelievable how we NEVER hold developers accountable.
Any "actual" Engineer would be (at least the one signing off, but in software developers never sign off anything - and maybe that's the problem).
Re: How to gain code execution on hundreds of millions of people and popular apps
#185I'm a huge fan of the writing style. it's like hacking gonzo, but with literally 0 fluff. amazing work and an absolute delight to read from beginning to end
[flagged]
Re: How to gain code execution on hundreds of millions of people and popular apps
#186I’d like to see some thoughts on where we go from here. Is there a way we can keep end users protected even despite potential compromise of services like ToDesktop?
(eg: companies still hosting some kind of integrity checking service themselves and the download is verified against that… likely there’s smarter ideas)
The user experience of auto-update is great, but having a single fatal link in the chain seems worrying. Can we secure it better?
Re: How to gain code execution on hundreds of millions of people and popular apps
#187> [please don't] make it seem like it's their fault, it's not. it's todesktop's fault if anything What?! It's not some kind of joke. This could _already_ literally kill people, stole money and ruin lives. It isn't even an option to avoid taking reaponsibility for the decisions which lead to security and safety of users for any app owner/author. It's as simple as this: no safety record to 3rd party - no trust, for sur…
Bit breathless. How could this kill people?
Re: How to gain code execution on hundreds of millions of people and popular apps
#188Earlier quoted context omitted.
> Google isn't to blame if you ship a paid product without running a security audit. Arguably, if you provide a service that makes it trivial to create security issues (that is to say, you have to go out of your way to use it correctly) then it's your fault. If making it secure means making it somewhat less convenient, it's 100% your fault for not making it less convenient.
What if I need to hack together a POC for 3 people to look at. It's my responsibility to make sure when we scale from 3 users to 30k users we take security seriously. As my old auto shop teacher used to say, if you try to idiot proof something they'll build a better idiot. Even if Google warns you in big bold print "YOU ARE DOING SOMETHING INSECURE", someone out there is going to click deploy anyway. You're arguing G…
Then you should have to click a big red button labelled "Enable insecure mode".
Defaults should be secure. Kind of blows my mind people still don't get this.
Re: How to gain code execution on hundreds of millions of people and popular apps
#189Earlier quoted context omitted.
> Google isn't to blame if you ship a paid product without running a security audit. Arguably, if you provide a service that makes it trivial to create security issues (that is to say, you have to go out of your way to use it correctly) then it's your fault. If making it secure means making it somewhat less convenient, it's 100% your fault for not making it less convenient.
Should we outlaw C because it lets you dereference null pointers, too?
Erm yes! Even the White House has said that.
The only reason we didn't for so long was because we didn't have a viable alternative. Now we do, we should absolutely stop writing C.
Re: How to gain code execution on hundreds of millions of people and popular apps
#190This is the second big attack found by this individual in what... 6 months? The previous exploit (which was in Arc browser), also leveraged a poorly configured firebase db: https://kibty.town/blog/arc/ So this is to say, at what point should we start pointing the finger at Google for allowing developers to shoot themselves in the foot so easily? Granted, I don't have much experience with firebase, but to me this just…
I'm sorry, but when will we hold the writers of crappy code responsible for their own bad decisions? Let's start there.
I don't know but we're in a thread about Cursor... I don't think anyone is writing significantly better code using Cursor.