Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to gain code execution on hundreds of millions of people and popular apps

kibty.town

Post reply on HN
Print view View original

191–200 of 350 posts

Re: How to gain code execution on hundreds of millions of people and popular apps

#191

Post by [deleted] »

TheDong wrote: post #94
tomjakubowski wrote: post #43

Earlier quoted context omitted.

Indeed, you can indeed punch out from an actions runner. Such a thing is probably against GitHub's ToS, but I've heard from my third cousin twice removed that his friend once ssh'ed out from an action to a bastion host, then used port forwarding to get herself a shell on the runner in order to debug a failing build.

> probably against GitHub's ToS, but Why would running code on a github action runner that's built to run code be against ToS? If it was, I'm sure they'd ban the marketplace extensions that make it absolutely trivial to do this: https://github.com/marketplace/actions/debugging-with-ssh

[deleted]

Re: How to gain code execution on hundreds of millions of people and popular apps

#192

Post by nonesuchuser »

TZubiri wrote: post #84
noisy_boy wrote: post #57

Question/idea: can't GitHub use LLMs to periodically scan the code for vulnerabilities like this and inform the repo owner? They can even charge for it ;)

Problem: a tool built with LLMs for building LLMs with LLMs has a vuln Solution: more LLMs Snap out of it

So you're saying one more LLM?

Re: How to gain code execution on hundreds of millions of people and popular apps

#193

Post by throw339d00 »

cdmyrm wrote: post #161
nyolfen wrote: post #110

Earlier quoted context omitted.

no offense man but this is totally inexcusable and there is zero chance i am ever touching anything made by y'all, ever

Good call. I'd seriously considering firing the developers responsible, too.

That's what a bad manager would do.

The employee made a mistake and you just paid for them to learn about it. Why would you fire someone you just educated?

Re: How to gain code execution on hundreds of millions of people and popular apps

#194

Post by sendintheclowns »

TZubiri wrote: post #75

I can't post things like "what a bunch of clowns" due to hacker news guidelines so let me go by another more productive route. These people, the ones who install dependencies (that install dependencies)+, these people who write apps with AI, who in the previous season looped between executing their code and searching the error on stackoverflow. Whether they work for a company or have their own startup, the moment tha…

[flagged]

Re: How to gain code execution on hundreds of millions of people and popular apps

#195

Post by ddingus »

Hackbraten wrote: post #149
RadiozRadioz wrote: post #132

Earlier quoted context omitted.

How about we don't build an auto-updater? Maybe some apps require an extremely tight coupling with a server, but we should try our best to release complete software to users that will work as close to forever as possible. Touching files on a user's system should be treated as a rare special occurrence. If a server is involved with the app, build a stable interface and think long and hard about every change. Meticulou…

> Maybe some apps require an extremely tight coupling with a server, but we should try our best to release complete software to users that will work as close to forever as possible. That sounds like a good idea. Unless you’re the vendor, and instead of 1000 support requests for version N, you’re now facing 100 support requests for version N, 100 for N−1, 100 for N−2, …, and 100 for N−9.

Have been there, done that.

The answer is a support window. If they are in bounds and have active maintenance contracts, support them.

If not, give them an option to get on support, or wish them luck.

Then the other answer is to really think releases through.

None of it is cheap. But it can be managed.

Re: How to gain code execution on hundreds of millions of people and popular apps

#196

Post by ddingus »

cdmyrm wrote: post #157
Hackbraten wrote: post #149

Earlier quoted context omitted.

> Maybe some apps require an extremely tight coupling with a server, but we should try our best to release complete software to users that will work as close to forever as possible. That sounds like a good idea. Unless you’re the vendor, and instead of 1000 support requests for version N, you’re now facing 100 support requests for version N, 100 for N−1, 100 for N−2, …, and 100 for N−9.

You're allowed to have a support matrix. You can refuse to support versions that are too old, but you can also just... let people keep using programs on their own computers.

Yep.

And anyone who does will find a percentage of users figure it out and then just get back to work.

Re: How to gain code execution on hundreds of millions of people and popular apps

#197

Post by sendintheclowns »

throw339d00 wrote: post #193
cdmyrm wrote: post #161

Earlier quoted context omitted.

Good call. I'd seriously considering firing the developers responsible, too.

That's what a bad manager would do. The employee made a mistake and you just paid for them to learn about it. Why would you fire someone you just educated?

[flagged]

Re: How to gain code execution on hundreds of millions of people and popular apps

#198

Post by mikechalmers »

milesrout wrote: post #185
permo-w wrote: post #124

I'm a huge fan of the writing style. it's like hacking gonzo, but with literally 0 fluff. amazing work and an absolute delight to read from beginning to end

[flagged]

Obnoxious is a bit harsh - I liked the feeling it gave to the article, found it very readable and I had no trouble discerning sentences, especially with how they were broken up into paragraphs.

Re: How to gain code execution on hundreds of millions of people and popular apps

#199

Post by ddingus »

davej wrote: post #12
spudlyo wrote: post #9

Earlier quoted context omitted.

> cannot happen again. Hubris. Does not inspire confidence. > We resolved the vulnerability within 26 hours of its initial report, and additional security audits were completed by February 2025. After reading the vulnerability report, I am impressed at how quickly you guys jumped on the fix, so kudos. Did the security audit lead to any significant remediation work? If you weren't following PoLP, I wonder what else ma…

Fair point. Perhaps better phrased as "to ensure this scenario can't recur.". I'll edit my post. Yes, we re-architected our build container as part of remediation efforts, it was quite significant.

That was solid. Nice way to handle a direct personal judgement!

Not your first rodeo.

Another way is to avoid absolutes and ultimatums as aggressively as one should avoid personal judgements.

Better phrased as: "we did our best to prevent this scenario from happening again.

Fact is it just could happen! Nobody likes that reality, and overall when we think about all this stuff, networked computing is a sad state of affairs..

Best to just be 100 percent real about it all, if you ask me.

At the very least people won't nail you on little things, which leaves you something you may trade on when a big thing happens.

And yeah, this is unsolicited and worth exactly what you paid. Was just sharing where I ended up on these things in case it helps

Re: How to gain code execution on hundreds of millions of people and popular apps

#200

Post by misiek08 »

cdmyrm wrote: post #164
prophesi wrote: post #126

Earlier quoted context omitted.

I think that's throwing the baby out with the bathwater; sane defaults are still an important thing to think about when developing a product. And for something as important as a database, which usually requires authentication or storing personal information, let your tutorials focus on these pain points instead of the promise of a database-driven app with only clientside code. It's awesome, but I think it deserves th…

Any purported expert who uses software without considering its security is simply negligent. I'm not sure why people are trying to spin this to avoid placing the blame on the negligent programmer(s).

Weak programmers do this to defend this group making crap software. I agree that defaults should be secure and maybe there should be request limit on admin, full access token - but then people will just create another token with full access and use it.
Post reply on HN