Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to gain code execution on hundreds of millions of people and popular apps

kibty.town

Post reply on HN
Print view View original

211–220 of 350 posts

Re: How to gain code execution on hundreds of millions of people and popular apps

#211

Post by zx8080 »

bashback wrote: post #156
zx8080 wrote: post #155

> [please don't] make it seem like it's their fault, it's not. it's todesktop's fault if anything What?! It's not some kind of joke. This could _already_ literally kill people, stole money and ruin lives. It isn't even an option to avoid taking reaponsibility for the decisions which lead to security and safety of users for any app owner/author. It's as simple as this: no safety record to 3rd party - no trust, for sur…

The problem is that this entire sclerotic industry is so allergic to accountability, that, if you want people to start, you probably have to fire 90% of the workforce. If it were up to me, the developers responsible for this would never write software "professionally" again.

The industry (or a couple of generations currently inhabiting it) could start with at least accepting responsibility when something goes wrong. Let me be clear: it's not about ending the "blameless culture" in engineering. No. It's about ending the culture of not taking any responsibility at all, when things go south. See the difference.

Re: How to gain code execution on hundreds of millions of people and popular apps

#212

Post by pulkitsh1234 »

tomjakubowski wrote: post #43
trallnag wrote: post #30

Earlier quoted context omitted.

Isn't it really common for build machines to have outbound internet access? Millions of developers use GitHub Actions for building artifacts and the public runners definitely have outbound internet access

Indeed, you can indeed punch out from an actions runner. Such a thing is probably against GitHub's ToS, but I've heard from my third cousin twice removed that his friend once ssh'ed out from an action to a bastion host, then used port forwarding to get herself a shell on the runner in order to debug a failing build.

could have just used https://github.com/mxschmitt/action-tmate

Re: How to gain code execution on hundreds of millions of people and popular apps

#213

Post by newAccount2025 »

sendintheclowns wrote: post #197
throw339d00 wrote: post #193

Earlier quoted context omitted.

That's what a bad manager would do. The employee made a mistake and you just paid for them to learn about it. Why would you fire someone you just educated?

[flagged]

It’s not a matter of good or bad, but a choice among alternatives?

Nobody gets fired: learning opportunity for next time, but little direct incentive to improve.

Fire someone: accountability theater (who is really responsible), loss of knowledge.

AFAIK, blameless postmortems and a focus on mechanisms to prevent repeats seems like the best we’ve come up with?

Re: How to gain code execution on hundreds of millions of people and popular apps

#214

Post by xrisk »

pjerem wrote: post #207
cdmyrm wrote: post #158

Earlier quoted context omitted.

This is actually precisely how package management works in Linux today... you release new versions, package maintainers package and release them, while ensuring they actually work. This is a solve problem, it's just that nobody writing JavaScript is old enough to realize it's an option.

And that's why I said "apart for Linux". Where are the package maintainers on the OSes everyone uses ? (and don't think that's sarcasm, I'm writing this comment on my linux desktop).

Homebrew and chocolatey?

Re: How to gain code execution on hundreds of millions of people and popular apps

#215

Post by sigmoid10 »

PeterStuer wrote: post #204
RadiozRadioz wrote: post #132

Earlier quoted context omitted.

How about we don't build an auto-updater? Maybe some apps require an extremely tight coupling with a server, but we should try our best to release complete software to users that will work as close to forever as possible. Touching files on a user's system should be treated as a rare special occurrence. If a server is involved with the app, build a stable interface and think long and hard about every change. Meticulou…

Sounds like you come from the B2B, consultancyware or 6÷ figure/year license world. For the vast realm of all your suggestions are completely unviable.

And it's not like B2B doesn't get whacked by bad software or bad actors regulalry. The idea that software updates itself is vastly more benefitial than harmful in the very long term. There so many old machines running outdated software in gated corporate networks, they will get owned immediately once a single one of them is compromised in any way. They are literally trading minor inconveniences for a massive time-bomb with a random timer.

Re: How to gain code execution on hundreds of millions of people and popular apps

#216

Post by XCabbage »

cdmyrm wrote: post #171
floydnoel wrote: post #76

Earlier quoted context omitted.

it blows me away that this is even a product. it's like a half day of dev time, and they don’t appear to have over-engineered it or even done basic things given the exploit here.

Software developers don't actually write software anymore, they glue together VC-funded security nightmares every 1-3 years, before moving on to the next thing. This goes on and on until society collapses under its own weight.

In my experience, blame for this basically never lies on grunt-level devs; it's EMs and CTOs/CIOs who insist on using third-party products for everything out of some misguided belief that it will save dev time and it's foolish to reinvent the wheel. (Of course, often figuring out how to integrate a third-party wheel, and maintain the integration, is predictably far more work for a worse result than making your own wheel in the first place, but I have often found it difficult to convince managers of this. In fairness, occasionally they're right and I'm wrong!)

Re: How to gain code execution on hundreds of millions of people and popular apps

#217

Post by pinoy420 »

davej wrote: post #3

Dave here, founder of ToDesktop. I've shared a write-up: https://www.todesktop.com/blog/posts/security-incident-at-to... This vulnerability was genuinely embarrassing, and I'm sorry we let it happen. After thorough internal and third-party audits, we've fundamentally restructured our security practices to ensure this scenario can't recur. Full details are covered in the linked write-up. Special thanks to Eva for resp…

[dead]

Re: How to gain code execution on hundreds of millions of people and popular apps

#218

Post by ludicrousdispla »

m11a wrote: post #186

I’d like to see some thoughts on where we go from here. Is there a way we can keep end users protected even despite potential compromise of services like ToDesktop? (eg: companies still hosting some kind of integrity checking service themselves and the download is verified against that… likely there’s smarter ideas) The user experience of auto-update is great, but having a single fatal link in the chain seems worryin…

The first step I'd recommend is to not use Electron when building a native app.

Re: How to gain code execution on hundreds of millions of people and popular apps

#219

Post by maxlin »

Oof. I already have enough stress of my own autoupdating, single-file remote access tool I run on all of my computers, given at a small part of the custom OTA mechanics' security is by obscurity. Would make sleeping hard owning something as popular as this.

Re: How to gain code execution on hundreds of millions of people and popular apps

#220

Post by [deleted] »

felixrieseberg wrote: post #31

As an Electron maintainer, I'll re-iterate a warning I've told many people before: Your auto-updater and the underlying code-signing and notarization mechanisms are sacred . The recovery mechanisms for the entire system are extremely painful and often require embarrassing emails to customers. A compromised code-sign certificate is close to the top of my personal nightmares. Dave and toDesktop have build a product tha…

[deleted]
Post reply on HN