Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to gain code execution on hundreds of millions of people and popular apps

kibty.town

Post reply on HN
Print view View original

241–250 of 350 posts

Re: How to gain code execution on hundreds of millions of people and popular apps

#241

Post by cutemonster »

carcabob wrote: post #80
gblargg wrote: post #69

Earlier quoted context omitted.

I had to go back and enable JavaScript. Wow, is the goal to direct my attention away from reading the text?

Ironically, it actually helped me stay focused on the article. Kind of like a fidget toy. When part of my brain would get bored, I could just move the cat and satisfy that part of my brain while I keep reading. I know that sounds kind of sad that my brain can't focus that well (and it is), but I appreciated the cat.

If one could click the cat to make it dead, that'd work for everyone?

Re: How to gain code execution on hundreds of millions of people and popular apps

#242

Post by GavinMcG »

beardedwizard wrote: post #125
abhiaagarwal wrote: post #22

Earlier quoted context omitted.

Based on the claims on the blog, it feels reasonable to say that this "cannot" occur again.

Based on which claim? That 12 months from now they might accidentally discover a new bug just as serious?

If you think someone is obviously wrong, it might be worth pausing for a second and considering where you might just be referring to different things. Here, you seem to understand “this” to mean “a serious bug.” Since it’s obvious that a serious bug could happen, it seems likely that the author meant “this” to mean “the kind of bug that led to the breach we’re presently discussing.”

Re: How to gain code execution on hundreds of millions of people and popular apps

#243

Post by remram »

TZubiri wrote: post #87
remram wrote: post #78

Earlier quoted context omitted.

This is not how the law works anywhere, thankfully.

Well for one it was a gift so there is no valid contract right? There are no direct damages because there is nothing paid and nothing to refund. Wrt indirect damages, there's bound to be a disclaimer or two, at least at the app layer. IANAL, not legal advice

If you give someone a bomb, or give someone a USB stick with a virus, or give someone a car with defective break, you are absolutely liable. Think about it.

Re: How to gain code execution on hundreds of millions of people and popular apps

#245

Post by graynk »

noisy_boy wrote: post #57

Question/idea: can't GitHub use LLMs to periodically scan the code for vulnerabilities like this and inform the repo owner? They can even charge for it ;)

You mean like this, but worse?

https://docs.github.com/en/code-security/code-scanning/intro...

Re: How to gain code execution on hundreds of millions of people and popular apps

#246

Post by turtlebits »

IshKebab wrote: post #237
withinboredom wrote: post #223

Earlier quoted context omitted.

I’ve seen devs deploy production software with the admin password being “password”. I don’t think you are listening when they are saying “they’ll build a better idiot”.

Right because nobody ever makes a mistake. That's why we don't have seatbelts of safety harnesses or helmets or RCDs. There's always going to be an idiot that drives without a seatbelt so why bother at all right?

When you drive without a seatbelt, it only affects you.

If you drive in a way that affects the safety of others, there are generally consequences.

Re: How to gain code execution on hundreds of millions of people and popular apps

#247

Post by turtlebits »

pixl97 wrote: post #97
ok_dad wrote: post #61

Earlier quoted context omitted.

Sounds like a problem with modern software build practices to me.

Ya too many people think it's a great idea to raw dog your ci/cd on the net and later get newspaper articles written about the data leak. The number of packages that is malicious is high enough, then you have typo packages, and packages that get compromised at a later date. Being isolated from the net with proper monitoring gives a huge heads up when your build system suddenly tries to contact some random site/IP.

People don't think it's a great idea. In general, its just too much additional work/process - for very little benefit.

You're far more likely to encounter a security issue from adding/upgrading a dependency than your build process requiring internet access.

Re: How to gain code execution on hundreds of millions of people and popular apps

#248

Post by gschier »

itsFolf wrote: post #45
felixrieseberg wrote: post #40

Earlier quoted context omitted.

Azure Trusted Signing is one of the best things Microsoft has done for app developers last year, I'm really happy with it. It's $9.99/month and open both to companies and individuals who can verify their identity (it used to only be companies). You really just call signtool.exe with a custom dll. I wrote @electron/windows-sign specifically to cover it: https://github.com/electron/windows-sign Reference implementation…

The big limitation with Azure Trusted Signing is that your organization needs to be at least 3 years old. Seems to be a weird case where developers that could benefit from this solution are pushed towards doing something else, with no big reason to switch back later.

This is not true. Or maybe it is but they missed me? I signed up with a brand new company without issue.

Re: How to gain code execution on hundreds of millions of people and popular apps

#249

Post by gschier »

filleokus wrote: post #152
felixrieseberg wrote: post #31

As an Electron maintainer, I'll re-iterate a warning I've told many people before: Your auto-updater and the underlying code-signing and notarization mechanisms are sacred . The recovery mechanisms for the entire system are extremely painful and often require embarrassing emails to customers. A compromised code-sign certificate is close to the top of my personal nightmares. Dave and toDesktop have build a product tha…

> For Windows signing, use Azure Trusted Signing I recently checked it out as an alternative to renewing our signing cert, but it doesn't support issuing EV certs. I've understood it as having an EV code signing cert on Windows is required for drivers, but somehow also gives you better SmartScreen reputation making it useful even for user space apps in enterprisey settings? Not sure if this is FUD spread by the EV CA…

Im not sure if they're technically considered EV but mine is linked to my corporation and I get no virus warnings at all during install.

Re: How to gain code execution on hundreds of millions of people and popular apps

#250

Post by anconam »

floydnoel wrote: post #76
stefan_ wrote: post #33

Earlier quoted context omitted.

Yeah, it is their fault. I don't download "todesktop" (to-exploit), I download Cursor. Don't give 3rd parties push access to all your clients, that's crazy. How can this crappy startup build server sign a build for you? That's insane.

it blows me away that this is even a product. it's like a half day of dev time, and they don’t appear to have over-engineered it or even done basic things given the exploit here.

With all due respect, a compile pipeline across Win, Mac, Linux, for different CPU architectures, making sure signing works for all, and that the Electron auto-updater works as expected is a nightmare. I have been there, and it’s not fun.
Post reply on HN