How to gain code execution on hundreds of millions of people and popular apps • Hacker News Board

Re: How to gain code execution on hundreds of millions of people and popular apps

#271

Post by TZubiri » Sat, Mar 01, 2025, 9:45 PM UTC

no_wizard wrote: post #262

valenterry wrote: post #136

Earlier quoted context omitted.

But that doesn't make it easy to integrate a new script from an author who doesn't provide the hash already.

Vendor your dependencies. It’s better for you as a maintainer anyway, since caching only works[0] with first party domains with any reliability. And once you vendor your dependencies you can calculate the hash yourself [0]: there are caveats to this

How would third party distribution like a cdn affect hashing?

I think https and integrity hashes address two very orthogonal attack vectors.

Re: How to gain code execution on hundreds of millions of people and popular apps

#272

Post by TZubiri » Sat, Mar 01, 2025, 9:47 PM UTC

quacksilver wrote: post #206

bastawhiz wrote: post #89

Earlier quoted context omitted.

1. Yes 2. Because that requires you to know how to find the hash and add it. Truthfully the burden should be on the third party that's serving the script (where did you copy that HTML in the first place?) but they aren't incentivizes to have other sites use a hash.

I wish popular browsers would get together and release an update that says: - After version X we are displaying a prominent popup if a script isn't loaded with a hash - After version Y we blocking scripts loaded without hashes They could solve this problem in a year or so, and if devs are too lazy to specify a hash when loading scripts then their site will break.

I don't think it's just laziness. There's use cases where the libraries are designed to be updated automatically.

Also some of the tracking scripts I don't think are strictly static content, maybe their strategy to fingerprint browser involves sending different shit to different users.

Re: How to gain code execution on hundreds of millions of people and popular apps

#273

Post by sky2224 » Sat, Mar 01, 2025, 9:49 PM UTC

cutemonster wrote: post #241

carcabob wrote: post #80

Earlier quoted context omitted.

Ironically, it actually helped me stay focused on the article. Kind of like a fidget toy. When part of my brain would get bored, I could just move the cat and satisfy that part of my brain while I keep reading. I know that sounds kind of sad that my brain can't focus that well (and it is), but I appreciated the cat.

If one could click the cat to make it dead, that'd work for everyone?

Would having it sleep be a suitable compromise?

Re: How to gain code execution on hundreds of millions of people and popular apps

#274

Post by TZubiri » Sat, Mar 01, 2025, 9:51 PM UTC

mirashii wrote: post #101

slibhb wrote: post #93

Earlier quoted context omitted.

While I think that resigning is stupid here, asserting that "punishment doesn't deter crime" is just absurd. It does!

The overwhelming majority of evidence suggests otherwise. https://www.psychologytoday.com/us/blog/crime-and-punishment... https://www.unsw.edu.au/newsroom/news/2020/07/do-harsher-pun... https://www.ojp.gov/pdffiles1/nij/247350.pdf https://www.helsinki.fi/en/news/economics/do-harsh-punishmen...

When I was younger I used to be much more influentiable, now you just can't change my mind, I made it up for good thank you.

And it pays off in cases like this, I'll be talking with someone about a topic like the seriousness of a vulnerability, they disagree, that's fine no need to convince me, you won't. And then it turns out they're left-leaning abolitionists who are against the idea of jails.

Many such cases, on the other hand I'll be disagreeing with someone on business strategy, and two lines later they reveal that they think taxation is theft. I can rest easy and ignore them.

Re: How to gain code execution on hundreds of millions of people and popular apps

#275

Post by TZubiri » Sat, Mar 01, 2025, 9:53 PM UTC

AdieuToLogic wrote: post #100

slibhb wrote: post #93

Earlier quoted context omitted.

While I think that resigning is stupid here, asserting that "punishment doesn't deter crime" is just absurd. It does!

> While I think that resigning is stupid here, asserting that "punishment doesn't deter crime" is just absurd. It does! Punishment does not deter crime. The threat of punishment does to a degree. IOW, most people will be unaware of a person being sent to prison for years until and unless they have committed a similar offense. But everyone is aware of repercussions possible should they violate known criminal laws.

My grandmother used to say that arguing about an idea is the ultimate concession.

If the topic becomes questioning century old traditions like jails, taxes, or war, like we're about to revolutionaze humankind, I'm out.

Re: How to gain code execution on hundreds of millions of people and popular apps

#276

Post by TZubiri » Sat, Mar 01, 2025, 9:59 PM UTC

phantomathkg wrote: post #108

TZubiri wrote: post #85

Earlier quoted context omitted.

I don't think the lesson is lost. The opposite. If you get a slap on the wrist, do you learn? No, you play it down. However if a dev who gets caught doing a bad is forced to resign. Then all the rest of the devs doing the same thing will shape up.

Can you back up your theory with the example of all the mistakes you have committed and force resigned taken?

I won't publicly list them. But yes, I can recount them mentally and I can confirm I learned from them.

Re: How to gain code execution on hundreds of millions of people and popular apps

#277

Post by TZubiri » Sat, Mar 01, 2025, 10:07 PM UTC

sky2224 wrote: post #114

TZubiri wrote: post #85

Earlier quoted context omitted.

I don't think the lesson is lost. The opposite. If you get a slap on the wrist, do you learn? No, you play it down. However if a dev who gets caught doing a bad is forced to resign. Then all the rest of the devs doing the same thing will shape up.

> If you get a slap on the wrist, do you learn? No, you play it down. Except Dave didn't play it down. He's literally taking responsibility for a situation that could have resulted in significantly worse consequences. Instead of saying, "nothing bad happened, let's move on," he, and by extension his company, have worked to remedy the issue, do a write up on it, disclose of the issue and its impact to users, and publi…

> "we've fundamentally restructured our security practices to ensure this scenario can't recur."

"Yeah it was a problem but it's fixed now, won't happen again"

Sure buddy.

It's not something you fix, when stuff like this happen, it's foundational, you can't fix it, it's a house of cards, you gotta bring it down and build it again with lessons learned.

It's like a skyscraper built with hay that had a close call with some strong northern winds, and they come out and say, we have fortified the northern wall, all is good now. You gotta take it down and build it with brick my man.

I'm done warning people about security, we'll fight it out in the industry, I hope we bankrupt you.

Re: How to gain code execution on hundreds of millions of people and popular apps

#278

Post by edm0nd » Sat, Mar 01, 2025, 10:23 PM UTC

eviks wrote: post #106

edm0nd wrote: post #14

Earlier quoted context omitted.

how much of a bounty was paid to Eva for this finding?

> for those wondering, in total i got 5k for this vuln

thanks for the update. that wasnt stated when the blog post first dropped.

Re: How to gain code execution on hundreds of millions of people and popular apps

#279

Post by TZubiri » Sat, Mar 01, 2025, 10:27 PM UTC

otterley wrote: post #88

TZubiri wrote: post #85

Earlier quoted context omitted.

I don't think the lesson is lost. The opposite. If you get a slap on the wrist, do you learn? No, you play it down. However if a dev who gets caught doing a bad is forced to resign. Then all the rest of the devs doing the same thing will shape up.

Under what theory of psychology are you operating? This is along the same lines as the theory that punishment is an effective deterrent of crime, which we know isn’t true from experience.

"jails don't work and we shouldn't have jails"

Got it

Re: How to gain code execution on hundreds of millions of people and popular apps

#280

Post by otterley » Sat, Mar 01, 2025, 10:34 PM UTC

TZubiri wrote: post #279

otterley wrote: post #88

Earlier quoted context omitted.

Under what theory of psychology are you operating? This is along the same lines as the theory that punishment is an effective deterrent of crime, which we know isn’t true from experience.

"jails don't work and we shouldn't have jails" Got it

I think you’re misunderstanding my point. The reality is more complicated than that.

There are some people who will be discouraged from committing a crime over threat of punishment. But many will not. Many people behave well because they’re just moral people, and others won’t because they’re just selfish and antisocial. Still others commit crimes out of desperation despite the risks. If the threat of imprisonment were effective, there would be no crime, because we already have prisons and penalties of punishment. But since we do have crime, it logically follows that it’s not effective.

The other point here is that threat of punishment is not particularly effective as a management strategy in the private sector. It doesn’t incentivize behavior in the manner you might believe. Mostly it makes your reports dislike you and it makes them less productive. It’s a thing you learn pretty quickly as a manager.

There’s a model of a person being a rational thinker, but in reality, people aren’t always rational. (Hell, adolescents are biologically programmed not to be rational and to stress test the limits of nature and society.) You find success in making less-than-rational people work together in harmony and achieve positive outcomes.