Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to gain code execution on hundreds of millions of people and popular apps

kibty.town

Post reply on HN
Print view View original

281–290 of 350 posts

Re: How to gain code execution on hundreds of millions of people and popular apps

#281

Post by otterley »

TZubiri wrote: post #274
mirashii wrote: post #101

Earlier quoted context omitted.

The overwhelming majority of evidence suggests otherwise. https://www.psychologytoday.com/us/blog/crime-and-punishment... https://www.unsw.edu.au/newsroom/news/2020/07/do-harsher-pun... https://www.ojp.gov/pdffiles1/nij/247350.pdf https://www.helsinki.fi/en/news/economics/do-harsh-punishmen...

When I was younger I used to be much more influentiable, now you just can't change my mind, I made it up for good thank you. And it pays off in cases like this, I'll be talking with someone about a topic like the seriousness of a vulnerability, they disagree, that's fine no need to convince me, you won't. And then it turns out they're left-leaning abolitionists who are against the idea of jails. Many such cases, on t…

> now you just can't change my mind, I made it up for good thank you

Respectfully, that’s not a very “hacker” way of seeing the world. Hackers learn from their mistakes and adapt. (Just like this software company is doing.)

Re: How to gain code execution on hundreds of millions of people and popular apps

#284

Post by FitCodIa »

TZubiri wrote: post #75

I can't post things like "what a bunch of clowns" due to hacker news guidelines so let me go by another more productive route. These people, the ones who install dependencies (that install dependencies)+, these people who write apps with AI, who in the previous season looped between executing their code and searching the error on stackoverflow. Whether they work for a company or have their own startup, the moment tha…

> Give those of us who do 10 times less, but do it right, some kind of marketing advantages, it shouldn't be legal that they are competing with us.

"Quality over quantity" should be the way, but I think it has failed in every single sector. Food. Healthcare. Education. Manufacturing. Construction. ...

Quality is expensive.

Re: How to gain code execution on hundreds of millions of people and popular apps

#285

Post by MuteXR »

cdmyrm wrote: post #160
morgante wrote: post #67

Earlier quoted context omitted.

They don’t elaborate on the logging details, but certainly must good systems don’t allow log tampering even for admins.

How confident are you that their log system is resilient, given the state of the rest of their software?

Following that logic it would be literally impossible to trust any part of their infra. They had a bad build container, the rest of their stuff was solid.

Re: How to gain code execution on hundreds of millions of people and popular apps

#286

Post by LtWorf »

SideQuark wrote: post #167
LtWorf wrote: post #141

Earlier quoted context omitted.

Getting tracked is less secure than not getting tracked.

Getting hacked is less secure than getting tracked.

Very clever. But getting tracked doesn't in any way protect you from getting hacked. It just exposes you to more risks, including getting hacked.

Re: How to gain code execution on hundreds of millions of people and popular apps

#287

Post by LtWorf »

Thorrez wrote: post #230
LtWorf wrote: post #135

Earlier quoted context omitted.

It should just not be done at all. But the main browser vendor loves tracking so they won't forbid this.

Are you saying Chrome should block all script includes that don't have hashes? That'll break tons of sites. See "Don't break the web"[1]. Disclosure: I work at Google, but not on Chrome. [1] https://flbrack.com/posts/2023-02-15-dont-break-the-web/

Also expired certificates break a lot of websites… should we disable checking?

Re: How to gain code execution on hundreds of millions of people and popular apps

#288

Post by xandrius »

HeatrayEnjoyer wrote: post #235
xandrius wrote: post #231

Earlier quoted context omitted.

I see a good excuse right there: the few thousand bucks. I'd rather one the most reliable and cheap hardware security model we know of: paper. Print a bunch of QR/datamatrix codes with your key. Keep one in a fireproof safe in your house, and another one elsewhere. Total cost: ~$0.1 (+ the multipurpose safe, if needed)

Printers often have hard drives with cached pages

Put the printer in the safe with the paper?

Re: How to gain code execution on hundreds of millions of people and popular apps

#289

Post by 0xCMP »

TZubiri wrote: post #271
no_wizard wrote: post #262

Earlier quoted context omitted.

Vendor your dependencies. It’s better for you as a maintainer anyway, since caching only works[0] with first party domains with any reliability. And once you vendor your dependencies you can calculate the hash yourself [0]: there are caveats to this

How would third party distribution like a cdn affect hashing? I think https and integrity hashes address two very orthogonal attack vectors.

Because if you're not getting the real benefit (improved response times due to caching) you can stop worrying about hashing it properly or not and simply serve a copy you know to be good (or at least known and probably version controlled). Now you don't need to hash or know which hash is correct or worry about the user getting served the wrong file because someone else got hacked.

Re: How to gain code execution on hundreds of millions of people and popular apps

#290

Post by 999900000999 »

Eisenstein wrote: post #264
999900000999 wrote: post #256

Earlier quoted context omitted.

150k is more than a fire fighter in San Francisco. https://sf-fire.org/employment-opportunities/h2-firefighter I don't think it's out of the question to expect professionalism at 150k. These are VC funded companies, not a couple of college kids scraping together a prototype. Then again, if I was a CTO seeing stories like this I'd be inclined to NOT use Firebase. I'm actually using Supabase right now since I don't lik…

> I don't think it's out of the question to expect professionalism at 150k. These are VC funded companies, not a couple of college kids scraping together a prototype. You can expect whatever you want, just prepare to be disappointed. We have absolutely learned by now that unless there very real consequences for doing or not doing something, you will regularly see the worst possible thing happen. This is why licenses…

Your solution is to regulate software instead of calling out bad actors?

What a dystopian future, curl without a permit?

Why are you blaming the rank and file employees. The buck stops with the employer. If anything fine the companies

Post reply on HN