Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to gain code execution on hundreds of millions of people and popular apps

kibty.town

Post reply on HN
Print view View original

291–300 of 350 posts

Re: How to gain code execution on hundreds of millions of people and popular apps

#291

Post by TZubiri »

0xCMP wrote: post #289
TZubiri wrote: post #271

Earlier quoted context omitted.

How would third party distribution like a cdn affect hashing? I think https and integrity hashes address two very orthogonal attack vectors.

Because if you're not getting the real benefit (improved response times due to caching) you can stop worrying about hashing it properly or not and simply serve a copy you know to be good (or at least known and probably version controlled). Now you don't need to hash or know which hash is correct or worry about the user getting served the wrong file because someone else got hacked.

Not sure I follow, how does hashing mean you lose improved response times or caching?

Do you mean that hashing the file takes time? I guess that can be significant, but it's probably 2 or 3 cycles per byte, and average js size is like 10kb tops? 30khz doesn't look like much, it's a millionth of a second.

Re: How to gain code execution on hundreds of millions of people and popular apps

#292

Post by Eisenstein »

999900000999 wrote: post #290
Eisenstein wrote: post #264

Earlier quoted context omitted.

> I don't think it's out of the question to expect professionalism at 150k. These are VC funded companies, not a couple of college kids scraping together a prototype. You can expect whatever you want, just prepare to be disappointed. We have absolutely learned by now that unless there very real consequences for doing or not doing something, you will regularly see the worst possible thing happen. This is why licenses…

Your solution is to regulate software instead of calling out bad actors? What a dystopian future, curl without a permit? Why are you blaming the rank and file employees. The buck stops with the employer. If anything fine the companies

Asking people to be responsible for the damage they cause is called 'accountability' and not 'dystopia'.

Software is not just something someone uses for hobbies or for word processing or whatever. A bad design decision in some critical software can have just as much of an impact as a bad design decision in a bridge or an airplane. If we want to be called 'engineers' then we need to put more on the line than just a public apology when something goes wrong due to a decision someone actively made to save money or reduce the work involved. And of course it should involve the people who make those decisions and not just the grunt who implemented them.

But if the 'grunts' had the power to say 'no, I will not do this because it is insecure and my license is on the line' then that's a good thing. No?

Re: How to gain code execution on hundreds of millions of people and popular apps

#293

Post by no_wizard »

TZubiri wrote: post #271
no_wizard wrote: post #262

Earlier quoted context omitted.

Vendor your dependencies. It’s better for you as a maintainer anyway, since caching only works[0] with first party domains with any reliability. And once you vendor your dependencies you can calculate the hash yourself [0]: there are caveats to this

How would third party distribution like a cdn affect hashing? I think https and integrity hashes address two very orthogonal attack vectors.

It’s about control foremost. If you vendor your dependencies you know what you’re serving and can calculate the hash and use it in your CSP, and provides more stability for versioning.

Plus, as mentioned, only 1st party origins enjoy any benefits of caching content for faster load times so you get an additional benefit

Re: How to gain code execution on hundreds of millions of people and popular apps

#294

Post by UltraSane »

davej wrote: post #3

Dave here, founder of ToDesktop. I've shared a write-up: https://www.todesktop.com/blog/posts/security-incident-at-to... This vulnerability was genuinely embarrassing, and I'm sorry we let it happen. After thorough internal and third-party audits, we've fundamentally restructured our security practices to ensure this scenario can't recur. Full details are covered in the linked write-up. Special thanks to Eva for resp…

Critical private keys must be stored on HSMs or they will be compromised.

Re: How to gain code execution on hundreds of millions of people and popular apps

#295

Post by 999900000999 »

Eisenstein wrote: post #292
999900000999 wrote: post #290

Earlier quoted context omitted.

Your solution is to regulate software instead of calling out bad actors? What a dystopian future, curl without a permit? Why are you blaming the rank and file employees. The buck stops with the employer. If anything fine the companies

Asking people to be responsible for the damage they cause is called 'accountability' and not 'dystopia'. Software is not just something someone uses for hobbies or for word processing or whatever. A bad design decision in some critical software can have just as much of an impact as a bad design decision in a bridge or an airplane. If we want to be called 'engineers' then we need to put more on the line than just a pu…

>But if the 'grunts' had the power to say 'no, I will not do this because it is insecure and my license is on the line' then that's a good thing. No?

This will never work in a global economy. If you outsource the software you're just begging companies to find someone making 15$ the fall guy.

Sounds pretty bad. Your manager tells you to do something stupid or your fired. You do so, and when it fails they blame you and your software engineering license is revoked. You can't find a job and now get to live in a homeless shelter.

Meaningful fines for companies is the only way to fix this.

Maybe... For some sensitive things like location data an expensive permit should be required. But this needs to be a corporate responsibility, not an individual one.

In your scenario bad companies are going to ruin the lives of their employees by making them risk their licenses.

Re: How to gain code execution on hundreds of millions of people and popular apps

#296

Post by ameliaquining »

LtWorf wrote: post #287
Thorrez wrote: post #230

Earlier quoted context omitted.

Are you saying Chrome should block all script includes that don't have hashes? That'll break tons of sites. See "Don't break the web"[1]. Disclosure: I work at Google, but not on Chrome. [1] https://flbrack.com/posts/2023-02-15-dont-break-the-web/

Also expired certificates break a lot of websites… should we disable checking?

Certificate expiration isn't an unanticipated regression. You know when you get a certificate when it will expire.

Re: How to gain code execution on hundreds of millions of people and popular apps

#297

Post by Eisenstein »

999900000999 wrote: post #295
Eisenstein wrote: post #292

Earlier quoted context omitted.

Asking people to be responsible for the damage they cause is called 'accountability' and not 'dystopia'. Software is not just something someone uses for hobbies or for word processing or whatever. A bad design decision in some critical software can have just as much of an impact as a bad design decision in a bridge or an airplane. If we want to be called 'engineers' then we need to put more on the line than just a pu…

>But if the 'grunts' had the power to say 'no, I will not do this because it is insecure and my license is on the line' then that's a good thing. No? This will never work in a global economy. If you outsource the software you're just begging companies to find someone making 15$ the fall guy. Sounds pretty bad. Your manager tells you to do something stupid or your fired. You do so, and when it fails they blame you and…

How do engineers manage it then? What about banks? Any regulated industry? It obviously works for some professions, why is software the exception?

Re: How to gain code execution on hundreds of millions of people and popular apps

#298

Post by ameliaquining »

withinboredom wrote: post #224
IshKebab wrote: post #189

Earlier quoted context omitted.

Erm yes! Even the White House has said that. The only reason we didn't for so long was because we didn't have a viable alternative. Now we do, we should absolutely stop writing C.

The white house recently said a lot of things. But of all things, I don’t think they’re even qualified to have an opinion about software, or medical advice, or… well, anything that generally requires an expert.

This is referring to a report issued in 2024, under the previous administration. It has nothing to do with anything currently in the news.

Re: How to gain code execution on hundreds of millions of people and popular apps

#299

Post by valenterry »

TZubiri wrote: post #270
valenterry wrote: post #136

Earlier quoted context omitted.

But that doesn't make it easy to integrate a new script from an author who doesn't provide the hash already.

But you can .. get the hash yourself? wget url; sha256 file

Of course you can. But when it comes to security, one thing is very important in practice: making the secure way of doing things as easy as possible.

So, why did you not actually post the correct shell script? Apparently that would have been more effort to get right and ensure is correct right? And also work for every OS. And there you have it: if someone first has to figure out which script to run, some percentage will give up here. And that's my point: the browser should make it as easy as possible to avoid that from happening.

Re: How to gain code execution on hundreds of millions of people and popular apps

#300

Post by rs186 »

RadiozRadioz wrote: post #132
felixrieseberg wrote: post #31

As an Electron maintainer, I'll re-iterate a warning I've told many people before: Your auto-updater and the underlying code-signing and notarization mechanisms are sacred . The recovery mechanisms for the entire system are extremely painful and often require embarrassing emails to customers. A compromised code-sign certificate is close to the top of my personal nightmares. Dave and toDesktop have build a product tha…

How about we don't build an auto-updater? Maybe some apps require an extremely tight coupling with a server, but we should try our best to release complete software to users that will work as close to forever as possible. Touching files on a user's system should be treated as a rare special occurrence. If a server is involved with the app, build a stable interface and think long and hard about every change. Meticulou…

> How about we don't build an auto-updater?

Auto-updaters are the most practical and efficient way of pushing updates in today's world. As pointed out by others, the alternative would be to go through app store's update mechanism, if the app is distributed via app store in the first place, and many people avoid Microsoft store/MacOS app store whenever possible. And no developer likes that process.

Post reply on HN