Chrome/Edge PDF viewers are pretty secure. You can reasonably safely open anything in them. Desktop PDF viewers like acrobat are gaping security holes... Don't use them!
What about the Preview app on MacOS?
A fake job offer took down Axie Infinity
301–310 of 364 posts
Re: A fake job offer took down Axie Infinity
#302Curious if anyone has been able to find technical details of how this attack works/worked. I'm under the impression most PDF viewers would prevent this sort of attack (e.g. opening a PDF in your browser should sandbox it to the browsing context), but really keen to know what PDF viewer / OS was used by the dev.
Likely this was a standalone PDF reader hack (rather than a browser), since those can have many more features and a much larger attack surface. It says it was an offer letter, so my guess is that opening it in the browser came up with an error like "to be able to digitally sign this offer letter, please open it in a desktop PDF reader with full scripting support enabled :)"
Luckily I am not getting a lot of unsolicited job offer letters via LinkedIn.
Re: A fake job offer took down Axie Infinity
#303If you care about security, two things you don't want to install on your computer are Adobe Acrobat and Microsoft Office. These products were written the 1990s in C/C++ and are impossible to secure. Microsoft does not allow installing Office on Secure Admin Workstations (SAW) [1] for a reason! [1] https://www.microsoft.com/en-us/insidetrack/protecting-high-...
For “security” reasons, many sites force downloads of pdfs instead of letting browsers read them, so people get into the habit of using their system viewer.
Re: A fake job offer took down Axie Infinity
#304Earlier quoted context omitted.
I see, much like Unicode exploits. I use Chrome to view PDFs which I assume to be safe.
Chrome's PDF viewer seems to be implemented in native code. But it probably benefits from the sandboxing that Chrome does. I would say Firefox is the safest here, because its built-in PDF viewer is written in JS, although Firefox's sandboxing is not as strong as Chrome's.
Surprising: https://pdfium.googlesource.com/pdfium/
Re: A fake job offer took down Axie Infinity
#305Earlier quoted context omitted.
When I first got into crypto, a few things were pretty much drilled into my head: - Not your keys, not your coins; always self-custody - Never use the same machine for trading and for work/surfing the web - Store only funds you want to regularly trade with on a hot wallet. Everything else on a cold wallet.
and this is part of why i think cryptocurrencies should have died before large number of people wasted their money on it. for the average user without the time/knowledge/patience to handle cryptos "properly", the choice is between losing money while handling this shit yourself or losing money while trusting someone else to do it right.
The market adapts to make secure access more convenient. The best solution devised so far is hardware wallets, which mostly insulate someone from hacks emanating from their computing device being compromised.
Re: A fake job offer took down Axie Infinity
#306Earlier quoted context omitted.
I lost nothing, but I can empathies with people who are screwed. It’s not that Bitcoin or any alt coin has X paper value right now, it’s nobody can get out without someone else getting stuck holding the bag. The underlying system is predatory because mining isn’t free so it’s a negative sum game where people have already cashed out. I remember being saddened when it was less than 1/1,000th isn’t current value I reali…
Wait a minute. You decided not to invest early, despite expecting it to be massively profitable because you were worried about the morality of allowing less competent people to try the same thing in future? Are you sure that's really the truth and you weren't just too hesitant and now you regret missing out so you've gone all salty?
they said odds were good, but maybe they're not much of a gambler. and sounds like they views cryptocurrencies as being something akin to scammy MLM or Ponzi scheme rather than an investment.
i haven't bought any myself. i just enjoy reading tech and economics stories in general so i've been reading about cryptocurrencies since 2013 or so. but i don't intend to buy any unless one fulfills some need i have better than other solutions. and i certainly don't intend to hold onto any if i can help it.
Re: A fake job offer took down Axie Infinity
#307Earlier quoted context omitted.
I lost nothing, but I can empathies with people who are screwed. It’s not that Bitcoin or any alt coin has X paper value right now, it’s nobody can get out without someone else getting stuck holding the bag. The underlying system is predatory because mining isn’t free so it’s a negative sum game where people have already cashed out. I remember being saddened when it was less than 1/1,000th isn’t current value I reali…
Wait a minute. You decided not to invest early, despite expecting it to be massively profitable because you were worried about the morality of allowing less competent people to try the same thing in future? Are you sure that's really the truth and you weren't just too hesitant and now you regret missing out so you've gone all salty?
Almost, I wasn't worried about people trying to time the market. I was worried for the suckers who actually believed the hype.
Look morality is only meaningful when it comes at a cost. I sincerely hope you are discouraged from scamming, robbing, kidnapping etc because you think it’s wrong rather than insufficient gain to be worth the effort.
Re: A fake job offer took down Axie Infinity
#308Is there a quick command line or GUI tool that strips a PDF of everything except text/formatting?
In other words, can I run `pdf-make-safe` on a file before opening it to make sure it can't execute arbitrary code the moment I do?
I found this:
https://github.com/freedomofpress/dangerzone
Is it any good?
Re: A fake job offer took down Axie Infinity
#309> Validators fulfill various functions in blockchains, including the creation of transaction blocks and the updating of data oracles. Ronin uses a so-called “proof of authority” system for signing transactions, concentrating power in the hands of nine trusted actors. This paragraph perfectly encapsulates everything wrong with the way promoters sell Ethereum. Smart contracts can do little of interest beyond straight m…
Oracles that connect to off-chain data are usually understood as points of centralization, I don’t think Ethereum or it’s developers are selling otherwise. Most Ethereum developers are advising against relying on bridges across security zones that would be upheld by multisigs and oracles, they are vulnerable to attacks. A better model than a bridge to sidechain would be a rollup - posting proofs on chain without givi…
[deleted]
Re: A fake job offer took down Axie Infinity
#310Earlier quoted context omitted.
Oracles that connect to off-chain data are usually understood as points of centralization, I don’t think Ethereum or it’s developers are selling otherwise. Most Ethereum developers are advising against relying on bridges across security zones that would be upheld by multisigs and oracles, they are vulnerable to attacks. A better model than a bridge to sidechain would be a rollup - posting proofs on chain without givi…
A better model than a bridge to sidechain would be a rollup - posting proofs on chain without giving the sequencer the ability to steal or control user funds. What's a "proof" of an event in the outside world? No such thing exists. The OP's point that dependence on real world events is a security flaw remains. No alternative programming method can change this because nothing on the Internet can guarantee a real event…
How do you know that a real world event happened if you didn't perceive it with your own senses?
One of the long term goals of blockchains interfacing with the "real world" is to build oracle marketplaces that compete to provide "proof of true events". You can essentially build a reputation by selling valid data. The same way different news outlets and journalists compete for providing the "proof" for events.