Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to gain code execution on hundreds of millions of people and popular apps

kibty.town

Post reply on HN
Print view View original

301–310 of 350 posts

Re: How to gain code execution on hundreds of millions of people and popular apps

#301

Post by ImPostingOnHN »

remram wrote: post #243
TZubiri wrote: post #87

Earlier quoted context omitted.

Well for one it was a gift so there is no valid contract right? There are no direct damages because there is nothing paid and nothing to refund. Wrt indirect damages, there's bound to be a disclaimer or two, at least at the app layer. IANAL, not legal advice

If you give someone a bomb, or give someone a USB stick with a virus, or give someone a car with defective break, you are absolutely liable. Think about it.

If you give someone a USB stick with a virus, and you don't know about the virus, you aren't liable. Unless maybe you gave them some sort of warranty or guarantee that it was virus-free.

The lesson: don't use USB sticks people give you, unless you have your own way of verifying that they're virus-free.

Also, don't give people bombs. That's usually illegal, unlike giving someone software with unknown bugs in it.

Re: How to gain code execution on hundreds of millions of people and popular apps

#302

Post by ImPostingOnHN »

Eisenstein wrote: post #265
cdmyrm wrote: post #164

Earlier quoted context omitted.

Any purported expert who uses software without considering its security is simply negligent. I'm not sure why people are trying to spin this to avoid placing the blame on the negligent programmer(s).

And if it is the programmer's fault, what can we do about it? People are trying to avoid finding a solution that isn't throwing their hands up in the air. We either need to solve the problem in a place that is effective with the situation as it is (the tools) or we need to solve the situation such that it has consequences for doing the wrong thing on the part of the developer. Which shall it be?

Since those are only 2 options, and there are many more options, I'll pick option 3: convince people to value and fund universal education more from preschool on, building a better foundation for engineers and other professions in the decades following.

In addition to that, it'd be cool if the blameless postmortems were made public, so everyone could learn from them.

As for the other 2 options of restricting freedom, and extremely blameful postmortems, I reject both.

Re: How to gain code execution on hundreds of millions of people and popular apps

#303

Post by ImPostingOnHN »

Eisenstein wrote: post #292
999900000999 wrote: post #290

Earlier quoted context omitted.

Your solution is to regulate software instead of calling out bad actors? What a dystopian future, curl without a permit? Why are you blaming the rank and file employees. The buck stops with the employer. If anything fine the companies

Asking people to be responsible for the damage they cause is called 'accountability' and not 'dystopia'. Software is not just something someone uses for hobbies or for word processing or whatever. A bad design decision in some critical software can have just as much of an impact as a bad design decision in a bridge or an airplane. If we want to be called 'engineers' then we need to put more on the line than just a pu…

> A bad design decision in some critical software can have just as much of an impact as a bad design decision in a bridge or an airplane.

This is a better point than you realize. Blameless postmortems in IT are largely inspired by blameless postmortems from aerospace failures.

Re: How to gain code execution on hundreds of millions of people and popular apps

#304

Post by Thorrez »

LtWorf wrote: post #287
Thorrez wrote: post #230

Earlier quoted context omitted.

Are you saying Chrome should block all script includes that don't have hashes? That'll break tons of sites. See "Don't break the web"[1]. Disclosure: I work at Google, but not on Chrome. [1] https://flbrack.com/posts/2023-02-15-dont-break-the-web/

Also expired certificates break a lot of websites… should we disable checking?

Those websites set up the expiring certificate themselves.

Re: How to gain code execution on hundreds of millions of people and popular apps

#305

Post by Eisenstein »

ImPostingOnHN wrote: post #303
Eisenstein wrote: post #292

Earlier quoted context omitted.

Asking people to be responsible for the damage they cause is called 'accountability' and not 'dystopia'. Software is not just something someone uses for hobbies or for word processing or whatever. A bad design decision in some critical software can have just as much of an impact as a bad design decision in a bridge or an airplane. If we want to be called 'engineers' then we need to put more on the line than just a pu…

> A bad design decision in some critical software can have just as much of an impact as a bad design decision in a bridge or an airplane. This is a better point than you realize. Blameless postmortems in IT are largely inspired by blameless postmortems from aerospace failures.

If aerospace gets away with it then we should fix that as well.

Re: How to gain code execution on hundreds of millions of people and popular apps

#306

Post by hyperdimension »

ameliaquining wrote: post #296
LtWorf wrote: post #287

Earlier quoted context omitted.

Also expired certificates break a lot of websites… should we disable checking?

Certificate expiration isn't an unanticipated regression. You know when you get a certificate when it will expire.

I don't mean to be pedantic, but not always--see the recent DigiCert delayed revocation issues. I will admit it is rare though and more often than not, you (should) know when your certs are going to expire.

Re: How to gain code execution on hundreds of millions of people and popular apps

#307

Post by ImPostingOnHN »

Eisenstein wrote: post #305
ImPostingOnHN wrote: post #303

Earlier quoted context omitted.

> A bad design decision in some critical software can have just as much of an impact as a bad design decision in a bridge or an airplane. This is a better point than you realize. Blameless postmortems in IT are largely inspired by blameless postmortems from aerospace failures.

If aerospace gets away with it then we should fix that as well.

On the contrary: blameless postmortems are better.

Re: How to gain code execution on hundreds of millions of people and popular apps

#308

Post by 999900000999 »

Eisenstein wrote: post #297
999900000999 wrote: post #295

Earlier quoted context omitted.

>But if the 'grunts' had the power to say 'no, I will not do this because it is insecure and my license is on the line' then that's a good thing. No? This will never work in a global economy. If you outsource the software you're just begging companies to find someone making 15$ the fall guy. Sounds pretty bad. Your manager tells you to do something stupid or your fired. You do so, and when it fails they blame you and…

How do engineers manage it then? What about banks? Any regulated industry? It obviously works for some professions, why is software the exception?

Why do you want to regulate software?

Arguably this whole thing wouldn't happen if these apps were distributed and updated via the OSX app store. If that's the future you want, it's largely already here.

You can check a setting in OSX to make it so.

Who decides what software to regulate. Do I need a permit to install Python ?

Re: How to gain code execution on hundreds of millions of people and popular apps

#309

Post by 0xCMP »

TZubiri wrote: post #291
0xCMP wrote: post #289

Earlier quoted context omitted.

Because if you're not getting the real benefit (improved response times due to caching) you can stop worrying about hashing it properly or not and simply serve a copy you know to be good (or at least known and probably version controlled). Now you don't need to hash or know which hash is correct or worry about the user getting served the wrong file because someone else got hacked.

Not sure I follow, how does hashing mean you lose improved response times or caching? Do you mean that hashing the file takes time? I guess that can be significant, but it's probably 2 or 3 cycles per byte, and average js size is like 10kb tops? 30khz doesn't look like much, it's a millionth of a second.

No, the hashing either when generating or checking is very fast like you said. Hashing itself isn't the culprit, but the battle between browsers and those fingerprinting users.

Originally the point of using a shared CDN like this was that if others used it too the file would already be cached on the user's computer and make it even faster. But, this feature was used for fingerprinting users by checking which files from other websites were cached and browsers have isolated the caches in response which makes it impossible to get the speed benefits from before.

So if you're not getting that speed benefit, and only really getting a tiny bandwidth reduction, the risks of serving the file from a 3rd party (which could be mitigated by the hashes) aren't worth it compared to simply vendoring the file and serving it yourself.

So it's not that hashing prevents caching or lowers response times, but that the risk it is mitigating isn't worth the effort. Just 'err on serving the file yourself.

Re: How to gain code execution on hundreds of millions of people and popular apps

#310

Post by Eisenstein »

ImPostingOnHN wrote: post #302
Eisenstein wrote: post #265

Earlier quoted context omitted.

And if it is the programmer's fault, what can we do about it? People are trying to avoid finding a solution that isn't throwing their hands up in the air. We either need to solve the problem in a place that is effective with the situation as it is (the tools) or we need to solve the situation such that it has consequences for doing the wrong thing on the part of the developer. Which shall it be?

Since those are only 2 options, and there are many more options, I'll pick option 3: convince people to value and fund universal education more from preschool on, building a better foundation for engineers and other professions in the decades following. In addition to that, it'd be cool if the blameless postmortems were made public, so everyone could learn from them. As for the other 2 options of restricting freedom,…

Yes, being held accountable for your decisions is a restriction on your freedom.
Post reply on HN