Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to gain code execution on hundreds of millions of people and popular apps

kibty.town

Post reply on HN
Print view View original

311–320 of 350 posts

Re: How to gain code execution on hundreds of millions of people and popular apps

#311

Post by Eisenstein »

999900000999 wrote: post #308
Eisenstein wrote: post #297

Earlier quoted context omitted.

How do engineers manage it then? What about banks? Any regulated industry? It obviously works for some professions, why is software the exception?

Why do you want to regulate software? Arguably this whole thing wouldn't happen if these apps were distributed and updated via the OSX app store. If that's the future you want, it's largely already here. You can check a setting in OSX to make it so. Who decides what software to regulate. Do I need a permit to install Python ?

> Why do you want to regulate software?

I don't want to regulate software. I want people to have something to lose if they make a decision that has a large impact.

> Arguably this whole thing wouldn't happen if these apps were distributed and updated via the OSX app store. If that's the future you want, it's largely already here.

I don't understand this point.

> Who decides what software to regulate.

Who decides any laws or regulations?

> Do I need a permit to install Python ?

Does you installing Python have potential consequences for large numbers of people or could it cause a significant amount of harm?

Why do you take the most extreme possible position and apply it to me? Is it that difficult to argue against a sensible one?

Re: How to gain code execution on hundreds of millions of people and popular apps

#312

Post by sky2224 »

TZubiri wrote: post #277
sky2224 wrote: post #114

Earlier quoted context omitted.

> If you get a slap on the wrist, do you learn? No, you play it down. Except Dave didn't play it down. He's literally taking responsibility for a situation that could have resulted in significantly worse consequences. Instead of saying, "nothing bad happened, let's move on," he, and by extension his company, have worked to remedy the issue, do a write up on it, disclose of the issue and its impact to users, and publi…

> "we've fundamentally restructured our security practices to ensure this scenario can't recur." "Yeah it was a problem but it's fixed now, won't happen again" Sure buddy. It's not something you fix, when stuff like this happen, it's foundational, you can't fix it, it's a house of cards, you gotta bring it down and build it again with lessons learned. It's like a skyscraper built with hay that had a close call with s…

> It's not something you fix, when stuff like this happen, it's foundational, you can't fix it, it's a house of cards, you gotta bring it down and build it again with lessons learned.

That's the last thing you should ever do within a large scale software system. The idea that restarting from scratch because "oh we'll do it better again" is the kind of thing that bankrupts companies. Plenty of seasoned engineers will tell you this.

https://www.joelonsoftware.com/2000/04/06/things-you-should-...

Re: How to gain code execution on hundreds of millions of people and popular apps

#313

Post by ImPostingOnHN »

Eisenstein wrote: post #310
ImPostingOnHN wrote: post #302

Earlier quoted context omitted.

Since those are only 2 options, and there are many more options, I'll pick option 3: convince people to value and fund universal education more from preschool on, building a better foundation for engineers and other professions in the decades following. In addition to that, it'd be cool if the blameless postmortems were made public, so everyone could learn from them. As for the other 2 options of restricting freedom,…

Yes, being held accountable for your decisions is a restriction on your freedom.

I still choose the third option, because it is the better of the three, compared to restricting what functionality the software people write is allowed to have, and extremely blameful postmortems (which are bad).

Re: How to gain code execution on hundreds of millions of people and popular apps

#314

Post by bastawhiz »

cdmyrm wrote: post #163
bastawhiz wrote: post #90

Earlier quoted context omitted.

> Google isn't to blame if you ship a paid product without running a security audit. Arguably, if you provide a service that makes it trivial to create security issues (that is to say, you have to go out of your way to use it correctly) then it's your fault. If making it secure means making it somewhat less convenient, it's 100% your fault for not making it less convenient.

Should we outlaw C because it lets you dereference null pointers, too?

I've never paid a company for C

Re: How to gain code execution on hundreds of millions of people and popular apps

#315

Post by bastawhiz »

valenterry wrote: post #120
bastawhiz wrote: post #89

Earlier quoted context omitted.

1. Yes 2. Because that requires you to know how to find the hash and add it. Truthfully the burden should be on the third party that's serving the script (where did you copy that HTML in the first place?) but they aren't incentivizes to have other sites use a hash.

Well, to be honest, the browsers could super easily solve that. In dev mode, just issue a warning "loaded script that has hash X but isn't statically defined. This is a huge security risk. Read more here" and that's it. Then you can just add the script, run the site, check the logs and add the hash, done.

> In dev mode, just issue a warning "loaded script that has hash X but isn't statically defined.

How does the browser know which files to warn you about? What about scripts that are generated dynamically and have no static hash? There's plenty of reasons why you wouldn't want this.

Re: How to gain code execution on hundreds of millions of people and popular apps

#316

Post by bastawhiz »

quacksilver wrote: post #206
bastawhiz wrote: post #89

Earlier quoted context omitted.

1. Yes 2. Because that requires you to know how to find the hash and add it. Truthfully the burden should be on the third party that's serving the script (where did you copy that HTML in the first place?) but they aren't incentivizes to have other sites use a hash.

I wish popular browsers would get together and release an update that says: - After version X we are displaying a prominent popup if a script isn't loaded with a hash - After version Y we blocking scripts loaded without hashes They could solve this problem in a year or so, and if devs are too lazy to specify a hash when loading scripts then their site will break.

Literally every website that uses JSONP will stop working if that happened. This would break the web in fundamental ways. If we're going to break the web in fundamental ways, resource integrity is hardly among the things that I'd be interested in changing.

Re: How to gain code execution on hundreds of millions of people and popular apps

#317

Post by theragra »

RadiozRadioz wrote: post #132
felixrieseberg wrote: post #31

As an Electron maintainer, I'll re-iterate a warning I've told many people before: Your auto-updater and the underlying code-signing and notarization mechanisms are sacred . The recovery mechanisms for the entire system are extremely painful and often require embarrassing emails to customers. A compromised code-sign certificate is close to the top of my personal nightmares. Dave and toDesktop have build a product tha…

How about we don't build an auto-updater? Maybe some apps require an extremely tight coupling with a server, but we should try our best to release complete software to users that will work as close to forever as possible. Touching files on a user's system should be treated as a rare special occurrence. If a server is involved with the app, build a stable interface and think long and hard about every change. Meticulou…

For me, Windows is thousand years ahead in this regard. I download software, and run it. And it works 99.9% of the time. Yes, I have a chance of getting a virus. Happened one time in 30 years I'm using Windows. (More in DOS times).

Linux, I got burned again yesterday. Proxmox distribution has no package I need in their repository.

I am trying to use Ubuntu package - does not work.

I try to use debian - too old version.

How do I solve this? By learning some details of how the Linux distributions and repositories work, struggling some more and finding customly built version of .deb. Okay, I can do it, kinda, but what about non-IT person?

Software without dependencies is awesome. So, docker is something I respect a lot, because it allows the same model (kinda).

Re: How to gain code execution on hundreds of millions of people and popular apps

#318

Post by Eisenstein »

ImPostingOnHN wrote: post #313
Eisenstein wrote: post #310

Earlier quoted context omitted.

Yes, being held accountable for your decisions is a restriction on your freedom.

I still choose the third option, because it is the better of the three, compared to restricting what functionality the software people write is allowed to have, and extremely blameful postmortems (which are bad).

All restrictions are bad, and accountability is bad. Got it. I'm glad to have had this discussion with you; very thought provoking.

Re: How to gain code execution on hundreds of millions of people and popular apps

#319

Post by pl4nty »

klabb3 wrote: post #232
RadiozRadioz wrote: post #229

Earlier quoted context omitted.

> file transfers. And I’m supposed to not touch files? I'm pretty sure you know what I meant, it's obvious from context. System program files. The files that are managed by your user's package manager (and by extension their IT department)

There isn’t a package manager in many cases: windows store requires a MS account. macOS app store nerfs apps by sandbox restrictions. Linux has so many flavors of package managers it’s death by 1000 paper cuts. None of the major bundlers like flutter, electron and tauri support all these package managers and/or app stores. Let alone running the infrastructure for it. Which leaves you with self-updaters. I definitely…

> windows store requires a MS account

they avoid mentioning it, but the Microsoft managed package format (MSIX) works just fine without the Microsoft Store. create an App Installer manifest, stick it on a website, and get semver-d differential updates across multiple architectures for free: https://learn.microsoft.com/en-us/windows/msix/app-installer...

msft have woefully underinvested in the ecosystem and docs though. I wish they'd fund me or others to contribute on the OSS side - electron could be far simpler and more secure with batteries-included MSIX

Re: How to gain code execution on hundreds of millions of people and popular apps

#320

Post by klabb3 »

pl4nty wrote: post #319
klabb3 wrote: post #232

Earlier quoted context omitted.

There isn’t a package manager in many cases: windows store requires a MS account. macOS app store nerfs apps by sandbox restrictions. Linux has so many flavors of package managers it’s death by 1000 paper cuts. None of the major bundlers like flutter, electron and tauri support all these package managers and/or app stores. Let alone running the infrastructure for it. Which leaves you with self-updaters. I definitely…

> windows store requires a MS account they avoid mentioning it, but the Microsoft managed package format (MSIX) works just fine without the Microsoft Store. create an App Installer manifest, stick it on a website, and get semver-d differential updates across multiple architectures for free: https://learn.microsoft.com/en-us/windows/msix/app-installer... msft have woefully underinvested in the ecosystem and docs thoug…

That's interesting and unexpected. How does the update check, notification & install process work?

EDIT: I think your link answered some of these questions. I’m on .msi myself so can’t benefit from it yet anyway.. basically these things need to be managed by the app bundlers like electron & tauri otherwise we’re asking for trouble. I think..

Post reply on HN