Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to gain code execution on hundreds of millions of people and popular apps

kibty.town

Post reply on HN
Print view View original

321–330 of 350 posts

Re: How to gain code execution on hundreds of millions of people and popular apps

#321

Post by 999900000999 »

Eisenstein wrote: post #311
999900000999 wrote: post #308

Earlier quoted context omitted.

Why do you want to regulate software? Arguably this whole thing wouldn't happen if these apps were distributed and updated via the OSX app store. If that's the future you want, it's largely already here. You can check a setting in OSX to make it so. Who decides what software to regulate. Do I need a permit to install Python ?

> Why do you want to regulate software? I don't want to regulate software. I want people to have something to lose if they make a decision that has a large impact. > Arguably this whole thing wouldn't happen if these apps were distributed and updated via the OSX app store. If that's the future you want, it's largely already here. I don't understand this point. > Who decides what software to regulate. Who decides any…

> Arguably this whole thing wouldn't happen if these apps were distributed and updated via the OSX app store. If that's the future you want, it's largely already here.

I don't understand this point.

The core of this issue is an insecure updating mechanism for desktop apps. You can argue for security sake, users may opt to only use the official Apple app store or the official Microsoft store. In this case instead of having a random startup manage the update process, you have a couple of multibillion dollar companies.

I'm trying to figure out what exactly you want to happen here. Would you essentially make it a legal to distribute software without a permit ? Would distributing certain software require a permit ?

Re: How to gain code execution on hundreds of millions of people and popular apps

#322

Post by ImPostingOnHN »

Eisenstein wrote: post #318
ImPostingOnHN wrote: post #313

Earlier quoted context omitted.

I still choose the third option, because it is the better of the three, compared to restricting what functionality the software people write is allowed to have, and extremely blameful postmortems (which are bad).

All restrictions are bad, and accountability is bad. Got it. I'm glad to have had this discussion with you; very thought provoking.

Again, I still choose the third option, because it is the better of the three, compared to restricting what functionality the software people write is allowed to have, and extremely blameful postmortems (which are bad).

You seem really stuck on the first two options. Why does it matter, given that the third is the best? Do you still insist upon a false dichotomy?

Re: How to gain code execution on hundreds of millions of people and popular apps

#323

Post by valenterry »

bastawhiz wrote: post #315
valenterry wrote: post #120

Earlier quoted context omitted.

Well, to be honest, the browsers could super easily solve that. In dev mode, just issue a warning "loaded script that has hash X but isn't statically defined. This is a huge security risk. Read more here" and that's it. Then you can just add the script, run the site, check the logs and add the hash, done.

> In dev mode, just issue a warning "loaded script that has hash X but isn't statically defined. How does the browser know which files to warn you about? What about scripts that are generated dynamically and have no static hash? There's plenty of reasons why you wouldn't want this.

It just warns about all embedded non-same-origin scripts that don't have a hash.

> What about scripts that are generated dynamically and have no static hash?

Well, then the warning is still valid because this is a security risk. I guess it'd be fine to be able to suppress the warning explicitly in those cases.

> There's plenty of reasons why you wouldn't want this.

For example? Honestly curious where you would not want a warning by default.

Re: How to gain code execution on hundreds of millions of people and popular apps

#324

Post by quacksilver »

TZubiri wrote: post #272
quacksilver wrote: post #206

Earlier quoted context omitted.

I wish popular browsers would get together and release an update that says: - After version X we are displaying a prominent popup if a script isn't loaded with a hash - After version Y we blocking scripts loaded without hashes They could solve this problem in a year or so, and if devs are too lazy to specify a hash when loading scripts then their site will break.

I don't think it's just laziness. There's use cases where the libraries are designed to be updated automatically. Also some of the tracking scripts I don't think are strictly static content, maybe their strategy to fingerprint browser involves sending different shit to different users.

If you are the one serving the website, then you are the one generating the hash. If you want to serve different stuff then you could dynamically generate the hash for that different stuff rather than hard code it statically.

Specifying a script hash says that you as the owner of that site agree to load the content only if it matches the hash. Presumably you trust the content enough to serve it to your users.

Re: How to gain code execution on hundreds of millions of people and popular apps

#325

Post by quacksilver »

bastawhiz wrote: post #316
quacksilver wrote: post #206

Earlier quoted context omitted.

I wish popular browsers would get together and release an update that says: - After version X we are displaying a prominent popup if a script isn't loaded with a hash - After version Y we blocking scripts loaded without hashes They could solve this problem in a year or so, and if devs are too lazy to specify a hash when loading scripts then their site will break.

Literally every website that uses JSONP will stop working if that happened. This would break the web in fundamental ways. If we're going to break the web in fundamental ways, resource integrity is hardly among the things that I'd be interested in changing.

Why would people choose JSONP over CORS?

There are security risks with JSONP (a hack to bypass same-origin policy), and the successor (CORS) has been around since 2009, so phasing it out may be a good thing.

https://dev.to/benregenspan/the-state-of-jsonp-and-jsonp-vul...

Re: How to gain code execution on hundreds of millions of people and popular apps

#326

Post by sigmoid10 »

buran77 wrote: post #226
sigmoid10 wrote: post #215

Earlier quoted context omitted.

And it's not like B2B doesn't get whacked by bad software or bad actors regulalry. The idea that software updates itself is vastly more benefitial than harmful in the very long term. There so many old machines running outdated software in gated corporate networks, they will get owned immediately once a single one of them is compromised in any way. They are literally trading minor inconveniences for a massive time-bom…

The two sides of your thought are going head to head. "Gated corporate networks" don't benefit from software that "updates itself" (unless we're talking about pure SaaS). It's exactly where auto-updating is completely useless because any company with a functioning IT will go out of its way to not delegate the decisions of when to update or what features are forced in out to the developer and their product manager. Au…

You're not thinking of it long term. In the short term you might be better off deciding when to update yourself, but in the long term you will be infinitely worse off because the reality of business practice is to delay updates until something catastrophic happens just to save a few bucks in the IT department. This approach merely means your system will run smoother over short time scales, while it becomes a complete clusterfuck over long time scales.

Re: How to gain code execution on hundreds of millions of people and popular apps

#327

Post by Eisenstein »

ImPostingOnHN wrote: post #322
Eisenstein wrote: post #318

Earlier quoted context omitted.

All restrictions are bad, and accountability is bad. Got it. I'm glad to have had this discussion with you; very thought provoking.

Again, I still choose the third option, because it is the better of the three, compared to restricting what functionality the software people write is allowed to have, and extremely blameful postmortems (which are bad). You seem really stuck on the first two options. Why does it matter, given that the third is the best? Do you still insist upon a false dichotomy?

It isn't exactly surprising that someone who is the beneficiary of a system which has no accountability is against the imposing of such, I was just hoping you had something better to offer back than 'I don't like it' and assertions that something is bad without ever explaining why. I have no idea why 'blameful postmortems' are bad because you never told me, you just say it is. Why should I change my mind in that case?

Re: How to gain code execution on hundreds of millions of people and popular apps

#328

Post by bell-cot »

IshKebab wrote: post #188
999900000999 wrote: post #96

Earlier quoted context omitted.

What if I need to hack together a POC for 3 people to look at. It's my responsibility to make sure when we scale from 3 users to 30k users we take security seriously. As my old auto shop teacher used to say, if you try to idiot proof something they'll build a better idiot. Even if Google warns you in big bold print "YOU ARE DOING SOMETHING INSECURE", someone out there is going to click deploy anyway. You're arguing G…

Then you should have to click a big red button labelled "Enable insecure mode". Defaults should be secure. Kind of blows my mind people still don't get this.

Legal Dept: +10, Favorite

Marketing Dept: -10, Flag

Re: How to gain code execution on hundreds of millions of people and popular apps

#329

Post by Eisenstein »

999900000999 wrote: post #321
Eisenstein wrote: post #311

Earlier quoted context omitted.

> Why do you want to regulate software? I don't want to regulate software. I want people to have something to lose if they make a decision that has a large impact. > Arguably this whole thing wouldn't happen if these apps were distributed and updated via the OSX app store. If that's the future you want, it's largely already here. I don't understand this point. > Who decides what software to regulate. Who decides any…

> Arguably this whole thing wouldn't happen if these apps were distributed and updated via the OSX app store. If that's the future you want, it's largely already here. I don't understand this point. The core of this issue is an insecure updating mechanism for desktop apps. You can argue for security sake, users may opt to only use the official Apple app store or the official Microsoft store. In this case instead of h…

I am expressing long held frustration that software engineering as a culture is trying to eat its cake and still have it. Wanting to be called an engineer, demanding a high salary and running the largest sections of the economy and disrupting society in highly impactful ways, yet whenever someone asks them to take responsibility for any damage caused they downplay their role and anyone else's in the industry. It is time to grow up. If you make a decision to make more money or do less work, knowing that it has a risk to cause major problems for infrastructure, economy, or other people, then there should be something more on the line for you than a 'oopsie' at the end of it if you lose that bet.

Re: How to gain code execution on hundreds of millions of people and popular apps

#330

Post by ImPostingOnHN »

Eisenstein wrote: post #327
ImPostingOnHN wrote: post #322

Earlier quoted context omitted.

Again, I still choose the third option, because it is the better of the three, compared to restricting what functionality the software people write is allowed to have, and extremely blameful postmortems (which are bad). You seem really stuck on the first two options. Why does it matter, given that the third is the best? Do you still insist upon a false dichotomy?

It isn't exactly surprising that someone who is the beneficiary of a system which has no accountability is against the imposing of such, I was just hoping you had something better to offer back than 'I don't like it' and assertions that something is bad without ever explaining why. I have no idea why 'blameful postmortems' are bad because you never told me, you just say it is. Why should I change my mind in that case…

>I have no idea why 'blameful postmortems' are bad because you never told me

Usually when you don't know something, you ask someone who knows. Since you sort-of asked here, I'll give you the answer:

Blameless postmortems lead to fewer failures, which is ostensibly the goal here. So what do you get from your idea of blameful ones? Feeling good about punishing someone, even though you're increasing failures by doing so?

Post reply on HN