Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to gain code execution on hundreds of millions of people and popular apps

kibty.town

Post reply on HN
Print view View original

331–340 of 350 posts

Re: How to gain code execution on hundreds of millions of people and popular apps

#331

Post by 999900000999 »

Eisenstein wrote: post #329
999900000999 wrote: post #321

Earlier quoted context omitted.

> Arguably this whole thing wouldn't happen if these apps were distributed and updated via the OSX app store. If that's the future you want, it's largely already here. I don't understand this point. The core of this issue is an insecure updating mechanism for desktop apps. You can argue for security sake, users may opt to only use the official Apple app store or the official Microsoft store. In this case instead of h…

I am expressing long held frustration that software engineering as a culture is trying to eat its cake and still have it. Wanting to be called an engineer, demanding a high salary and running the largest sections of the economy and disrupting society in highly impactful ways, yet whenever someone asks them to take responsibility for any damage caused they downplay their role and anyone else's in the industry. It is t…

I'm on the side of freedom.

If you want to run your company using vetted software and limit your developers to only use a small list of approved software. You can do that. I've worked in such environments. You can lock down the corporate firewall. The point is choice.

It's completely different if you basically want a regulatory agency which will decide what software people are allowed to build.

Outside of work I like to use niche Linux distros. If I accidentally wipe my vacation photos during the install process, that's a risk I took. I don't have a right to complain that I destroyed my own data and blame it on software largely built by volunteers.

However I don't disagree completely. If you want to build a hardened fork of Linux with software vetted by your private certifying authority, that could be a good market. If all engineers working on your custom fork need to be "licensed" by a privately run organization, that is also fine.

I just wouldn't want the State to do this.

Re: How to gain code execution on hundreds of millions of people and popular apps

#332

Post by account42 »

PeterStuer wrote: post #204
RadiozRadioz wrote: post #132

Earlier quoted context omitted.

How about we don't build an auto-updater? Maybe some apps require an extremely tight coupling with a server, but we should try our best to release complete software to users that will work as close to forever as possible. Touching files on a user's system should be treated as a rare special occurrence. If a server is involved with the app, build a stable interface and think long and hard about every change. Meticulou…

Sounds like you come from the B2B, consultancyware or 6÷ figure/year license world. For the vast realm of all your suggestions are completely unviable.

This is how consumer programs used to work before everyone got fast broadband.

Re: How to gain code execution on hundreds of millions of people and popular apps

#333

Post by account42 »

sigmoid10 wrote: post #215
PeterStuer wrote: post #204

Earlier quoted context omitted.

Sounds like you come from the B2B, consultancyware or 6÷ figure/year license world. For the vast realm of all your suggestions are completely unviable.

And it's not like B2B doesn't get whacked by bad software or bad actors regulalry. The idea that software updates itself is vastly more benefitial than harmful in the very long term. There so many old machines running outdated software in gated corporate networks, they will get owned immediately once a single one of them is compromised in any way. They are literally trading minor inconveniences for a massive time-bom…

This mentality is how we get incidents like CrowdStrike. Relying on auto-updates for security is a crutch that allows insecure designs to spread.

Re: How to gain code execution on hundreds of millions of people and popular apps

#334

Post by account42 »

sigmoid10 wrote: post #326
buran77 wrote: post #226

Earlier quoted context omitted.

The two sides of your thought are going head to head. "Gated corporate networks" don't benefit from software that "updates itself" (unless we're talking about pure SaaS). It's exactly where auto-updating is completely useless because any company with a functioning IT will go out of its way to not delegate the decisions of when to update or what features are forced in out to the developer and their product manager. Au…

You're not thinking of it long term. In the short term you might be better off deciding when to update yourself, but in the long term you will be infinitely worse off because the reality of business practice is to delay updates until something catastrophic happens just to save a few bucks in the IT department. This approach merely means your system will run smoother over short time scales, while it becomes a complete…

The reality of auto-updates is that you get your workflow broken during critical project phases.

Re: How to gain code execution on hundreds of millions of people and popular apps

#335

Post by account42 »

klabb3 wrote: post #222
RadiozRadioz wrote: post #132

Earlier quoted context omitted.

How about we don't build an auto-updater? Maybe some apps require an extremely tight coupling with a server, but we should try our best to release complete software to users that will work as close to forever as possible. Touching files on a user's system should be treated as a rare special occurrence. If a server is involved with the app, build a stable interface and think long and hard about every change. Meticulou…

> How about we don't build an auto-updater? Sure. I’d rather have it be provided by the platform. It’s a lot of work to maintain for 5 OSs (3 desktop, 2 mobile). > we should try our best to release complete software to users that will work as close to forever as possible This isn’t feasible. Last I tried to support old systems on my app, the vendor (Apple) had stopped supporting and didn’t even provide free VMs. Wind…

> This isn’t feasible. Last I tried to support old systems on my app, the vendor (Apple) had stopped supporting and didn’t even provide free VMs.

Why do you need "free VMs" as a professional software company. A couple of legacy machines is pocket change comparet to the salary of even a signle developer.

> Windows 10 is scheduled for non-support this year (afaik).

So? People are still releasing new software for XP. It's not that hard.

> On Linux glibc or gtk will mess with any GUI app after a few years.

glibc provides extreme long-term backwards compatibility so isn't a problem as long as you build against the oldest version you want to support.

gtk is a problem but also doesn't change as often as you are implying - we are only at version 4 now. And depending on what software you are building you can also avoid it.

> If Microsoft, Google and Apple can’t, why the hell should I as a solo app developer? Plus, I have 5 platforms to worry about, they only have their own.

So that your users have a reason to choose you over Microsoft, Google and Apple.

Re: How to gain code execution on hundreds of millions of people and popular apps

#336

Post by account42 »

rustcleaner wrote: post #221
felixrieseberg wrote: post #31

As an Electron maintainer, I'll re-iterate a warning I've told many people before: Your auto-updater and the underlying code-signing and notarization mechanisms are sacred . The recovery mechanisms for the entire system are extremely painful and often require embarrassing emails to customers. A compromised code-sign certificate is close to the top of my personal nightmares. Dave and toDesktop have build a product tha…

This one is right. Have a shoe-box key, a key which is copied 2*N (redundancy) times and N copies are stored in 2 shoe-boxes. It can be on tape, or optical, or silicon, or paper. This key always stays offline. This is your rootiest of root keys in your products, and almost nothing is signed by it. The next key down which the shoe-box key signs (ideally, the only thing) is for all intents and purposes your acting "roo…

Signing a revocation doesn't magically inform all affected devices. In practice this is equivalent to pushing an update that replaces the root key.

Re: How to gain code execution on hundreds of millions of people and popular apps

#337

Post by account42 »

TZubiri wrote: post #270
valenterry wrote: post #136

Earlier quoted context omitted.

But that doesn't make it easy to integrate a new script from an author who doesn't provide the hash already.

But you can .. get the hash yourself? wget url; sha256 file

Cool. Now your site will break if the upstream pushes a fix while you're on vacation.

Re: How to gain code execution on hundreds of millions of people and popular apps

#338

Post by account42 »

bastawhiz wrote: post #316
quacksilver wrote: post #206

Earlier quoted context omitted.

I wish popular browsers would get together and release an update that says: - After version X we are displaying a prominent popup if a script isn't loaded with a hash - After version Y we blocking scripts loaded without hashes They could solve this problem in a year or so, and if devs are too lazy to specify a hash when loading scripts then their site will break.

Literally every website that uses JSONP will stop working if that happened. This would break the web in fundamental ways. If we're going to break the web in fundamental ways, resource integrity is hardly among the things that I'd be interested in changing.

Good. JSONP requests to a domain you don't control are a security nightmare.

Re: How to gain code execution on hundreds of millions of people and popular apps

#339

Post by Moni_Mac »

filleokus wrote: post #152
felixrieseberg wrote: post #31

As an Electron maintainer, I'll re-iterate a warning I've told many people before: Your auto-updater and the underlying code-signing and notarization mechanisms are sacred . The recovery mechanisms for the entire system are extremely painful and often require embarrassing emails to customers. A compromised code-sign certificate is close to the top of my personal nightmares. Dave and toDesktop have build a product tha…

> For Windows signing, use Azure Trusted Signing I recently checked it out as an alternative to renewing our signing cert, but it doesn't support issuing EV certs. I've understood it as having an EV code signing cert on Windows is required for drivers, but somehow also gives you better SmartScreen reputation making it useful even for user space apps in enterprisey settings? Not sure if this is FUD spread by the EV CA…

[dead]

Re: How to gain code execution on hundreds of millions of people and popular apps

#340

Post by PeterStuer »

account42 wrote: post #332
PeterStuer wrote: post #204

Earlier quoted context omitted.

Sounds like you come from the B2B, consultancyware or 6÷ figure/year license world. For the vast realm of all your suggestions are completely unviable.

This is how consumer programs used to work before everyone got fast broadband.

There was not much consumer programs to exploit in the days of dialup.

Sure, virii were with us since the early 80's, but they mostly targetted the OS, and there were no rapid security patch release cycles back then. You just had 'prevention' and mostly cleanup.

Post reply on HN