Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Unauthenticated remote code execution in OpenCode

cy.md

Post reply on HN
Print view View original

41–50 of 155 posts

Re: Unauthenticated remote code execution in OpenCode

#41

Post by angry_octet »

This is such an egregious lack of respect for users, you can't trust this organisation again, and the lack of responsiveness just signals that they don't consider it a problem. Users must signal to companies that this attitude is unacceptable by dumping them.

Re: Unauthenticated remote code execution in OpenCode

#42

Post by heavyset_go »

If you aren't blocking your browser from allowing sites to call to local services, you should:

> Network Boundary Shield

> The Network Boundary Shield (NBS) is a protection against attacks from an external network (the Internet) to an internal network - especially against a reconnaissance attack where a web browser is abused as a proxy.

> The main goal of NBS is to prevent attacks where a public website requests a resource from the internal network (e.g. the logo of the manufacturer of the local router); NBS will detect that a web page hosted on the public Internet is trying to connect to a local IP address. NBS only blocks HTTP requests from a web page hosted on a public IP address to a private network resource; the user can allow specific web pages to access local resources (e.g. when using Intranet services).

https://jshelter.org/nbs/

Re: Unauthenticated remote code execution in OpenCode

#43

Post by capybarafriend »

fwiw they should probably slow down a bit, even though they seem to be winning the race. they started selling their own subscription plan last week, and promptly committed all subscriber’s emails to the public repo

> Hey - have some bad news.

> We accidentally committed your email to our repo as part of a script that was activating OpenCode Black.

> No other information was included, just the email on its own.

Re: Unauthenticated remote code execution in OpenCode

#44

Post by theshrike79 »

lvl155 wrote: post #23

They keep adding features without maintaining the core. I stopped using it when they started selling plans. The main reason for Opencode was to use multiple models but it turns out context sharing across models is PIA and impractical right now. I went back to using Claude Code and Codex side by side. Having said that, there is definitely a need for open platform to utilize multiple vendors and models. I just don’t th…

As someone who uses the two big C's, I can recommend ampcode[0] and Crush[1]+z.ai GLM as an addition.

Amp can do small utility scripts and changes for free (especially if you enable the ads) and Crush+GLM is pretty good at following plans done by Claude or Codex

[0] https://ampcode.com/

[1] https://github.com/charmbracelet/crush

Re: Unauthenticated remote code execution in OpenCode

#45

Post by pamcake »

blackbear_ wrote: post #39

Isn't it insane that any web page can run a port scan in the first place? Who wants that? Meanwhile, running opencode in a podman container seems to stop this particular, err, feature.

If you use uBlock Origin you can enable the "Privacy -> Block Outsider Intrusion into LAN" filter list to mitigate this.

Re: Unauthenticated remote code execution in OpenCode

#46

Post by shimman »

tommica wrote: post #36
shimman wrote: post #20

Earlier quoted context omitted.

It's hard to not own it when it's publicly disclosed. Maybe save the accolades for when they actually do something and not just say something.

[flagged]

In my limited existence on this earth, talk is very cheap and actions should matter more.

Re: Unauthenticated remote code execution in OpenCode

#47

Post by glerk »

zmmmmm wrote: post #37

This is pretty egregious. And outside the fact the server is now disabled by default, once it's running it is still egregious: > When server is enabled, any web page served from localhost/127.0.0.1 can execute code > When server is enabled, any local process can execute code without authentication > No indication when server is running (users may be unaware of exposure) I'm sorry this is horrible. I really want there…

Factory’s droid is pretty good for a cross-provider solution.

Re: Unauthenticated remote code execution in OpenCode

#50

Post by observationist »

thdxr wrote: post #4

hey maintainer here we've done a poor job handling these security reports, usage has grown rapidly and we're overwhelmed with issues we're meeting with some people this week to advise us on how to handle this better, get a bug bounty program funded and have some audits done

Good luck, and thank you for eating the accountability sandwich and being up front about what you're doing. That's not always easy to do, and it's appreciated!
Post reply on HN