Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to gain code execution on hundreds of millions of people and popular apps

kibty.town

Post reply on HN
Print view View original

71–80 of 350 posts

Re: How to gain code execution on hundreds of millions of people and popular apps

#71

Post by TheDong »

mcoliver wrote: post #59
TheDong wrote: post #32

Earlier quoted context omitted.

In what world do you have a machine which downloads source code to build it, but doesn't have outbound internet access so it can't download source code or build dependencies? Like, effectively the "build machine" here is a locked down docker container that runs "git clone && npm build", right? How do you do either of those activities without outbound network access? And outbound network access is enough on its own to…

There are plenty of worlds that take security more seriously and practice defense in depth. Your response could use a little less hubris and a more genuinely inquisitive tone. Looks like others have already chimed in here but to respond to your (what feels like sarcasm) questions: - You can have a submission process that accepts a package or downloads dependencies, and then passes it to another machine that is on an…

You have to meet your users where they are. Your users are not using nix and bazel, they're using npm and typescript.

If your users are using bazel, it's easy to separate "download" from "build", but if you're meeting your users over here where cows aren't spherical, you can't take security that seriously.

Security doesn't help if all your users leave.

Re: How to gain code execution on hundreds of millions of people and popular apps

#72

Post by gtirloni »

tomjakubowski wrote: post #43
trallnag wrote: post #30

Earlier quoted context omitted.

Isn't it really common for build machines to have outbound internet access? Millions of developers use GitHub Actions for building artifacts and the public runners definitely have outbound internet access

Indeed, you can indeed punch out from an actions runner. Such a thing is probably against GitHub's ToS, but I've heard from my third cousin twice removed that his friend once ssh'ed out from an action to a bastion host, then used port forwarding to get herself a shell on the runner in order to debug a failing build.

So this friend escaped from the ephemeral container VM into the build host which happened to have a private SSH on it that allowed it to connect to a bastion host to... go back to the build host and debug a failed build that should be self-contained inside the container VM which they already had access in the first place by the means of, you know, running a build on it? Interesting.

Re: How to gain code execution on hundreds of millions of people and popular apps

#73

Post by TheDong »

fc417fc802 wrote: post #55
TheDong wrote: post #32

Earlier quoted context omitted.

In what world do you have a machine which downloads source code to build it, but doesn't have outbound internet access so it can't download source code or build dependencies? Like, effectively the "build machine" here is a locked down docker container that runs "git clone && npm build", right? How do you do either of those activities without outbound network access? And outbound network access is enough on its own to…

If you don't network isolate your build tooling then how do you have any confidence that your inputs are what you believe them to be? I run my build tools in a network namespace with no connection to the outside world. The dependencies are whatever I explicitly checked into the repo or otherwise placed within the directory tree.

You don't have any confidence beyond what lockfiles give you (which is to say the npm postinstall scripts could be very impure, non-hermetic, and output random strings). But if you require users to vendor all their dependencies, fully isolate all network traffic during build, be perfectly pure and reproducible and hermetic, presumably use nix/bazel/etc... well, you won't have any users.

If you want a perfectly secure system with 0 users, it's pretty easy to build that.

Re: How to gain code execution on hundreds of millions of people and popular apps

#74

Post by TheDong »

areyourllySorry wrote: post #36
TheDong wrote: post #32

Earlier quoted context omitted.

In what world do you have a machine which downloads source code to build it, but doesn't have outbound internet access so it can't download source code or build dependencies? Like, effectively the "build machine" here is a locked down docker container that runs "git clone && npm build", right? How do you do either of those activities without outbound network access? And outbound network access is enough on its own to…

you can always limit said network access to npm.

You can't since a large number of npm post-install scripts also make random arbitrary network calls.

This includes things like downloading and compiling pre-compiled binaries for the native architecture hosted on random servers.

npm is really cool.

Re: How to gain code execution on hundreds of millions of people and popular apps

#75

Post by TZubiri »

I can't post things like "what a bunch of clowns" due to hacker news guidelines so let me go by another more productive route.

These people, the ones who install dependencies (that install dependencies)+, these people who write apps with AI, who in the previous season looped between executing their code and searching the error on stackoverflow.

Whether they work for a company or have their own startup, the moment that they start charging money, they need to be held liable when shit happens.

When they make their business model or employability advantage to take free code in the internet, add pumpkin spice and charge cash for it, they cross the line from pissing passionate hackers by defiling our craft, to dumping in the pool and ruining it for users and us.

It is not sufficient to write somewhere in a contract that something is as is and we hold harmless and this and that. Buddy if you download an ai tool to write an ai tool to write an ai tool and you decided to slap a password in there, you are playing with big guns, if it gets leaked, you are putting other services at risk, but let's call that a misdemeanor. Because we need to reserve something stronger for when your program fails silently, and someone paid you for it, and they relied on your program, and acted on it.

That's worse than a vulnerability, there is no shared responsibility, at least with a vuln, you can argue that it wasn't all your fault, someone else actively caused harm. Now are we to believe the greater risk of installing 19k dependencies and programming ai with ai is vulns? No! We have a certainty, not a risk, that they will fuck it up.

Eventually we should license the field, but for now, we gotta hold devs liable.

Give those of us who do 10 times less, but do it right, some kind of marketing advantages, it shouldn't be legal that they are competing with us. A vscode fork got how much in VC funding?

My brothers lets take arms and defend. And defend quality software I say. Fear not writing code, fear not writing raw html, fear not, for they don't feel fear so why should you?

Re: How to gain code execution on hundreds of millions of people and popular apps

#76

Post by floydnoel »

stefan_ wrote: post #33
GuestFAUniverse wrote: post #15

" please do not harass these companies or make it seem like it's their fault, it's not. it's todesktop's fault if anything) " I don't get it. Why would it be "todesktop's fault", when all the mentioned companies allowed to push updates? I had these kind of discussions with naive developers giving _full access_ to GitHub orgs to various 3rd party apps -- that's never right!

Yeah, it is their fault. I don't download "todesktop" (to-exploit), I download Cursor. Don't give 3rd parties push access to all your clients, that's crazy. How can this crappy startup build server sign a build for you? That's insane.

it blows me away that this is even a product. it's like a half day of dev time, and they don’t appear to have over-engineered it or even done basic things given the exploit here.

Re: How to gain code execution on hundreds of millions of people and popular apps

#77

Post by TZubiri »

spudlyo wrote: post #9
davej wrote: post #3

Dave here, founder of ToDesktop. I've shared a write-up: https://www.todesktop.com/blog/posts/security-incident-at-to... This vulnerability was genuinely embarrassing, and I'm sorry we let it happen. After thorough internal and third-party audits, we've fundamentally restructured our security practices to ensure this scenario can't recur. Full details are covered in the linked write-up. Special thanks to Eva for resp…

> cannot happen again. Hubris. Does not inspire confidence. > We resolved the vulnerability within 26 hours of its initial report, and additional security audits were completed by February 2025. After reading the vulnerability report, I am impressed at how quickly you guys jumped on the fix, so kudos. Did the security audit lead to any significant remediation work? If you weren't following PoLP, I wonder what else ma…

[flagged]

Re: How to gain code execution on hundreds of millions of people and popular apps

#78

Post by remram »

TZubiri wrote: post #64
davej wrote: post #3

Dave here, founder of ToDesktop. I've shared a write-up: https://www.todesktop.com/blog/posts/security-incident-at-to... This vulnerability was genuinely embarrassing, and I'm sorry we let it happen. After thorough internal and third-party audits, we've fundamentally restructured our security practices to ensure this scenario can't recur. Full details are covered in the linked write-up. Special thanks to Eva for resp…

Don't worry man, it's way more embarassing for the people that downloaded your dep or any upstream tool. If they didn't pay you a cent, you have no liability here.

This is not how the law works anywhere, thankfully.

Re: How to gain code execution on hundreds of millions of people and popular apps

#79

Post by TZubiri »

felixrieseberg wrote: post #31

As an Electron maintainer, I'll re-iterate a warning I've told many people before: Your auto-updater and the underlying code-signing and notarization mechanisms are sacred . The recovery mechanisms for the entire system are extremely painful and often require embarrassing emails to customers. A compromised code-sign certificate is close to the top of my personal nightmares. Dave and toDesktop have build a product tha…

Question.

I've noticed a lot of websites import from other sites, instead of local.

I almost never see a hash in there. Is this as dangerous as it looks, why don't people just use a hash?

Re: How to gain code execution on hundreds of millions of people and popular apps

#80

Post by carcabob »

gblargg wrote: post #69
vekatimest wrote: post #27

The cat is cute but I'd rather not have it running in front of the text while I'm trying to read and use my cursor.

I had to go back and enable JavaScript. Wow, is the goal to direct my attention away from reading the text?

Ironically, it actually helped me stay focused on the article. Kind of like a fidget toy. When part of my brain would get bored, I could just move the cat and satisfy that part of my brain while I keep reading.

I know that sounds kind of sad that my brain can't focus that well (and it is), but I appreciated the cat.

Post reply on HN