Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to gain code execution on hundreds of millions of people and popular apps

kibty.town

Post reply on HN
Print view View original

81–90 of 350 posts

Re: How to gain code execution on hundreds of millions of people and popular apps

#81

Post by braiamp »

TZubiri wrote: post #77
spudlyo wrote: post #9

Earlier quoted context omitted.

> cannot happen again. Hubris. Does not inspire confidence. > We resolved the vulnerability within 26 hours of its initial report, and additional security audits were completed by February 2025. After reading the vulnerability report, I am impressed at how quickly you guys jumped on the fix, so kudos. Did the security audit lead to any significant remediation work? If you weren't following PoLP, I wonder what else ma…

[flagged]

This is the wrong response, because that means that the learning would be lost. The security community didn't want that to happen when one of the CA's got a vulnerability, we do not want it to happen to other companies. We want companies to succeed and get better, being shameful doesn't help towards that. Learning the right lessons does, and resigning means that you are learning the wrong ones.

Re: How to gain code execution on hundreds of millions of people and popular apps

#82

Post by TZubiri »

giantg2 wrote: post #21

With rhe number of dependencies and dependency trees going multiple levels deep? Third party risk is the largely unaddressed elephant in the room that companies don't care about.

I started to use

-paid operating system (rhel) with a team of paid developers and maintainers verifying builds and dependencies.

- empty dependencies. Only what the core language provides.

It's not that great of a sacrifice. Like 20$/mo for the OS. And like 2 days of dev work which pays itself off in the long run by avoiding a mass of code you don't understand

Re: How to gain code execution on hundreds of millions of people and popular apps

#83

Post by TZubiri »

gamedever wrote: post #49
rvz wrote: post #6

My goodness. So much third-party risk upon risk and lots of external services opening up this massive attack surface and introducing this RCE vulnerability. From an Electron bundler service, to sourcemap extraction and now an exposed package.json with the container keys to deploy any app update to anyone's machine. This isn't the only one, the other day Claude CLI got a full source code leak via the same method from…

Blaming Js/Ts is ridiculous. All those same problems exist in all environments. Js/Ts is the biggest so it gets the most attention but if you think it's different in any other environment you're fooling yourself.

Ecosystem, not the lang itself.

It truly is a community issue, it's not a matter of the lang.

You will never live down fucking left-pad

Re: How to gain code execution on hundreds of millions of people and popular apps

#84

Post by TZubiri »

noisy_boy wrote: post #57

Question/idea: can't GitHub use LLMs to periodically scan the code for vulnerabilities like this and inform the repo owner? They can even charge for it ;)

Problem: a tool built with LLMs for building LLMs with LLMs has a vuln

Solution: more LLMs

Snap out of it

Re: How to gain code execution on hundreds of millions of people and popular apps

#85

Post by TZubiri »

braiamp wrote: post #81
TZubiri wrote: post #77

Earlier quoted context omitted.

[flagged]

This is the wrong response, because that means that the learning would be lost. The security community didn't want that to happen when one of the CA's got a vulnerability, we do not want it to happen to other companies. We want companies to succeed and get better, being shameful doesn't help towards that. Learning the right lessons does, and resigning means that you are learning the wrong ones.

I don't think the lesson is lost. The opposite.

If you get a slap on the wrist, do you learn? No, you play it down.

However if a dev who gets caught doing a bad is forced to resign. Then all the rest of the devs doing the same thing will shape up.

Re: How to gain code execution on hundreds of millions of people and popular apps

#87

Post by TZubiri »

remram wrote: post #78
TZubiri wrote: post #64

Earlier quoted context omitted.

Don't worry man, it's way more embarassing for the people that downloaded your dep or any upstream tool. If they didn't pay you a cent, you have no liability here.

This is not how the law works anywhere, thankfully.

Well for one it was a gift so there is no valid contract right? There are no direct damages because there is nothing paid and nothing to refund. Wrt indirect damages, there's bound to be a disclaimer or two, at least at the app layer.

IANAL, not legal advice

Re: How to gain code execution on hundreds of millions of people and popular apps

#88

Post by otterley »

TZubiri wrote: post #85
braiamp wrote: post #81

Earlier quoted context omitted.

This is the wrong response, because that means that the learning would be lost. The security community didn't want that to happen when one of the CA's got a vulnerability, we do not want it to happen to other companies. We want companies to succeed and get better, being shameful doesn't help towards that. Learning the right lessons does, and resigning means that you are learning the wrong ones.

I don't think the lesson is lost. The opposite. If you get a slap on the wrist, do you learn? No, you play it down. However if a dev who gets caught doing a bad is forced to resign. Then all the rest of the devs doing the same thing will shape up.

Under what theory of psychology are you operating? This is along the same lines as the theory that punishment is an effective deterrent of crime, which we know isn’t true from experience.

Re: How to gain code execution on hundreds of millions of people and popular apps

#89

Post by bastawhiz »

TZubiri wrote: post #79
felixrieseberg wrote: post #31

As an Electron maintainer, I'll re-iterate a warning I've told many people before: Your auto-updater and the underlying code-signing and notarization mechanisms are sacred . The recovery mechanisms for the entire system are extremely painful and often require embarrassing emails to customers. A compromised code-sign certificate is close to the top of my personal nightmares. Dave and toDesktop have build a product tha…

Question. I've noticed a lot of websites import from other sites, instead of local. I almost never see a hash in there. Is this as dangerous as it looks, why don't people just use a hash?

1. Yes

2. Because that requires you to know how to find the hash and add it.

Truthfully the burden should be on the third party that's serving the script (where did you copy that HTML in the first place?) but they aren't incentivizes to have other sites use a hash.

Re: How to gain code execution on hundreds of millions of people and popular apps

#90

Post by bastawhiz »

999900000999 wrote: post #56
sky2224 wrote: post #41

This is the second big attack found by this individual in what... 6 months? The previous exploit (which was in Arc browser), also leveraged a poorly configured firebase db: https://kibty.town/blog/arc/ So this is to say, at what point should we start pointing the finger at Google for allowing developers to shoot themselves in the foot so easily? Granted, I don't have much experience with firebase, but to me this just…

Firebase let's anyone get started in 30 seconds. Details like proper usage, security, etc. Those are often overlooked. Google isn't to blame if you ship a paid product without running a security audit. I use firebase essentially for hobbyist projects for me and my friends. If I had to guess these issues come about because developers are rushing to market. Not Google's fault ... What works for a prototype isn't produc…

> Google isn't to blame if you ship a paid product without running a security audit.

Arguably, if you provide a service that makes it trivial to create security issues (that is to say, you have to go out of your way to use it correctly) then it's your fault. If making it secure means making it somewhat less convenient, it's 100% your fault for not making it less convenient.

Post reply on HN