91–100 of 155 posts
Isn't it insane that any web page can run a port scan in the first place? Who wants that? Meanwhile, running opencode in a podman container seems to stop this particular, err, feature.
If you use uBlock Origin you can enable the "Privacy -> Block Outsider Intrusion into LAN" filter list to mitigate this.
A coworker raised an interesting point to me. The CORS fix removes exploitation by arbitrary websites (but obviously allows full access from the opencode domain), but let's take that piece out for a second... What's the difference here between this and, for example, the Neovim headless server or the VSCode remote SSH daemon? All three listen on 127.0.0.1 and would grant execution access to another process who could s…
Neovim’s server defaults to named pipes or domain sockets, which do not have this issue. The documentation states that the TCP option is insecure. VS Code’s ssh daemon is authenticated.
Good note on pipes / domain sockets, but it doesn't appear there's a "default", and the example in the docs even uses TCP, despite the warning below it.
https://neovim.io/doc/user/api.html#rpc-connecting
(EDIT: I guess outside of headless mode it uses a named pipe?)
> VS Code’s ssh daemon is authenticated.
How is it authenticated? I went looking briefly but didn't turn up much; obviously there's the ssh auth itself but if you have access to the remote, is there an additional layer of auth stopping anyone from executing code via the daemon?
The next few years are going to be a golden age for ops and security overtime
fwiw they should probably slow down a bit, even though they seem to be winning the race. they started selling their own subscription plan last week, and promptly committed all subscriber’s emails to the public repo > Hey - have some bad news. > We accidentally committed your email to our repo as part of a script that was activating OpenCode Black. > No other information was included, just the email on its own.
the sloppers are just a parody of themselves at this point
But this leaves a very bad taste.
Guess I will stick to aider and copy-pasting.
WTF, they not just made unauthenticated RCE http endpoint, they also helpfully added CORS bypass for it... all in CLI tool? That silently starts http server??
Seems that OpenCode is YC-backed as well [0] [1]. I would've thought YC would encourage better cyber security practice than OpenCode have demonstrated here. [0]: https://www.ycombinator.com/companies/sst [1]: https://anoma.ly/
I have no idea where you got your internal image of YC-backed companies from, but it needs massive adjusting.
Earlier quoted context omitted.
Neovim’s server defaults to named pipes or domain sockets, which do not have this issue. The documentation states that the TCP option is insecure. VS Code’s ssh daemon is authenticated.
> Neovim’s server defaults to named pipes or domain sockets, which do not have this issue. The documentation states that the TCP option is insecure. Good note on pipes / domain sockets, but it doesn't appear there's a "default", and the example in the docs even uses TCP, despite the warning below it. https://neovim.io/doc/user/api.html#rpc-connecting (EDIT: I guess outside of headless mode it uses a named pipe?) > VS…
Earlier quoted context omitted.
Good idea. Start sending in some PRs to contribute then.
Unless they've recently invented a shitpost to typescript compiler, I'm afraid I'll have to devote my time elsewhere.