How to gain code execution on hundreds of millions of people and popular apps
1–10 of 350 posts
Re: How to gain code execution on hundreds of millions of people and popular apps
#2[flagged]
Re: How to gain code execution on hundreds of millions of people and popular apps
#3Dave here, founder of ToDesktop. I've shared a write-up: https://www.todesktop.com/blog/posts/security-incident-at-to...
This vulnerability was genuinely embarrassing, and I'm sorry we let it happen. After thorough internal and third-party audits, we've fundamentally restructured our security practices to ensure this scenario can't recur. Full details are covered in the linked write-up. Special thanks to Eva for responsibly reporting this.
Re: How to gain code execution on hundreds of millions of people and popular apps
#4[flagged]
Why does it use Neko the cursor chasing cat? Why the goth color scheme? These are stylistic choices, there is no explaining them.
Re: How to gain code execution on hundreds of millions of people and popular apps
#5[flagged]
just the style of their blog
Re: How to gain code execution on hundreds of millions of people and popular apps
#6My goodness. So much third-party risk upon risk and lots of external services opening up this massive attack surface and introducing this RCE vulnerability.
From an Electron bundler service, to sourcemap extraction and now an exposed package.json with the container keys to deploy any app update to anyone's machine.
This isn't the only one, the other day Claude CLI got a full source code leak via the same method from its sourcemaps being exposed.
But once again, I now know why the entire Javascript / TypeScript ecosystem is beyond saving given you can pull the source code out of the sourcemap and the full credentials out of a deployed package.json.
Re: How to gain code execution on hundreds of millions of people and popular apps
#7[flagged]
it’s a blog. people regularly use their personal sites to write in a tone and format that they are fond of. i only normally feel like i see this style from people who were on the internet in the 90s. i’d imagine we would see it even more if phones and auto correct didn’t enforce a specific style. imagine being a slave to the shift key. it can’t even fight back! i’m more upset the urls aren’t actually clickable links.
Re: How to gain code execution on hundreds of millions of people and popular apps
#8Re: How to gain code execution on hundreds of millions of people and popular apps
#9Dave here, founder of ToDesktop. I've shared a write-up: https://www.todesktop.com/blog/posts/security-incident-at-to... This vulnerability was genuinely embarrassing, and I'm sorry we let it happen. After thorough internal and third-party audits, we've fundamentally restructured our security practices to ensure this scenario can't recur. Full details are covered in the linked write-up. Special thanks to Eva for resp…
> cannot happen again.
Hubris. Does not inspire confidence.
> We resolved the vulnerability within 26 hours of its initial report, and additional security audits were completed by February 2025.
After reading the vulnerability report, I am impressed at how quickly you guys jumped on the fix, so kudos. Did the security audit lead to any significant remediation work? If you weren't following PoLP, I wonder what else may have been overlooked?
Re: How to gain code execution on hundreds of millions of people and popular apps
#10[flagged]
its cool. not everything has to be typed in a "normal" way.