Hacker News Reader

Comment by mushufasa | Hacker News Reader

> The databases used in TeaTime are GitHub repositories tagged with the teatime-database topic, which are published on GitHub Pages.

Couldn't this be a security issue, for a bad actors to use this tag?

View on HN

That's a fair point - I guess it could be abused. Databases are sorted by their number of GitHub stars, so I was hoping that with the power of the crowds it will be possible to minimize the bad effect such actor might have, by simply not voting them up.

there's been several attacks recently where a bad actor takes over a repo where the original maintainer wants to take a step back, then launch a supply chain attack. in recent cases, the attack came from obfuscated binary files in the repo rather than code. given we are dealing with documents here (books) that would be easy to hide malicious code in a file. pdfs have all sorts of execution vulnerabilities for example

PDFs are not executables.

You’d be surprised what’s executable with the right attitude.

May I recommend the old 27C3 talk "OMG WTF PDF"?

Other than the JavaScript, you mean.

https://cloudmersive.com/article/Understanding-Embedded-Java...

Interesting - I'm kinda counting on PDF.js, which is used for PDF rendering, on doing it safely, but of course that doesn't always have to be the case. Do you have any thoughts on how to make this safer?

some other method of collection where you can hav eknown trust of the files contributed, some method of 'registering' a submission to create trust,

Reply on news.ycombinator.com