Hacker News Reader

tmsbrgon Remote code execution vulnerability in Google they are not willing to fix

From my experience most of these defences take the form of limiting privileges and implementing the four eye principle. Consider the fact he could take over 15 Google developers systems within a few weeks with little effort. What if there's two people who can approve each other's production deployments, etc.?

Even if you only take over one developer's system, it's a great starting point for pivoting into the network and starting a more sophisticated attack. I'm sure an advanced threat actor would know how to take advantage of the opportunity against Google.

tmsbrgon Class-action lawsuit filed against US state agency over mobile 'spyware'

Ah good point. I didn't realise that. I need to look into MicroG again. Any Android running Play Services basically has a massive backdoor.

tmsbrgon Class-action lawsuit filed against US state agency over mobile 'spyware'

Thanks for finding that. The Ars Technica article is actually informative journalism. The The Register article just leaves you confused about what's real and seems to focus more on who's involved than what's happened.

Really creepy that Google is willing to work with governments to force install apps like that. Makes me think nobody should run stock Android.

tmsbrgon Show HN: Xq – command-line XML and HTML beautifier and content extractor

Definitely seconding pup, love it and it's easy to use with css selectors. Often use it to parse HTML tables of data on random websites into usable CSVs / etc.

xq looks interesting for pure XML, will add it to my notes.

Regarding xmlstarlet, I don't use it much but here's some stuff from my notes:

XML filter on xpath: xmlstarlet sel -t -c configuration/appender logback.xml; echo

XML editing: xmlstarlet ed -d configuration/root -d configuration/logger -s configuration -t elem -n woof -v 'Woof!' logback.xml

The last one deletes elements given by xpath "configuration/root" and "configuration/logger", then adds a new element with the contents <woof>Woof!</woof> under the xpath "configuration".

tmsbrgon What happened when my wife died

On Android you can just install Firefox for mobile and install uBlock Origin as usual.

tmsbrgon ‘Sovereign chess’ is a battle without loyalty or humanity (2020)

That would be Diplomacy [0]

Worth trying out online for example through webDiplomacy [1]. It's my favourite game.

[0] https://en.wikipedia.org/wiki/Diplomacy_(game)

[1] https://webdiplomacy.net/

tmsbrgon Signal users can give a recurring monthly contribution

I'm willing to donate, but I don't have a Google account linked to my device, so Google pay is out of the question.

Maybe Mobilecoin will be an alternative in the future that doesn't depend on Google services.

tmsbrgon Kagi: A Premium Search Engine

It seems the trend lately for new services to be built with rather high monthly fees.

From the FAQ: "We plan to offer entry level plans for as low as $10/month, unlimited plan at around $20/mo as well as make bundles (to include Kagi email and other services), family plans and annual payment discounts available."

I have to say I support a lot of these initiatives, but I can't help but think altogether they're creating a division of the web into premium services the rich can afford, and low quality services for the masses. Most of the world doesn't have the silicon valley salaries where $10/month is considered low. I feel like there should be an ideological consideration as well to make better services accessible to as many people as possible. Just my 2 cents.

tmsbrgon An iframe from googlesyndication.com tries to access the camera and microphone

That doesn't protect your microphone from being exposed though.

tmsbrgon A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

I think what he means with historically is before ASLR, DEP, and other mitigations, where a buffer overflow meant you can simply overwrite the return pointer at ESP, jump to the stack and run any shellcode. Mitigations have made exploitation much, much more complex nowadays. See for example https://github.com/stong/how-to-exploit-a-double-free

tmsbrgon “We removed the RSS feed since this technology became obsolete”

https://github.com/Dither/full-text-rss

https://github.com/alrs/full-text-rss-docker

tmsbrgon How to use dig

I never really got why people use `dig`. Its interface and output is awkward, and it seems all of its functionality can be more easily performed with `host`, which doesn't feel the need to print stuff like:

; <<>> DiG 9.16.20 <<>> -r jvns.ca ;; global options: +cmd ;; Got answer:

just try `host goo.gl 1.1.1.1` or `host -t ns google.com` -- it's the output you'd expect without all the verbosity.

tmsbrgon A great organic-food fraud

Another one of those articles that's too long for its own good.

Thought at the title: Fraud, organic food, yes. This must be interesting.

Reading through the start: Okay, here's the life story of someone who's going to do something halfway through this article. Let me check how long this article is.

Jeez. It's gonna be a long read and I still don't get what it's about. I'll pass.

Thought I'd mention this as it's become a common thing in media lately.

tmsbrgon A study of data collection by Android devices

I was curious about the LineageOS, so I checked and found:

"On all of the other handsets the Google Play Services and Google Play store system apps send a considerable volume of data to Google, the content of which is unclear, not publicly documented and Google confirm there is no opt out from this data collection. LineageOS collects no data beyond this data collected by Google and so is perhaps the next most private choice after /e/OS."

So the problem is Play Services and the Play store. Note that /e/OS uses MicroG[0] to replace Play Services so you can still use the many Android apps that require it. It's a really cool project and I think it's amazing how someone is like "Damn, I need a Google account for this app? I'll just write my own account manager to replace Google's!". Really that's the spirit of open source, and I hope more people become empowered to be able to solve problems that way in the future.

I think you can also use MicroG rather than OpenGapps on LineageOS, though I haven't tried and haven't read anything about it. Does anyone have some info about this setup?

[0] https://edevelopers-blog.medium.com/microg-what-you-need-to-...

tmsbrgon Mosh: The Mobile Shell

Hmm, rlwrap[0] is a really nice tool when working with applications that are poor at handling terminal input. It basically handles your keystrokes in rlwrap and whenever you type enter it will send the input line to the application to handle. It's very useful also for application that don't have their own input handling (arrow keys, etc.) or have extreme keystroke latency. It will even give you ctrl+r feature to search commands you typed earlier.

I use it often for pentesting when getting a raw reverse shell. I'll get access to a remote bash session through netcat, and using rlwrap I can do the line editing locally and find the complex commands I've written before without copypaste.

[0] https://linux.die.net/man/1/rlwrap

tmsbrgon Autofill in password managers can allow login credentials to be stolen

They don't need your session cookie either. An attacker can just use XmlHttpRequest to perform any actions as you on the website, and read the web page results. E.g. go to your profile and steal all your personal data.

They can also set up a keylogger or fake login screen and wait for you to type or paste in your password yourself.

I've always thought HttpOnly cookie flag is overrated. Stealing the session cookie may be the easiest attack but it's hardly the only.

tmsbrgon Researchhub: GitHub for Science

Trying to load https://www.researchhub.com/hubs with Google domains disabled in uMatrix causes it to go into some infinite loop of constantly trying to reload everything until my Firefox uses 100% CPU and never loads :(

tmsbrgon Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

This is actually just a Go app which implements SSH using the Go standard library's SSH module. It's not like you're really SSH-ing into a server. See the source: https://github.com/hackclub/jobs

tmsbrgon Babel is used by millions, so why are we running out of money?

Sorry, but as someone who doesn't live in the USA, I have a hard time feeling bad for someone for not being able to earn "$11,000 per month as a baseline salary for working full-time on open source."

Sure, it's nice to be able to make a living from open source based on donations. That doesn't have to be comparable to Silicon Valley salaries that are fueled by huge ad money and other dubious sources. I know many people here are from Silicon Valley so they might even think it's a low salary, but I'd ask you guys to get some perspective.

If I know my donation would be used to fund someone's (in my eyes) incredibly high salary, I'd prefer spending it on somewhere where it would have more impact. You know, people who are actually struggling to make ends meet.

tmsbrgon AI Dungeon public disclosure vulnerability report

You can and should protect GraphQL on the backend. GraphQL will just forward requests to resolvers which actually get the data, these resolvers should see who's logged in and only return data this user has access to. I'd say the security model the AI dungeon GraphQL uses (depending on GraphQL interfaces to protect subfields of objects) is broken. These fields should never be returned to GraphQL by the backend in the first place, if you're not authorized.

tmsbrgon AI Dungeon public disclosure vulnerability report

Considering he had already found and reported this vulnerability before, and then took the time to write this report about it, that's not what happened here. He knew it was a vulnerability, he used it purposely to download private data and he looked into it. Not only could AI dungeon sue him for this, also the owners of the data (the people playing AI dungeon) could.

There have been cases of ethical hackers who found a vulnerability and abused it to download a disproportionate number of records being convicted, at least in the Netherlands. It didn't matter that their goal was just to show it to the website owner. So if you're an ethical hacker reading this, I would strongly advise you to only download the minimum required to demonstrate a vulnerability (preferably your own data, or one record), and not do what this person did.

tmsbrgon Codecov Bash Uploader compromised

Basically what you want is a Docker image static analysis tool in your CICD that rejects your pull request if it seems to contain a secret.

I'm not really sure what would be the best tool for this, but googling got me to https://sysdig.com/blog/20-docker-security-tools/ which has enough scanning tools to research. I don't think any will be foolproof though.

Maybe you can also do what this guy did, use conftest with some OPA rules to detect what seems like a secret: https://cloudberry.engineering/article/dockerfile-security-b...

If your secrets all follow RFC 8959 ( https://tools.ietf.org/html/rfc8959 ) then you could make it fool proof by just searching for secret-token: with the tool from the previous blog post. However I've yet to find a place that uses this RFC for all secrets.

tmsbrgon Firefox 83 introduces HTTPS-Only Mode

Have a look at Let's Encrypt DNS challenge. I created a DNS wildcard certificate for a subdomain I own and use it for all my internal domains. A great way to get HTTPS on non-public networks.

HTTP over VPN is still weaker than HTTPS over VPN. For example HTTPS also handles authentication which HTTP doesn't. If you're outside of your VPN, a MitM could redirect you to http://my-internal-domain.example and resolve its DNS to an attacker's website. Your browser would not understand the difference between this and your actual website in your VPN. It would send all the site's cookies to the evil website, and if Service Workers[1] worked over HTTP, this would actually be a way to completely compromise an internal HTTP website. So it's important not to whitelist such HTTP sites as if they're secure.

[1] https://developer.mozilla.org/en-US/docs/Web/API/Service_Wor...

tmsbrgon Kirc – A tiny IRC client written in POSIX C99

IRC in 307 rules of C code without dependencies, pretty cool. Of course for that to work they had to sacrifice secure TLS support. Based on the "do one thing well" I was thinking you could set up a TLS tunnel from localhost:6667 to <irc-server>:6697

Not really perfect but my WIP attempt using `socat`:

`socat -v tcp-listen:6667,reuseaddr,fork,bind=127.0.0.1 ssl:<irc-server>:6697`

then connect to it:

`./kirc -s 127.0.0.1 -c 'channel' -n 'name' -r 'realname'`

not sure what TLS version socat uses by default, might be something horrible :)

tmsbrgon 10,000 Games projects have been successfully funded on Kickstarter

Without the multiplayer there's OpenMW: https://openmw.org/en/

Without the open world there's DarkPlaces (based on Quake), with games like Xonotic: https://en.wikipedia.org/wiki/Xonotic

Both are really good considering it's hard to make something like this tbh. Not sure if there's anything good that has all 4 of those things, though ;). People often underestimate just how much work game engines are. And also how useless they are without an actual game on them.

tmsbrgon US Announces Withdrawal from TPP

You have to be weary too of the exact meanings, not just how it reads. I remember reading an article from the EFF on the IP provisions which quoted a lot from the then-leaked information. The quotes all sounded quite fair and reasonable if you read them. Things like "countries should attempt to ensure proper protections of the public domain" (don't remember actual quotes, but that was the tone). But the problem was, as the EFF then pointed out, all of the provisions about protecting the people against corporations where just non-binding advice like that, while most of the provisions about protecting corporations from the people were strong and binding. So even if it seems like a reasonable text, if you look at it in a very critical lawyerish way, it could actually be very different.

Then again maybe you did read it that way and still found it not that bad. I admit I didn't read it myself, but then again I'm from Europe so it's not my agreement to check. Still I have some faith in the EFF and other organisations which did read it and found it a dangerous agreement. And I really think it's a good thing that it's now harder to negotiate trade agreements in secret. It doesn't matter what the traditional way to negotiate these was, they have a big impact on the countries that implement them, and people deserve more than just a (representative) YES/NO to a huge number of potentially life-changing provisions at once.

tmsbrgon Giteveryday – A useful minimum set of commands for Everyday Git

That does look a lot better! Bit weird that the main client requires Node.JS though.

tmsbrgon Giteveryday – A useful minimum set of commands for Everyday Git

I have the idea of creating a tool which is more like a tutorial for commands rather than the reference that `man` is. Has anyone made something like that before?

I thought of giving it a name like `tutor`. Where you can use it without arguments for a general shell tutorial and with arguments for a mini-tutorial about a command

$ tutor

Welcome to the Bash command shell. This is a short tutorial about how (and why) to use the shell...

$ tutor ls

Use `ls` to view files in the current directory or one you specify. Examples:

- ls

Lists current directory (excluding files starting with a ., these are "hidden files")

- ls -A

Lists current directory including hidden files ... ===

Something like that at least. I think one of the worst things about the shell is finding out about the functionality there actually is, so having something like that built in could be handy. Maybe you could also have it do something like `tutor copy file` and have it find and list commands that fit the description.