3 ms·
Very nice project, a lot of times I wished there was something to start a server for a quick ssh/ping/traceroute/debug from outside my network. Well done! A f
by emilburzo 10y ago
Very nice project, a lot of times I wished there was something to start a server for a quick ssh/ping/traceroute/debug from outside my network.
Well done!
A few security aspects that I've noticed so far:
- calling the action(s) with an id that doesn't exist will show a pretty useful stacktrace, it should probably be disabled for production
- calling the action(s) with ids close to my server, I can do things to other people's servers (presumably, I didn't confirm the action for any of those, but I can at a minimum see what others have named their servers)
Not trying to be abusive, I just want to make sure we find the security bugs before the bad guys do, because I really like what you've built here.
- OwainX 10y agoThanks. We also received a ticket about these issues and have deployed fixes. You discover all kinds of things when you go from 15 users to 700 in a matter of an hour or two :)