4 ms·
This is neat, but the complete lack of access control (UDP) just doesn't seem prudent in 2016.
by FullyFunctional 10y ago
This is neat, but the complete lack of access control (UDP) just doesn't seem prudent in 2016.
- josho 10y agoI assume it binds to the loop back interface so that other hosts can't send messages. Regardless UDP interface does seem odd for this sort of tool. Edit: nope. It listens on all interfaces. At least an attack can only maliciously change your menubar colour.
- cyphar 10y agoI just started reading the code. I don't write Objective-C, but it looks to me as though it will have some vulnerabilities with how it opens images for the dots (but maybe its some sort of resource opening thing that doesn't have the usual path escape vulnerabilities).
- scott_karana 10y agoWell, assuming the syntax for calling local files isn't breakable by using "../square" to open executables with JPEG extensions too... ;)
- tonsky 10y agoI think you shouldn’t open random UDP ports to outside world in the first place