6 ms·

>The Signal devs thought $.html() does some kind of escaping: Uhm... that's a really rookie mistake to make. Like, one of the very basics of jQuery usage. I'm

>The Signal devs thought $.html() does some kind of escaping: Uhm... that's a really rookie mistake to make. Like, one of the very basics of jQuery usage. I'm not exactly sure what to think about it after seeing this commit you linked...

twr 9y ago
I don't know if this is correct, but, I once got the impression that Signal Desktop was under the sole purview of a new hire at OWS. In other words, Moxie doesn't review the commits. I hope I'm wrong, but even if I'm not, I suppose it makes no difference, as he's arguably responsible either way.
- debacle 9y ago
  Isn't this supposed to be an app for secure communication? Theo would have a conniption.
  - fjsolwmv 9y ago
    Has Theo de Raadt ever endorsed the security of anything except the default install of OpenBSD?
ddtaylor 9y ago
The worst part is that someone assumed something then removed the code that did the escaping without even doing the most basic of tests, like even in the browser just doing a quick foo.html('<script>alert("oh snap this is bad")</script>')
- deleted 9y ago
  [deleted]
- deleted 9y ago
  [deleted]
- icebraining 9y ago
  Maybe he did and it didn't work for some reason and he thought it was good. Shit happens. I think the most worrying part is not having been caught in code review. Signal does code review, right?
- Cakez0r 9y ago
  Even worse than that, it looks like there _were_ unit tests to check that input was correctly sanitized, but the patch that introduced the bug also explicitly changed the unit tests to ensure that input was _not_ being escaped! A mistake that seems like it could've been caught in a code review!
  - ddtaylor 9y ago
    These are the kinds of things that make tinfoil hats wonder if any agencies interested in subverting encryption "plant" employees. It's difficult to differentiate stupidity from malice. We know they use shell companies and subvert device manufacturers and standards, so it's not unfathomable.

twr 9y ago

I don't know if this is correct, but, I once got the impression that Signal Desktop was under the sole purview of a new hire at OWS. In other words, Moxie doesn't review the commits. I hope I'm wrong, but even if I'm not, I suppose it makes no difference, as he's arguably responsible either way.

debacle 9y ago
Isn't this supposed to be an app for secure communication? Theo would have a conniption.
- fjsolwmv 9y ago
  Has Theo de Raadt ever endorsed the security of anything except the default install of OpenBSD?

ddtaylor 9y ago

The worst part is that someone assumed something then removed the code that did the escaping without even doing the most basic of tests, like even in the browser just doing a quick foo.html('<script>alert("oh snap this is bad")</script>')

deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
icebraining 9y ago
Maybe he did and it didn't work for some reason and he thought it was good. Shit happens. I think the most worrying part is not having been caught in code review. Signal does code review, right?
Cakez0r 9y ago
Even worse than that, it looks like there _were_ unit tests to check that input was correctly sanitized, but the patch that introduced the bug also explicitly changed the unit tests to ensure that input was _not_ being escaped! A mistake that seems like it could've been caught in a code review!
- ddtaylor 9y ago
  These are the kinds of things that make tinfoil hats wonder if any agencies interested in subverting encryption "plant" employees. It's difficult to differentiate stupidity from malice. We know they use shell companies and subvert device manufacturers and standards, so it's not unfathomable.