4 ms·

Why is this flagged?

by tlrobinson 8y ago

on_and_off 8y ago
Same question. Also, is there somewhere where we can see why a thread is flagged ?
- tlrobinson 8y ago
  Unfortunately there's no way to know why users flag something, but that brings up an interesting idea: in order to flag something require the user types out a reason, and if an article is flagged it could show why people flagged it.
verroq 8y ago
Probably signal-desktop devs in full damage control mode over their bloated electron abomination. Upvote the thread to counter the flagging.
geofft 8y ago
I usually have a "vouch" button but I can't find it - maybe I don't have it on posts and only on comments?
ddtaylor 8y ago
I had the same question, the title seemed generous considering this was technically a RCE exploit. EDIT It also appears lots of comments just got hit with a wave of downvotes. It's possible there is some brigading or vote manipulation.
Ceezy 8y ago
Because the discution is already a flame war. I feel like everybody has a solution. Try not to get burn because JS is bad! a sorry electron is terrible! No innerhtml is a sin!
- verroq 8y ago
  I thought we already accepted that JS is bad. It is objectively a bad language, with the weak typing, quirky edge cases and a hundred bad libraries, and some backdoored ones available on npm as well. We've also accepted that Electron is bad, we don't need native applications that bundle Chrome so they can run JavaScript. It's a bloated memory haemorrhaging mess pretending to be a cross platform framework. And if that wasn't bad enough, we have JavaScript developers who know nothing about security, writing a supposedly "secure" desktop app where a XSS is now a RCE. We've come such a long way that browsers can now almost securely execute JavaScript and you're telling me that a 2018 "secure" chat messaging desktop application has a RCE from a XSS in the messaging feature. It sends and receives text to other people for god's sake. Myspace wasn't even this bad and it didn’t pretend it was secure. It is absolute lunacy. I won't be surprised that the Signal desktop brand is completely ruined by all this fallout because these are just rookie mistakes compounded on rookie mistakes.

Why is this flagged?

on_and_off 8y ago

Same question. Also, is there somewhere where we can see why a thread is flagged ?

tlrobinson 8y ago
Unfortunately there's no way to know why users flag something, but that brings up an interesting idea: in order to flag something require the user types out a reason, and if an article is flagged it could show why people flagged it.

verroq 8y ago

Probably signal-desktop devs in full damage control mode over their bloated electron abomination. Upvote the thread to counter the flagging.

geofft 8y ago

I usually have a "vouch" button but I can't find it - maybe I don't have it on posts and only on comments?

ddtaylor 8y ago

I had the same question, the title seemed generous considering this was technically a RCE exploit. EDIT It also appears lots of comments just got hit with a wave of downvotes. It's possible there is some brigading or vote manipulation.

Ceezy 8y ago

Because the discution is already a flame war. I feel like everybody has a solution. Try not to get burn because JS is bad! a sorry electron is terrible! No innerhtml is a sin!

verroq 8y ago
I thought we already accepted that JS is bad. It is objectively a bad language, with the weak typing, quirky edge cases and a hundred bad libraries, and some backdoored ones available on npm as well. We've also accepted that Electron is bad, we don't need native applications that bundle Chrome so they can run JavaScript. It's a bloated memory haemorrhaging mess pretending to be a cross platform framework. And if that wasn't bad enough, we have JavaScript developers who know nothing about security, writing a supposedly "secure" desktop app where a XSS is now a RCE. We've come such a long way that browsers can now almost securely execute JavaScript and you're telling me that a 2018 "secure" chat messaging desktop application has a RCE from a XSS in the messaging feature. It sends and receives text to other people for god's sake. Myspace wasn't even this bad and it didn’t pretend it was secure. It is absolute lunacy. I won't be surprised that the Signal desktop brand is completely ruined by all this fallout because these are just rookie mistakes compounded on rookie mistakes.