3 ms·
Uh. Ok. "I was able to find and fix this issue only because I could see the source code." This is how all security issues happen. If I was as terrible person, i
by ransom1538 8y ago
Uh. Ok. "I was able to find and fix this issue only because I could see the source code." This is how all security issues happen. If I was as terrible person, i would create scripts that pray upon people that didnt' patch.
- nebulous1 8y agoPeople find vulnerabilities in closed source software too, they just don't have the source to patch it.
- deathanatos 8y agoActually, I think there are cases where people have patched closed source software. Binary patches are possible, just harder to write. (Not trying to say you're wrong: it's definitely easier if one has the source. Only that some humans are both determined and skilled, and some incredible stuff comes from that combination.) IIRC, there was a flaw in Flash patched in this manner; it was using memcpy(), which requires the source and destination regions to not overlap, but, they did. In this case, it's fairly simple: one just needs to call memmove(), which conveniently takes the same args in the same order. (IIRC, there was a lot of consternation getting Adobe to fix that properly, given how obvious the bug was.)
- myWindoonn 8y agoGo for it. Be a "terrible person". Write PoCs. It wouldn't be any worse than your attitude here. In addition, you'll enrich the ecosystem, and you might even learn something. Edit: Oh, and surely you meant that you would do it if only you were a terrible person.