5 ms·
I posted about another macOS app called “Dropshare.app” a few days ago [1]. I didn’t bother to write a blog post about it because my English is not good enough
by guessmyname 7y ago
I posted about another macOS app called “Dropshare.app” a few days ago [1].
I didn’t bother to write a blog post about it because my English is not good enough.
Basically, anyone who uses this app is vulnerable to cross-infection and data leaks. Assume that user John installed this app, then hacker Alice tricked John to visit their malicious website. In this website, they added code that sends requests to “http://localhost:34344/upload” http://localhost:34344/upload” to upload malicious files to any of the services that John’s computer is connected to via Dropshare, this includes private servers via SSH, Amazon S3, Rackspace Cloud Files, Google Drive, Backblaze B2 Cloud Storage, Microsoft Azure Blob Storage, Dropbox, WeTransfer, and custom Mac network connections. The port number is also static, saving the hacker the need to run a port scanner.
I already contacted Dropshare’s developers to fix the issue, but got not response.
[1] https://news.ycombinator.com/item?id=20399551 https://news.ycombinator.com/item?id=20399551
- pavel_lishin 7y agoYour English seems fine.
- jonshariat 7y agoAgreed and honestly blog posts these days need to use more basic english and not go on and on in a long post. Think of it as long form tweeting!
- edraferi 7y agoTechnical writing should be clear and concise. Always try to convey your core idea as directly as possible. Here are some resources I find useful for this: http://www.hemingwayapp.com/ http://www.hemingwayapp.com/ https://www.plainlanguage.gov/guidelines/ https://www.plainlanguage.gov/guidelines/ I’m intrigued by https://www.grammarly.com/ https://www.grammarly.com/ but it sends everything you write to their cloud service, which is completely unacceptable to me. If I can’t use the tool for proprietary and private writing, it’s useless.
- KingFelix 7y agois your name Robert Paulson? Agreed with the other comments, this comment = blog, looks like you know what you're talking about, short, to the point. Good find, and thanks for sharing off topic comment: For all, what are people blogging on these days? I am not too fond of Medium, but I just got into Ghost and really liking it. It seems like a great short post / resource to write something. I have it installed on a cheap DO server, plain text like lapcat?
- anderspitman 7y agoI host my own. I think basically any of the popular static site generators[0] on a droplet or netlify are a great option. [0] https://www.staticgen.com/ https://www.staticgen.com/
- jsilence 7y agoAlso https://write.as https://write.as seems to be a nice and federated alternative to Medium. Host your own if you don't like the pricing?
- icelancer 7y ago>> I didn’t bother to write a blog post about it because my English is not good enough. Basically everyone who says this has better English than most American technical developers. We appreciate your modesty, but please, write it up :)
- asavadatti 7y agoCommunicating in a non-native language is difficult even if you know it well. It doesn't come naturally and is taxing on the brain
- icelancer 7y agoFair enough. I definitely understand that. Don't go out of your way if it's too much work, but everyone thinks your English is quite clear.
- segmondy 7y agoThen write it up in your native language first then translate or ask for help in translating.
- tehlike 7y agoThat is one hell of a way to improve it though. I wrote lame articles years ago, to explain technical work i did on castle and nhibernate. Made me better over time.
- abdusco 7y agoCertainly. I'm a non-native speaker myself and although the end result looks somewhat convincing, it takes me an inordinate amount of time to write, look up words and proofread the text. I'd guess a native would come up with a comprehensible text at the first try, and it'd take a few tweaks until it looks immaculate. The reason non-natives seem to write better is that we simply spend more time working on it, and fix a lot of mistakes. Just now, writing this, I had to look up if the saying went "inordinate amount" or "unordinate amount". The difference between "pristine" and "immaculate". It really adds up when writing longer texts.
- sdoering 7y agoPlease write something. Even something short. This way I could share it into our #security channel and warn others, if they use this.
- wolf4earth 7y agoI actually know the people behind Dropshare. They are former colleagues of mine. Maybe I can get you in touch?
- henvic 7y agoThis comes up way more often than we imagine. I found a malware on a JavaScript errors notifications for Chrome in 2015 that affected 86k users and the developer was mad because apparently he made some money out of it (I was called a paranoyd). The malware basically logged your accessed URLs and solt it to a statistics service called Fairshare. https://news.ycombinator.com/item?id=10309432 https://news.ycombinator.com/item?id=10309432
- amingilani 7y agoPlease write it in your native language. HN trending articles can be translated articles too.[0] Edit: I guess not, see Dang's reply below. [0]: https://news.ycombinator.com/item?id=20402070 https://news.ycombinator.com/item?id=20402070
- dang 7y agoJust on the HN point: we usually penalize those submissions and ask people not to do it. I'm sure guessmyname can write a fine post in English.
- oplav 7y agoIs Dropshare's CORS policy allowing all origins?