4 ms·
I really don’t get it. You’re running their code, whether it prints an ad or not. There’s no need for “injection attacks and escape sequences” at that point.
by ryanlol 7y ago
I really don’t get it.
You’re running their code, whether it prints an ad or not. There’s no need for “injection attacks and escape sequences” at that point.
- ben509 7y agoIf someone, for instance, takes control of their repo, then they can upload whatever they like. But that auth can be fairly securely guarded, and it's probably a very hard to do it quietly as packages are signed. But now they're hosting the ads and potentially allowing remote code execution. Now the attacker only needs to get on to a webserver to deploy a payload. That's why it opens a new vector of attack. Moreover, if they're able to own the server quietly, they can be deploying whatever they like to a ton of people over time.
- ryanlol 7y agoAll of the terminal ads I’ve seen have been nothing like you suggest. They’ve looked like echo “Hi please send me money”