4 ms·

> They can just add something like require('fs').readFileSync(process.env.HOME + '/.ssh/id_rsa').toString() And that is why you encrypt your SSH keys with a pa

by crgwbr 7y ago

> They can just add something like require('fs').readFileSync(process.env.HOME + '/.ssh/id_rsa').toString() And that is why you encrypt your SSH keys with a passphrase, use a Keychain, etc. Discord isn’t unique in its ability to read file on the FS. Pretty much anything can do that.

ubercow13 7y ago
Does that really help much? It still has access to .bash_profile
- crgwbr 7y ago
  What secrets are you putting in your bash profile? I used to be guilty of putting AWS keys in there, I guess, but nowadays we have aws-vault.
  - ubercow13 7y ago
    For example it could register a fake ssh-agent that just grabs your password first time you type it
clarry 7y ago
> Pretty much anything can do that. Nah, pretty much anything except proprietary software has a higher chance of being written by people I trust and packaged by people I trust and probably audited by me and other people, and is not capable of loading executable code from any server after installation.