3 ms·
> Paint features as security vulnerabilities. Example: your "arbitrary command execution tool" can "execute arbitrary commands" This is pretty funny to me. I
by px43 6y ago
> Paint features as security vulnerabilities. Example: your "arbitrary command execution tool" can "execute arbitrary commands"
This is pretty funny to me.
I live on the other side of this, and let me tell you, what you don't often hear, and what we legally can't tell you, is that there are dozens of financial institutions running your "command execution as a service" tool open to the internet with default admin creds because they think it's a simple uptime monitor.
I have broken into multiple Fortune 500 companies using these sorts of bugs, and because I actually do want to live in a world where people can trust their technology, I do the right thing and report them. These bugs often get de-prioritized, or closed as WONTFIX because they're only applicable in really obscure situations that would never happen in the real world.
My favorite example of this happening is when Homokov was trying to get mass assignment disabled by default, and his issues on GitHub kept getting closed because it was a feature, and only an idiot would screw up mass assignment, so he exploited a mass assignment bug in GitHub to create an issue from 1000 years in the future warning the past about letting mass assignment bugs persist. Since it was from the future, it was always on top of the issues list, serving as a constant reminder to the rails developers that their security posture is a joke.
- franciscop 6y agoWell and SQL injection is still #1 security vulnerability AFAIK. Do we mark any script that can run an arbitrary SQL query as "vulnerable"? Or educate the devs to not concatenate strings from untrusted inputs and instead either validate the text or use named parameters? If you want powerful tools these are also dangerous. Sure we should try to make our libraries as safe as possible and pick the safer version everything being the same, but everything is not the same. "there are dozens of financial institutions running your "command execution as a service" tool open to the internet with default admin creds because they think it's a simple uptime monitor" that's 9 out of 10 on the companies' side in my experience (except for the "default admin creds", which we all know should be prompted/created on the first run).
- cratermoon 6y ago> educate the devs to not concatenate strings from untrusted inputs What if the dev is the CTO? https://arstechnica.com/gadgets/2021/03/rookie-coding-mistake-prior-to-gab-hack-came-from-sites-cto/ https://arstechnica.com/gadgets/2021/03/rookie-coding-mistak...
- PradeetPatel 6y agoThe CTO is still susceptible to mistakes, when that happens they must also be challenged. Of course, you can't just simply reject a PR from the CTO. Getting them to change their ways often require delicate skills in key stakeholder management and re-aligning them with core company vision.