3 ms·
Very neat, I love it, I used to have a tool to do this but it's been ages and is now unmaintained. Just be sure to do input santization, since if someone else
by dontbenebby 4y ago
Very neat, I love it, I used to have a tool to do this but it's been ages and is now unmaintained.
Just be sure to do input santization, since if someone else uses your code it could go from a very cool project to a backdoor that ends up on the front page for all the wrong reasons :-)
- sandreas 4y ago> Very neat, I love it, I used to have a tool to do this but it's been ages and is now unmaintained. Thank you :-) Glad to hear that. > Just be sure to do input santization, since if someone else uses your code it could go from a very cool project to a backdoor that ends up on the front page for all the wrong reasons :-) Good point. I think that the "scriptable" part needs special care regarding security issues, as well as the metadata-readers and JSON parsers. I don't want that to bite me in the neck because of a "malicious" file. Maybe it is worth to provide a responsible disclosure email and make a plan for security issues. See https://github.com/sandreas/tone/issues/12 https://github.com/sandreas/tone/issues/12
- dontbenebby 4y agoSounds like you're detail oriented, good luck with your project. Here's a good starting point for reading about common meta level patterns in software vulnerabilities so you can avoid reinventing the wheel https://owasp.org/Top10/ https://owasp.org/Top10/
- sandreas 4y ago> Sounds like you're detail oriented, good luck with your project. Yeah that may be true... :-) Good old owasp will help out here. Thanks for your feedback, I really appreciate it.
- dontbenebby 4y agoNo worries, gotta do something while a big software update installs and my laptop charges (other than talk the barista's ear off, hehe)