5 ms·

One crucial thing that enabled this work is being able to decompile the enterprise version of the GitHub binary. It makes you think that distributing a binary o

One crucial thing that enabled this work is being able to decompile the enterprise version of the GitHub binary. It makes you think that distributing a binary of your app is either a good idea or bad idea, depending on how you view security. If your app is important though then it’s definitely a good idea.

greatgib 3y ago
At the opposite, thanks to that they now have a safer platform. At the opposite, there could still be nefarious insiders that discover that and abuse of it or resell the exploit for years without anyone noticing. Especially for a proprietary service, as a customer, for me it is an added bonus point to know that the thing can and is battle tested by outsiders...
epcoa 3y ago
> [was] being able to decompile the enterprise version of the GitHub binary. > It makes you think that distributing a binary of your app is either a good idea or bad idea, > If your app is important though then it’s definitely a good idea. I don’t follow. What are you saying would have been the good idea here? It also isn’t clear to me that they required the code except to answer why it works, certainly this parsing defect could be discovered simply by testing the endpoint.
- asimpletune 3y ago
  That distributing a binary app was a good idea. The attacker found and fixed the vulnerability. Of course it wasn't required to find the vulnerability, however if you make it then it's more likely that good guys will find and fix stuff. The contrary would be it's difficult to find this stuff, so then only highly motivated bad guys do it, because at that point 10 grand might not be worth it. Again, this was all prefaced with it depends. Some might see it as making it easier to find problems, and others might say 'yeah, exactly.". It's just an opinion. A fact is however that a binary makes it easier. Source code would be even easier.
  - xboxnolifes 3y ago
    But what alternative are you suggesting? Not having apps?
    - rsanek 3y ago
      if you don't offer a self hosted version you don't have to distribute anything. just force people to use your cloud product

greatgib 3y ago

At the opposite, thanks to that they now have a safer platform. At the opposite, there could still be nefarious insiders that discover that and abuse of it or resell the exploit for years without anyone noticing. Especially for a proprietary service, as a customer, for me it is an added bonus point to know that the thing can and is battle tested by outsiders...

epcoa 3y ago

> [was] being able to decompile the enterprise version of the GitHub binary. > It makes you think that distributing a binary of your app is either a good idea or bad idea, > If your app is important though then it’s definitely a good idea. I don’t follow. What are you saying would have been the good idea here? It also isn’t clear to me that they required the code except to answer why it works, certainly this parsing defect could be discovered simply by testing the endpoint.

asimpletune 3y ago
That distributing a binary app was a good idea. The attacker found and fixed the vulnerability. Of course it wasn't required to find the vulnerability, however if you make it then it's more likely that good guys will find and fix stuff. The contrary would be it's difficult to find this stuff, so then only highly motivated bad guys do it, because at that point 10 grand might not be worth it. Again, this was all prefaced with it depends. Some might see it as making it easier to find problems, and others might say 'yeah, exactly.". It's just an opinion. A fact is however that a binary makes it easier. Source code would be even easier.
- xboxnolifes 3y ago
  But what alternative are you suggesting? Not having apps?
  - rsanek 3y ago
    if you don't offer a self hosted version you don't have to distribute anything. just force people to use your cloud product