3 ms·
> [was] being able to decompile the enterprise version of the GitHub binary. > It makes you think that distributing a binary of your app is either a good idea
by epcoa 3y ago
> [was] being able to decompile the enterprise version of the GitHub binary.
> It makes you think that distributing a binary of your app is either a good idea or bad idea,
> If your app is important though then it’s definitely a good idea.
I don’t follow. What are you saying would have been the good idea here?
It also isn’t clear to me that they required the code except to answer why it works, certainly this parsing defect could be discovered simply by testing the endpoint.
- asimpletune 3y agoThat distributing a binary app was a good idea. The attacker found and fixed the vulnerability. Of course it wasn't required to find the vulnerability, however if you make it then it's more likely that good guys will find and fix stuff. The contrary would be it's difficult to find this stuff, so then only highly motivated bad guys do it, because at that point 10 grand might not be worth it. Again, this was all prefaced with it depends. Some might see it as making it easier to find problems, and others might say 'yeah, exactly.". It's just an opinion. A fact is however that a binary makes it easier. Source code would be even easier.
- xboxnolifes 3y agoBut what alternative are you suggesting? Not having apps?
- rsanek 3y agoif you don't offer a self hosted version you don't have to distribute anything. just force people to use your cloud product