4 ms·
I'm amazed by how profoundly stupid this vulnerability is. To get arbitrary code execution, you literally just send somebody else's user ID, which is fairly tr
by ARandomerDude 2y ago
I'm amazed by how profoundly stupid this vulnerability is. To get arbitrary code execution, you literally just send somebody else's user ID, which is fairly trivial to obtain.
I don't work at FAANG. I just work at some company that makes crap products you don't actually need, and even I would never build this kind of bug.
But these people want to build a web browser, with all the security expertise and moral duty that implies?! Wow.
- deleted 2y ago[deleted]
- bilater 2y agoCan you explain how you could get someone else's user id? I get that this is still a big vulnerability but am trying to understand how that would happen.
- darthwalsh 2y agoIt says in the article. If you share one of your snippets, or make/accept a friend request, that all uses the same id
- bilater 2y agoah gotcha thanks