4 ms·

I don't see what the fuss is about. This all looks pretty standard. I use random people's stuff all the time. Isn't that the point of open source? Did you find

I don't see what the fuss is about. This all looks pretty standard. I use random people's stuff all the time. Isn't that the point of open source? Did you find something malicious in the random GitHub repo? If so, you should write an article about that instead.

xocnad 7mo ago
All good for you to make those choices for yourself. Your response seems to be show ignorance of all the recent supply chain attacks that have occurred. You can imagine that given the situation with the shoe gifts that many high up members of the administration and cabinet members are running this app.
- trimethylpurine 7mo ago
  I'm critical of the author. I'm well aware of supply chain attacks. But this isn't a supply chain attack. If it were, the article would be way more interesting. The supply chain attack articles are interesting exactly because this is so common. So what's special here other than it being loosely related to a disliked political figure? HN isn't supposed to be an especially political website. "A common app is doing the same thing that basically every other app is doing." Is that a good headline? No. And this isn't a good article.
  - xocnad 7mo ago
    > I'm well aware of supply chain attacks. But this isn't a supply chain attack. If it were, the article would be way more interesting. It's an article that includes coverage of the exposure to supply chain attacks, mainly via directly linking in https://lonelycpp.github.io/react-native-youtube-iframe/iframe_v2.html https://lonelycpp.github.io/react-native-youtube-iframe/ifra.... You seem to be flippantly dismissing this as insignificant given the people who are probably running this app. > HN isn't supposed to be an especially political website. Yes but when technology and politics cross paths...
    - trimethylpurine 7mo ago
      There's nothing you could exploit here. There's nothing special about this app. This article is about nothing. Not politics and not technology. If you enjoy reading about how a guy smelled another guy's underpants and discovered that they smell like everyone else's, then rest assured, you can continue reading it over and over again if you like. I'm not able to down vote, so your enjoyment is safe from my opinion. If he finds something interesting in there (I hope he does), and writes another article I might miss it, unfortunately, because I've written him off as a trash piece author. EDIT: I went to use this as an example. Hilarious, this blog now has a bad SSL cert, just to put the icing on the cake.
rendx 7mo ago
I don't know if you're being serious or not, but in case you are: There is a difference between (re)using other people's open sourced code, hopefully reviewed, and giving anyone in control of the third party repository the ability to run arbitrary code on your user's devices. Even if the "random GitHub repo" doesn't contain any malicious code right now, it may well contain some tomorrow.
- torstenvl 7mo ago
  Completely agree. This is really unique. Can you imagine if it were standard practice to be open to supply chain attacks like that, by blindly relying on hotlinked or unpinned dependencies?
  - trimethylpurine 7mo ago
    Why imagine? Let's take a quick look at what's actually happening right now. We can check some widely used libraries and see what their instructions are teaching new developers. Boostrap (code snippet from their quick start instructions): ``` <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>Bootstrap demo</title> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/css/bootstrap.min.css https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/css/bootst..." rel="stylesheet" integrity="sha384-sRIl4kxILFvY47J16cr9ZwB07vP4J8+LH7qKQnuqkuIAvNWLzeN8tE5YBujZqJLB" crossorigin="anonymous"> </head> <script src="https://cdn.jsdelivr.net/npm/@popperjs/core@2.11.8/dist/umd/popper.min.js https://cdn.jsdelivr.net/npm/@popperjs/core@2.11.8/dist/umd/..." integrity="sha384-I7E8VVD/ismYTF4hNIPjVp/Zjvgyol6VFvRkX/vR+Vc4jQkC+hVqc2pM8ODewa9r" crossorigin="anonymous"></script> <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/js/bootstrap.min.js https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/js/bootstr..." integrity="sha... ``` Pay close attention, they are inviting the new developer to link not just to Bootstrap, but to Popper! HTMX (code snippet from their quick start guide): ``` <script src="https://cdn.jsdelivr.net/npm/htmx.org@2.0.8/dist/htmx.min.js"></script>  <button hx-post="/clicked" hx-swap="outerHTML"> Click Me </button> ``` Fontawesome: A video quick start guide and instructions that recommends using the direct link to the kits via CDN for performance! Look, I certainly don't think they should be used this way. But, to say that it's unique to the White House app? I definitely wouldn't say that. In fact, I think you've dangerously overestimated the status quo.
kevinsync 7mo ago
Using somebody's stuff is different than hot-linking directly to a hosted version of it, even just from the perspective that dude could delete it at any time and break the whole app.
- trimethylpurine 7mo ago
  That's fair. I download and embed, personally. Still, it's not a rant worthy mistake, honestly. Suggest a better approach, sure.
  - array_key_first 7mo ago
    It's definitely a rant worthy mistake because this would literally never happen in any professional app anywhere. This is a supply chain risk.
    - trimethylpurine 7mo ago
      Microsoft? Okta? JetBrains? If these are amateurs, who is a professional developer? https://www.encryptionconsulting.com/top-10-supply-chain-attacks-that-shook-the-world/ https://www.encryptionconsulting.com/top-10-supply-chain-att... Are you aware that common libraries like Bootstrap, FontAwesome, and HTMX walk developers through linking to their CDNs directly? In fact, FontAwesome recommends it for CDN performance. I think you're dangerously mistaken if you believe that it "literally never" happens. It literally does happen all the damned time. And, for your own safety and others', you should assume that when you use any app for which you don't have the source code.
      - array_key_first 7mo ago
        Linking to a CDN is for development only. Once the app is build you build your dependencies into the app. You don't fetch them at runtime and run them. Not only for security, but also for performance. There's also a difference between using a CDN for, say, React and a random github project hosted by some dude.
input_sh 7mo ago
It's always a better idea to make a local copy of it. Imagine they're downloading a project directly from your GitHub account. Even if you're not doing anything malicious and have no intention of doing anything malicious even after you've been aware of this, now all of a sudden your GitHub account / email is a huge target for anyone that wants to do something malicious.
rpdillon 7mo ago
The dependencies weren't vendored, meaning their behavior can change at any time if a malicious actor gains control of that third-party repo. This is bad for security.
- trimethylpurine 7mo ago
  Yes, I agree. And it's sadly, as we can see, still fairly standard practice to ignore it.
gitaarik 7mo ago
For an Android game downloaded from the Play store I wouldn't find these findings surprising at all. But from an official app from the White House? Well ok, from THIS White House - you're completely right to expect that.
- trimethylpurine 7mo ago
  Lol, this is a really funny take. I'm imagining Joe Biden or George Bush asking, "did you check it for supply chain vulnerabilities?" The DoD has been hacked countless times, by children even. I wouldn't doubt if we decompiled most government apps we'd find this same vector in many of them. It seems like this vector is only recently a hot topic. And decades of doing things wrong won't be patched and habits broken in short time. It will take a few years to get the majority of it, and decades after that to get the next majority, and so on.
  - gitaarik 7mo ago
    I agree that governments in general are very bad at this. But I also think that this admistration is even more special in it's own way.
    - trimethylpurine 7mo ago
      Okay, great! So post a piece that criticizes Trump. This one failed to do that. And that makes it stink of fanaticism (which is annoying to rational folks).
      - gitaarik 7mo ago
        Come on, you're defending a sinking ship ;). Trump might be right about a lot of things, but that doesn't make him right about everything. And he and his whole administration pretends he is. And it's just pathetic and laughable how they try to keep denying how their decisions where maybe not always the wisest or most responsible. I think that is just very unprofessional, and just plainly simply childish. And I think it's becoming more and more clear that that is actually the way it is. The worse it gets the more they go in denial and the more they blame the woke democrats for everything that's their failures. They just don't know what responsibility is and only know how to turn around the narrative to blame others and to make it seem like they're the best ever. You just can't make this stuff up. But I'm actually enjoying it, because they're falling now and they're gonna fall hard. Interesting times.

xocnad 7mo ago

All good for you to make those choices for yourself. Your response seems to be show ignorance of all the recent supply chain attacks that have occurred. You can imagine that given the situation with the shoe gifts that many high up members of the administration and cabinet members are running this app.

trimethylpurine 7mo ago
I'm critical of the author. I'm well aware of supply chain attacks. But this isn't a supply chain attack. If it were, the article would be way more interesting. The supply chain attack articles are interesting exactly because this is so common. So what's special here other than it being loosely related to a disliked political figure? HN isn't supposed to be an especially political website. "A common app is doing the same thing that basically every other app is doing." Is that a good headline? No. And this isn't a good article.
- xocnad 7mo ago
  > I'm well aware of supply chain attacks. But this isn't a supply chain attack. If it were, the article would be way more interesting. It's an article that includes coverage of the exposure to supply chain attacks, mainly via directly linking in https://lonelycpp.github.io/react-native-youtube-iframe/iframe_v2.html https://lonelycpp.github.io/react-native-youtube-iframe/ifra.... You seem to be flippantly dismissing this as insignificant given the people who are probably running this app. > HN isn't supposed to be an especially political website. Yes but when technology and politics cross paths...
  - trimethylpurine 7mo ago
    There's nothing you could exploit here. There's nothing special about this app. This article is about nothing. Not politics and not technology. If you enjoy reading about how a guy smelled another guy's underpants and discovered that they smell like everyone else's, then rest assured, you can continue reading it over and over again if you like. I'm not able to down vote, so your enjoyment is safe from my opinion. If he finds something interesting in there (I hope he does), and writes another article I might miss it, unfortunately, because I've written him off as a trash piece author. EDIT: I went to use this as an example. Hilarious, this blog now has a bad SSL cert, just to put the icing on the cake.

rendx 7mo ago

I don't know if you're being serious or not, but in case you are: There is a difference between (re)using other people's open sourced code, hopefully reviewed, and giving anyone in control of the third party repository the ability to run arbitrary code on your user's devices. Even if the "random GitHub repo" doesn't contain any malicious code right now, it may well contain some tomorrow.

torstenvl 7mo ago
Completely agree. This is really unique. Can you imagine if it were standard practice to be open to supply chain attacks like that, by blindly relying on hotlinked or unpinned dependencies?
- trimethylpurine 7mo ago
  Why imagine? Let's take a quick look at what's actually happening right now. We can check some widely used libraries and see what their instructions are teaching new developers. Boostrap (code snippet from their quick start instructions): ``` <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>Bootstrap demo</title> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/css/bootstrap.min.css https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/css/bootst..." rel="stylesheet" integrity="sha384-sRIl4kxILFvY47J16cr9ZwB07vP4J8+LH7qKQnuqkuIAvNWLzeN8tE5YBujZqJLB" crossorigin="anonymous"> </head> <script src="https://cdn.jsdelivr.net/npm/@popperjs/core@2.11.8/dist/umd/popper.min.js https://cdn.jsdelivr.net/npm/@popperjs/core@2.11.8/dist/umd/..." integrity="sha384-I7E8VVD/ismYTF4hNIPjVp/Zjvgyol6VFvRkX/vR+Vc4jQkC+hVqc2pM8ODewa9r" crossorigin="anonymous"></script> <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/js/bootstrap.min.js https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/js/bootstr..." integrity="sha... ``` Pay close attention, they are inviting the new developer to link not just to Bootstrap, but to Popper! HTMX (code snippet from their quick start guide): ``` <script src="https://cdn.jsdelivr.net/npm/htmx.org@2.0.8/dist/htmx.min.js"></script>  <button hx-post="/clicked" hx-swap="outerHTML"> Click Me </button> ``` Fontawesome: A video quick start guide and instructions that recommends using the direct link to the kits via CDN for performance! Look, I certainly don't think they should be used this way. But, to say that it's unique to the White House app? I definitely wouldn't say that. In fact, I think you've dangerously overestimated the status quo.

kevinsync 7mo ago

Using somebody's stuff is different than hot-linking directly to a hosted version of it, even just from the perspective that dude could delete it at any time and break the whole app.

trimethylpurine 7mo ago
That's fair. I download and embed, personally. Still, it's not a rant worthy mistake, honestly. Suggest a better approach, sure.
- array_key_first 7mo ago
  It's definitely a rant worthy mistake because this would literally never happen in any professional app anywhere. This is a supply chain risk.
  - trimethylpurine 7mo ago
    Microsoft? Okta? JetBrains? If these are amateurs, who is a professional developer? https://www.encryptionconsulting.com/top-10-supply-chain-attacks-that-shook-the-world/ https://www.encryptionconsulting.com/top-10-supply-chain-att... Are you aware that common libraries like Bootstrap, FontAwesome, and HTMX walk developers through linking to their CDNs directly? In fact, FontAwesome recommends it for CDN performance. I think you're dangerously mistaken if you believe that it "literally never" happens. It literally does happen all the damned time. And, for your own safety and others', you should assume that when you use any app for which you don't have the source code.
    - array_key_first 7mo ago
      Linking to a CDN is for development only. Once the app is build you build your dependencies into the app. You don't fetch them at runtime and run them. Not only for security, but also for performance. There's also a difference between using a CDN for, say, React and a random github project hosted by some dude.

input_sh 7mo ago

It's always a better idea to make a local copy of it. Imagine they're downloading a project directly from your GitHub account. Even if you're not doing anything malicious and have no intention of doing anything malicious even after you've been aware of this, now all of a sudden your GitHub account / email is a huge target for anyone that wants to do something malicious.

rpdillon 7mo ago

The dependencies weren't vendored, meaning their behavior can change at any time if a malicious actor gains control of that third-party repo. This is bad for security.

trimethylpurine 7mo ago
Yes, I agree. And it's sadly, as we can see, still fairly standard practice to ignore it.

gitaarik 7mo ago

For an Android game downloaded from the Play store I wouldn't find these findings surprising at all. But from an official app from the White House? Well ok, from THIS White House - you're completely right to expect that.

trimethylpurine 7mo ago
Lol, this is a really funny take. I'm imagining Joe Biden or George Bush asking, "did you check it for supply chain vulnerabilities?" The DoD has been hacked countless times, by children even. I wouldn't doubt if we decompiled most government apps we'd find this same vector in many of them. It seems like this vector is only recently a hot topic. And decades of doing things wrong won't be patched and habits broken in short time. It will take a few years to get the majority of it, and decades after that to get the next majority, and so on.
- gitaarik 7mo ago
  I agree that governments in general are very bad at this. But I also think that this admistration is even more special in it's own way.
  - trimethylpurine 7mo ago
    Okay, great! So post a piece that criticizes Trump. This one failed to do that. And that makes it stink of fanaticism (which is annoying to rational folks).
    - gitaarik 7mo ago
      Come on, you're defending a sinking ship ;). Trump might be right about a lot of things, but that doesn't make him right about everything. And he and his whole administration pretends he is. And it's just pathetic and laughable how they try to keep denying how their decisions where maybe not always the wisest or most responsible. I think that is just very unprofessional, and just plainly simply childish. And I think it's becoming more and more clear that that is actually the way it is. The worse it gets the more they go in denial and the more they blame the woke democrats for everything that's their failures. They just don't know what responsibility is and only know how to turn around the narrative to blame others and to make it seem like they're the best ever. You just can't make this stuff up. But I'm actually enjoying it, because they're falling now and they're gonna fall hard. Interesting times.