edgeyboy

4 ms·

1. 1.▲
   by edgeyboy 7y ago

   They're called through os.system. Say that you have a website that relies on downloading content from URLs supplied by users. A user can send a "specially constructed" URL ("anything;commandgoeshere") and run any co
2. 2.▲
   by edgeyboy 7y ago

   My apologies, I'll be more careful, and more factual.
3. 3.▲
   by edgeyboy 7y ago

   I apologize for criticizing the person and not the project, but again, the fact that he deleted the issues is unreasonable.
4. 4.▲
   by edgeyboy 7y ago

   I didn't ever say "Oh god this is a fucking goldmine". That was a reply.
5. 5.▲
   by edgeyboy 7y ago

   Now that the release is out, it's actually worse than we expected: https://news.ycombinator.com/item?id=20251344
6. 6.▲
   by edgeyboy 7y ago

   After going through the source code, I can tell for sure that it's an insecure C transpiler. - Most things call just out to C. - A lot of examples don't even compile. - Some things use CLI curl or mkdir, this is /INCREDIBLY&#