Thread

A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

491 points · 208 comments · Handy-Man

oefrha · 1789704813 · focus · HN ↗
Unsandboxed ImageMagick is known for being a security nightmare even back when PHP ruled the world (not saying sandboxing is a panacea either, it just requires a different and potentially harder exploit to develop a full chain). Difference is it's easier than ever to turn vulnerabilities into full compromises. At some point we'll have to replace all parsers with something at least as safe as <a href="https://github.com/google/wuffs" rel="nofollow">https://github.com/google/wuffs right? Otherwise ImageMagick and co. will just keep giving.
1. djxfade · 1789708281 · focus · HN ↗
  PHP still rules the world, even though many doesn't want to realize it. It's still the biggest web language by a far margin
  1. willy_k · 1789713317 · focus · HN ↗
    Phones don’t “rule the world” of cinematography, despite the majority of videos being from phones. The serious stuff, professional and personal, uses cameras.

Unofficial Hacker News client; not affiliated with Y Combinator.