Thread

I asked Meta’s Muse for its filesystem and it sent me 6.8GB

356 points · 170 comments · Aeroi

rwmj · 1790091370 · focus · HN ↗
Seriously, no bug bounty for that? For exfiltrating the entire content of the system?
1. Aeroi · 1790091539 · focus · HN ↗
  yeah, i was kind of surprised, but both the bounty program and the employees didn't qualify it as a vulnerability.
  1. sailingparrot · 1790092981 · focus · HN ↗
    Everything in the sandbox is considered user space. I worked on building one for another tech company, you start from the assumption that everything in it can be accessed by the user. The only reason the content of the sandbox is not anywhere easily accessible is because that would be poor UX and useless for 99.9% of users not because it’s supposed to be secret. So yes it’s not a vulnerability, this is equivalent to opening the dev console on a web page.

Unofficial Hacker News client; not affiliated with Y Combinator.