Thread

How one Twitch chat message became code execution on a streamer’s PC

67 points · 30 comments · tau255

charcircuit · 1790472348 · focus · HN ↗
<a href="https://github.com/obsproject/obs-browser/pull/523" rel="nofollow">https://github.com/obsproject/obs-browser/pull/523
Not even counting the time it took to make this PR, releasing a security update for the browser took 4 months to merge. For reference Brave has a 1 day SLA for releasing the update itself after a security fix gets published.
1. landr0id · 1790483383 · focus · HN ↗
  It's not just moving a code pointer. They had to migrate CEF runtimes (Alloy to Chrome) which, as I understand from the few minutes of reading I did to understand the complexities outlined in the PR, was necessary because Alloy was removed in M128. So OBS was using the last version of legacy runtime and needed to migrate. I imagine they wanted to do a decent amount of testing to ensure compat.
  1. charcircuit · 1790490269 · focus · HN ↗
    >It's not just moving a code pointer.
    That's not the end user's problem. End user's don't want to be told that they got hacked because keeping your product secure was too hard.

Unofficial Hacker News client; not affiliated with Y Combinator.