Show HN: Edabit – Like Duolingo for Learning to Code

Re:Show HN: Edabit – Like Duolingo for Learning to Code by anonymousJim12 on Wednesday November 14, 2018 @04:41PM (#18454279)

remote code execution doesn't really mean much in an un-privileged container. They could be using cgroup limits, capability drops, MAC, seccomp, etc etc

Now, I'm not saying that containers are super tight by default. It is entirely possible this particular container env is wide open, but I didn't really see anything too concerning from the parents analysis.

[ Parent | on HN ]

Re:Show HN: Edabit – Like Duolingo for Learning to Code by pvg on Wednesday November 14, 2018 @04:47PM (#18454332)

remote code execution doesn't really mean much in an un-privileged container.

It means pretty much everything. Have you ever heard of someone reporting an RCE in a major service and it being treated as no big deal? They're invariably treated as catastrophic compromise because it is. The jump from RCE to privilege escalation, escape, etc is nothing compared to the actual RCE-ing.

[ Parent | on HN ]

Re:Show HN: Edabit – Like Duolingo for Learning to Code by MadcapJake on Wednesday November 14, 2018 @06:48PM (#18455419)

when the platform is itself about RCE... I think you have to evaluate what specific dangerous code can be executed before you start lighting the torches.

[ Parent | on HN ]