Discord is not an acceptable choice for free software projects

Re:Discord is not an acceptable choice for free software pro... by crgwbr on Friday February 21, 2020 @01:03PM (#22385219)

> They can just add something like require('fs').readFileSync(process.env.HOME + '/.ssh/id_rsa').toString()

And that is why you encrypt your SSH keys with a passphrase, use a Keychain, etc. Discord isn’t unique in its ability to read file on the FS. Pretty much anything can do that.

[ Parent | on HN ]

Re:Discord is not an acceptable choice for free software pro... by clarry on Friday February 21, 2020 @01:11PM (#22385290)

> Pretty much anything can do that.

Nah, pretty much anything except proprietary software has a higher chance of being written by people I trust and packaged by people I trust and probably audited by me and other people, and is not capable of loading executable code from any server after installation.

[ Parent | on HN ]

Re:Discord is not an acceptable choice for free software pro... by ubercow13 on Friday February 21, 2020 @01:10PM (#22385281)

Does that really help much? It still has access to .bash_profile

[ Parent | on HN ]

Re:Discord is not an acceptable choice for free software pro... by crgwbr on Friday February 21, 2020 @01:15PM (#22385327)

What secrets are you putting in your bash profile? I used to be guilty of putting AWS keys in there, I guess, but nowadays we have aws-vault.

[ Parent | on HN ]

Re:Discord is not an acceptable choice for free software pro... by ubercow13 on Friday February 21, 2020 @01:22PM (#22385403)

For example it could register a fake ssh-agent that just grabs your password first time you type it

[ Parent | on HN ]