News for hackers. Stuff that matters.

A comment on Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws. Parent comment

Re:Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws by chc4 on Saturday June 29, 2024 @03:24PM (#40832822)
You should never assume any method of executing any attacker controlled code is safe, unless something explicitly calls that out and also has put Google-level amounts of effort into supporting that.
[ Parent | on HN ]
Re:Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws by _factor on Saturday June 29, 2024 @09:29PM (#40834531)
My interpreter only accepts print and addition to a predefined variable. Let the attackers print and count all they want.

The problem isn’t the execution, it’s the scope of what it means to “execute”.

[ Parent | on HN ]
Re:Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws by kfmdnfj on Monday July 01, 2024 @01:54AM (#40842929)
Depending on the implementation, there might still be multiple bugs lurking, especially in input parsing
[ Parent | on HN ]