How to gain code execution on hundreds of millions of people and popular apps

Re:How to gain code execution on hundreds of millions of peo... by Thorrez on Saturday March 01, 2025 @08:51AM (#43219229)

Are you saying Chrome should block all script includes that don't have hashes? That'll break tons of sites. See "Don't break the web"[1].

Disclosure: I work at Google, but not on Chrome.

[1] https://flbrack.com/posts/2023-02-15-dont-break-the-web/

[ Parent | on HN ]

Re:How to gain code execution on hundreds of millions of peo... by LtWorf on Saturday March 01, 2025 @06:50PM (#43225430)

Also expired certificates break a lot of websites… should we disable checking?

[ Parent | on HN ]

Re:How to gain code execution on hundreds of millions of peo... by ameliaquining on Saturday March 01, 2025 @09:50PM (#43226685)

Certificate expiration isn't an unanticipated regression. You know when you get a certificate when it will expire.

[ Parent | on HN ]

Re:How to gain code execution on hundreds of millions of peo... by hyperdimension on Sunday March 02, 2025 @01:18PM (#43233283)

I don't mean to be pedantic, but not always--see the recent DigiCert delayed revocation issues. I will admit it is rare though and more often than not, you (should) know when your certs are going to expire.

[ Parent | on HN ]

Re:How to gain code execution on hundreds of millions of peo... by Thorrez on Sunday March 02, 2025 @09:44AM (#43230939)

Those websites set up the expiring certificate themselves.

[ Parent | on HN ]