Re:How to gain code execution on hundreds of millions of peo...
by zahlman on Saturday March 01, 2025 @02:11PM
(#43222561)
> The miss here isn't that the build container had network access, it's that the build container both ran untrusted code, and had access to secrets.
If you're providing a build container service then you pretty much have to run untrusted code (the customer's) in the container, yes? So then the problem is really just the bad Firebase config... ?
If you're providing a build container service then you pretty much have to run untrusted code (the customer's) in the container, yes? So then the problem is really just the bad Firebase config... ?