News for hackers. Stuff that matters.

A comment on We pwned X, Vercel, Cursor, and Discord through a supply-chain attack. Parent comment

Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by username223 on Thursday December 18, 2025 @03:30PM (#46318228)
It's wild how often we rediscover that executing untrusted code leads to decades of whack-a-mole security. Excel/Word plus macros, HTML plus JavaScript, SVG plus JavaScript, ...
[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by eastbound on Thursday December 18, 2025 @03:59PM (#46318641)
It’s wild how often specs are ok for 9 versions, and then at version 10, standard bodies decide to transform them into a trojan firehose.

It’s so regular like clockwork that it has to be a nation state doing this to us.

[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by moss_dog on Thursday December 18, 2025 @04:30PM (#46319058)
Any notable examples you can share?
[ Parent | on HN ]
Re:We pwned X, Vercel, Cursor, and Discord through a supply-... by kevin_thibedeau on Thursday December 18, 2025 @06:03PM (#46320038)
PDF was purposely a non-Turing adaptation of PostScript. Then they added JavaScript support.
[ Parent | on HN ]