Jlleitschuh

Jlleitschuh on Hacker News

Digital Travel App TripBFF Exposed Location Data Way Too Accurately

Posted by Jlleitschuh on Sunday January 11, 2026 @01:22PM
from the medium.com dept.

https://medium.com/bugbountywriteup/digital-travel-app-tripbff-exposed-location-data-way-too-accurately-524cd0792a7d

( Read More... | no comments | on HN )

What's an OSS Vulnerability Janitor?

Posted by Jlleitschuh on Thursday July 31, 2025 @12:57PM
from the infosecwriteups.com dept.

https://infosecwriteups.com/what-is-a-oss-vulnerability-janitor-b7ab176bdd3f

( Read More... | no comments | on HN )

Burn It with Fire: How to Eliminate an Industry-Wide Supply Chain Vulnerability

Posted by Jlleitschuh on Wednesday July 02, 2025 @12:58PM
from the medium.com dept.

https://medium.com/@jonathan.leitschuh/burn-it-with-fire-how-to-eliminate-an-industry-wide-supply-chain-vulnerability-12515516fb56

( Read More... | no comments | on HN )

The 160-Comment Fight to Fix SnakeYAML's RCE Default

Posted by Jlleitschuh on Thursday June 05, 2025 @11:15AM
from the self-post dept.

https://infosecwriteups.com/️-inside-the-160-comment-fight-to-fix-snakeyamls-rce-default-1a20c5ca4d4c

( Read More... | no comments | 2 points | on HN )

Re:When Open Source Isn't: How OpenRewrite Lost Its Way on Wednesday May 14, 2025 @02:51PM (#43987977)

Moderne quietly relicensed community-contributed OpenRewrite code from Apache 2.0 to a proprietary license, abandoning its open source commitments. This decision risks legal exposure, undermines community trust, and sets a dangerous precedent for OSS stewardship.

When Open Source Isn't: How OpenRewrite Lost Its Way

Posted by Jlleitschuh on Wednesday May 14, 2025 @02:51PM
from the medium.com dept.

https://medium.com/@jonathan.leitschuh/when-open-source-isnt-how-openrewrite-lost-its-way-642053be287d

( Read More... | 3 comments | 2 points | on HN )

Falsehoods People Believe about CVE's

Posted by Jlleitschuh on Monday April 14, 2025 @12:04PM
from the medium.com dept.

https://medium.com/@jonathan.leitschuh/falsehoods-people-believe-about-cves-85c1d063ffda

( Read More... | 2 comments | on HN )

Re:Falsehoods People Believe about CVE's on Monday April 14, 2025 @12:04PM (#43682806)

Inspired by Falsehoods Programmers Believe About Names, this is a list of things people (wrongly) believe about CVEs. Some are naive. Some are overly optimistic. A few are just wishful thinking.

Re:Codecov Bash Uploader compromised on Thursday April 15, 2021 @05:07PM (#26826126)

Curious how you found that. Great find though. This is the exact line:

https://gist.github.com/davidrans/ca6e9ffa5865983d9f6aa00b7a...

Re:Ask HN: Remote repos being used for C2 botnet, or VMS scan? on Monday August 19, 2019 @01:46PM (#20739942)

As a company working for one of the companies impacted by this weirdness we are just as concerned about the potential implications here as you are. We have followed up with JFrog about this and are waiting for a response from them about this.

I'm glad others are seeing these weird things too and it's giving them pause as well.

Re:Vulnerability in the Mac Zoom client allows malicious websites to e... on Tuesday July 09, 2019 @03:22AM (#20389644)

Thanks for being cool!

Re:Vulnerability in the Mac Zoom client allows malicious websites to e... on Monday July 08, 2019 @11:41PM (#20388839)

If you want to see some part of this fixed, please UPVOTE this issue:

https://github.com/mozilla/standards-positions/issues/143

Re:Vulnerability in the Mac Zoom client allows malicious websites to e... on Monday July 08, 2019 @09:25PM (#20388242)

Hi I'm the author, AMA

Or come hang out in the party chat!

Use the exploit to join: https://jlleitschuh.org/zoom_vulnerability_poc/zoompwn_ifram...

Re:Want to take over the Java ecosystem? All you need is a MITM on Monday June 10, 2019 @06:45PM (#20151609)

Oh hey! My article got shared here! Awesome!

I'm the author. AMA!