Olivier Forget @teleclimber@social.tchncs.de
Public

I don't use so I didn't pay much attention to this, but is quite a thing, wow.

From what I understand if you were running your RSC in @deno_landDeno with *minimal permissions* then the exploit's consequences would have been limited. In the post I boosted below, the exploit was used to overwrite the authorized SSH keys. You'd *never* run Deno in prod with that kind of access (right? RIGHT???).

What surprises me a bit is that I don't see many posts from people who were running their React in Deno (properly) and therefore largely escaped this massive vuln. I feel like they'd be celebrating, but I don't see it. Does nobody run React in Deno in prod? Or did they still get pwned somehow? Something else?

0
0
1

If you have a fediverse account, you can quote this note from your own instance. Search https://social.tchncs.de/users/teleclimber/statuses/115945757738056076 on your instance and quote it. (Note that quoting is not supported in Mastodon.)

Olivier Forget @teleclimber@social.tchncs.de
Public

RE: social.tchncs.de/@teleclimber/

By the way this vulnerability is exactly why Dropserver apps run in a sandbox by default, and why I'm focusing on making it easy to have a useful DS install that isn't visible to the public internet (like using Tailscale). I'm also thinking of more ways of making small projects useful and safe to have around the net without having to keep up with every vuln all the time.

With people vibe-coding their personal apps you just know this kind of thing is going to happen over and over again. How to run these apps safely is going to be the question.

0
0
0