6 ms·

The origin story of how zemnmez found this is so hilarious > i got tricked into finding some 0days in vscode because I got asked to review a vscode based proje

by theobr 4y ago

The origin story of how zemnmez found this is so hilarious > i got tricked into finding some 0days in vscode because I got asked to review a vscode based project and didn't notice the 1P devs had only made one minor change to it. actually not a joke https://twitter.com/zemnmez/status/1562103677686407168 https://twitter.com/zemnmez/status/1562103677686407168

paraph1n 4y ago
Can someone explain? I can barely parse this quote. Who are the 1P devs? Why does it matter that they didn't notice they had made a minor change? Why were they "tricked"? Edit: I think I might understand it more now: This person got tricked into carefully reviewing the "entire" code, instead of focusing on the one minor change that was made to it, because they didn't realize it was only the minor change they had to review. In their careful review of the code, they uncovered vulnerabilities which were actually related to the original code (ie. VSCode) rather than the changes that this person was asked to review. Did I get it? I'm still confused about the use of "1P" here though.
- dankwizard 4y ago
  I assume 1Password
- zemnmez 4y ago
  First-party (i.e. Google). Tricked in the sense I was asked to do a security assessment and didn't check what differential changes had been made edit: correct!
- sitkack 4y ago
  I found a linked list bug in FreeBSD because I am less smart than my buddy who was like it's trivial bla bla bla. I am like wait, lets back up, I don't understand this... I think one sniff out shifty code, as soon as you open the file you can tell there are going to be bugs in there. I am not saying, well groomed high level code is high quality or bug free. A couple trivial deficiencies and there a probably a whole lot more you don't see. Like if the code has a low to zero number of tests. Or the build system includes top level shell commands.
spatley 4y ago
Who does a code review without a diff?
- aceazzameen 4y ago
  The ones who find 0days apparently.
- soulofmischief 4y ago
  They were reviewing a project, not a diff.

by theobr 4y ago

paraph1n 4y ago

Can someone explain? I can barely parse this quote. Who are the 1P devs? Why does it matter that they didn't notice they had made a minor change? Why were they "tricked"? Edit: I think I might understand it more now: This person got tricked into carefully reviewing the "entire" code, instead of focusing on the one minor change that was made to it, because they didn't realize it was only the minor change they had to review. In their careful review of the code, they uncovered vulnerabilities which were actually related to the original code (ie. VSCode) rather than the changes that this person was asked to review. Did I get it? I'm still confused about the use of "1P" here though.

dankwizard 4y ago
I assume 1Password
zemnmez 4y ago
First-party (i.e. Google). Tricked in the sense I was asked to do a security assessment and didn't check what differential changes had been made edit: correct!
sitkack 4y ago
I found a linked list bug in FreeBSD because I am less smart than my buddy who was like it's trivial bla bla bla. I am like wait, lets back up, I don't understand this... I think one sniff out shifty code, as soon as you open the file you can tell there are going to be bugs in there. I am not saying, well groomed high level code is high quality or bug free. A couple trivial deficiencies and there a probably a whole lot more you don't see. Like if the code has a low to zero number of tests. Or the build system includes top level shell commands.

spatley 4y ago

Who does a code review without a diff?

aceazzameen 4y ago
The ones who find 0days apparently.
soulofmischief 4y ago
They were reviewing a project, not a diff.