• 0 Posts
  • 31 Comments
Joined 3 years ago
cake
Cake day: June 9th, 2023

help-circle
  • I fully agree, there isn’t a good reason. The issue is that flaw is a systemic one in Windows.

    Modern operating systems should be operating under zero trust. The fact that Windows still operates on Intranet Era logic, where if a file is reachable, it’s probably safe, is exactly why these exploits keep happening.

    The problem comes down to a Windows API called ShellExecute. When an application like Notepad passes a link to this API, it is effectively saying to the OS, The user wants to open this, figure out how to run it.

    Windows looks at it and essentially says, Oh, it’s an .exe on a network share? The user must want to run that software, launch it, rather than, This is executable code from a network location I don’t control, download it and make the user double-click it themselves.

    The main reason it does this is for legacy enterprise convenience. Decades ago Microsoft designed Windows so that companies could put internal tools on a shared drive and employees could run them instantly. They prioritised seamlessness over security by assuming the network perimeter was the security boundary, and everything on it was there because they wanted it to be.

    Obviously that assumption is dangerous. Like you said, no remote executable should ever be treated as trusted by default, regardless of whether it came from the Store, an SMB share, or a web link. The action of clicking a link should never map directly to execution of code. It should map to retrieval of data. Microsoft basically turned a convenience feature into a permanent vulnerability.


  • Yeah I get your thought process, but the second vulnerability is actually just how Windows is designed to work. When Notepad follows a link, it isn’t opening a web page, it’s passing a command directly to the OS shell.

    Because Notepad is a trusted native application, it bypasses many of the security checks that a browser has.

    If the link uses the file:// protocol to point to an .exe on a remote server, or ms-appinstaller to trigger an install, the OS treats that as a direct instruction to launch that software, so it can trigger an app installation prompt or, depending on the exploit, silently side-load malicious packages.







  • You’re literally arguing nothing right now. THEY took the position we should have brackets defining the order in every single equation or otherwise have them as undefined TODAY. It doesn’t matter when they were invented. Obviously it’s never been written like that. They are the one arguing it SHOULD BE. I said that would be stupid vs following the left to right convention already established. You’re getting caught up in the semantics of the wording.

    What you inferred: they’re saying brackets were always around and we chose left to right to avoid bracket mess.

    What I was actually saying: we chose and continue to choose to keep using the left to right convention over brackets everywhere because it would be unnecessary and make things more cluttered.

    And yes, that IS a position mathematicians COULD have chosen once brackets WERE invented. They could have decided we should use them in every equation for absolute clarity of order. Saying we should not do that based on tradition alone is a bad reason.

    The “always been the case” argument could justify any legacy system. We don’t still use Roman numerals for arithmetic just because they were traditional. Things DO change.

    Ancient Greeks and Romans strongly resisted zero as a concept, viewing it as philosophically problematic. Negative numbers were even more controversial with many mathematicians into the Renaissance calling them “fictitious” or “absurd numbers.” It took centuries for these to become accepted as legitimate mathematical objects.

    Before Robert Recorde introduced “=” in 1557, mathematicians wrote out “is equal to” in words. Even after its introduction, many resisted it for decades, preferring verbal descriptions or other symbols.

    I could go on but if you’re going to argue why something shouldn’t be the case, you should argue more than “it’s tradition” or “we’ve done fine without it so far”. Because they did fine with many things in mathematics until they decided they needed to change or expand it.







  • There was an exploit in version 0.17.0 through 0.19.0 (fixed in 0.19.1) that, from what I understand, allowed people to view DMs of anyone by reporting them, but as you can’t know the ID of a given DM you’re not part of, they couldn’t really target a specific user, but rather would just send reports to a range of potential IDs and see what comes back.