Gab - hacked. Truth social - hacked. What if they come for us? The rdrama codebase probably isn't perfectly secure! Chrome or firefox has layers of sandboxes, a hundred different gadgets like 'stack protection' or 'W xor X', and still has a new RCE every week. rdrama can probably be trivially owned if someone googles all the dependency versions for a few hours. also, lol commit history, 'sneed'. If that happens - what leaks? i guess just associations between stored ip addresses (if they are) and post histories. And IP can reveal a lot, or nothing, depending on where you live, ISP, etc. Combine that with a post history referencing improvements you made to your house or your occupation ... might be bad.
Practically, seems incredibly unlikely anyone will care enough to do anything, it's a small community and the essay format gets in the way of 'omg these rightwingers grr'. But, always good to ponder potential security issues. Also, you wanted content, so content.
Jump in the discussion.
No email address required.
Notes -
Eh it's probably pretty safe. There's no actual version specified (lol python), so everything gets the latest version of all dependencies on every image build. Most open source packages are pretty safe, most of the ones that do have issues aren't remotely exploitable, and mostly actual remotely exploitable vulnerabilities that aren't widely known and immediately fixed are only known to a few well-financed organizations that have much bigger fish to fry than our little site.
Also it's a public forum, everyone's post history is already public. Even if it did get hacked, there's not much to get except IPs, emails, and password hashes. IPs aren't very easy to resolve to people, email address might be mildly embarrassing if you used your real name or something easily connected to you, so probably best not to do that (it's optional anyways), and passwords are hashed well, not much real risk unless you used a very easily guessed password connected to accounts on other sites with the same email.
I'm sure people have been trying to attack rdrama for a while too. The fact that they haven't been hacked yet is a good sign. Yeah some of the past coding practices aren't the best, but all of us who have participated in the dev work have looked over it and not seen any security issues.
this isn't really accurate in spirit (except the last bit). "most packages are safe" is true in the sense that the termcolors package probably is safe (aside from supply chain / github / npm attacks, because termcolors can use network and filesystem just like express, but separate issue), but it's also vacuous. most issues aren't exploitable too, but again, vacuous. most exploitable vulnerabilities that are widely known are fixed quickly - although see “ This issue was initially discovered in 2016 by a RedHat kernel developer and disclosed in a public email thread, but the Linux kernel community did not patch the issue until it was re-reported in 2021.” from HN frontpage for a funny counterexample. Unfortunately, there are just so many vulnerabilities discovered and used that it's little comfort, and breaches happen constantly. also, the rdrama codebase is not audited frequently for security, and probably has its own flaws.
Of course it's true that nobody cares about our site so nothing will happen probably. its just interesting to work out the details.
i'm not sure rdrama would notice. do they have good logging and monitoring? probably not?
true, and the biggest defense we have is that there's just not much to breach (nobody has their real names like gab) but having your ip does make it much easier to track someone down just because of location, so i'd rather nobody have them.
FWIW, I tend to be a bit skeptical of certain types of things coming from the security community. They do have a tendency to overstate the severity and applicability of issues due to the benefits of publicity in that community.
Ex - the browser environment is riddled with RCEs because the attack surface is massively huge - they are expected to let any site on the net run arbitrary JS code with a ton of flexibility on their user's systems, and to use as much of the overall power of those systems as possible, but not let that code behave beyond certain limits. I sympathize with the people trying to keep that secure. But it doesn't have a lot in common with most other environments.
The web server environment has a much more limited attack surface. For the most part, apart from supply chain attacks, you can only really attack it by sending HTTP requests to it. That doesn't make them invulnerable, but it does mean that the great majority of vulnerabilities follow a few specific patterns that are straightforward to avoid. None of us who have worked with the code here have found any of those in the codebase yet.
I don't think I'd quite bet that there's no vulnerabilities at all. But it seems unlikely enough that there's anything serious that I'm not actively worrying about it. Especially combined with our relatively small size, general lack of going out of our way to piss people off, and lack of really juicy things to be gained from compromising the site.
Eh. googling 'flask RCE' shows a few.
And web servers regularly get owned by leaving API keys open, configuring something wrong, too. Maybe you use azure, and the part of azure you're using is broken. maybe your web server is perfect but your cloudflare password is 'marseeeeeey2' without 2fa and you get owned that way.
I guarantee someone sufficiently motivated could be inside rdrama in a week or two. But I highly doubt anyone is.
More options
Context Copy link
Not sure if they overstate the severity of issues; If the NSA has been hacking everything, how has nobody seen them coming?
Not directly applicable here*, but cybersecurity in general is... there's no cybersecurity, really. Intel ME.
* but maybe for Gab / Truth and such?
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link
More options
Context Copy link