Hacker News Reader

Comment by capableweb | Hacker News Reader

> Zero vulnerabilities or memory leaks

Dangerous to put on your landing page. First, if it gains popularity and more people start looking into it, you will find vulnerabilities or memory leaks, it's just a question of effort and time. Secondly, it invites people to prove you wrong, maybe more than wanted, and once they find something, you're gonna have to eat your shoe.

Maybe something better would be "Security & Performance high priority" or similar, with better wording.

View on HN

It's brilliant, for exactly those reasons. If it motivates someone to find flaws, I would happily claim my code is "flawless". When I'm inevitably proven wrong, I can fix the bug / merge the PR and say "Thanks to [contributor]'s hard work and sharp eyes, now the code is completely flawless!" Hopefully, it would motivate even more to prove me wrong. Really smart, on the part of the developers, to say that.

This will destroy the trust people may have in any author's claim as well...

Depends on the how they respond and the audience.

Personally, if they respond with alacrity and transparency then I get to trust them more.

For the average consumer ...

This isn't an unheard-of practice in the software world. BSD has often touted itself as the most secure *NIX-like system on the market today. When someone files a CVE, the developers use it as an excuse to powwow, crush the bug or vuln, and then continue claiming to be best-in-breed.

And yes, that's not necessarily the de-facto behavior of a lot of developers, unfortunately. Projects like Flatpak have hundreds of open issues and vulns, with only a handful of developers actually dedicated to working on it. These people often prioritize features over fixes, and they reap what they sow for it.

This is a really bizarre comment to make, considering BSD has no equivalent to flatpak. Flatpak might only have a handful of developers, on BSD you get nobody trying to fix application-level sandboxing at all. Unless I missed something and there's a new BSD project being worked on here, but I haven't heard anything.

They're both security-oriented, open-source projects with limited numbers of contributors. I'm comparing the way they handle their priorities, and moreover just trying to tie it back to how claiming to be perfectly secure is a pretty regular occurrence. It's not an apples-to-apples comparison, but it doesn't have to be for the sake of this example.

I don't think it's a serious statement, just tongue in cheek kinda thing. The next sentence clearly indicates that:

> Guaranteed or your money back! (In case you do find any, please let us know.)

Haha, you're right! I thought that referred to some support contract the developer was offering, but based on the rest of the content of the page (and lack of support contract), I think you're right :)

Maybe it was meant as bait for the RIIR crowd.

It's especially bad because I can already name a vulnerability. The method used by this program (sending SIGSTOP to the pid in _NET_WM_PID) is inherently broken and can be abused by malicious processes into sending signals to the wrong process, because _NET_WM_PID is set by the client and can be anything. It's completely broken and won't work at all if your process is in a pid namespaced sandbox (e.g. docker container, bwrap, firejail, flatpaks, snaps) because the process inside the namespace doesn't know its global pid.

Suffice to say it's disappointing whenever I see tools built this way, using pids for signaling in a GUI is a really bad idea and should be avoided. A way to fix it on Linux would be to pass pidfds around everywhere, unfortunately that's Linux-only and adoption of it is very slow. Another Linux-only option would be to use the cgroup freezer if that ever gets implemented in cgroupsv2.

Any process that can connect to the X server has complete control over all other apps running on it and can record all user activity.

It can also pop up an xterm and type ‘kill’ into it.

Not that this isn’t poor design though, but it’s the best one can do.

No I mentioned two ways it could be done better, it has to use different OS facilities. Of course you are right about the futility of trying to secure anything connected to the X server, a solution based on X11 will probably always have vulnerabilities.

Reply on news.ycombinator.com