Hacker News Reader

Comment by jwilk | Hacker News Reader

28 points·jwilk··5 comments

This history of a bug fix or bug request shows again the need for more intelligent indexing for both bugs and for software, especially when the program is an editor or a browser.

I would expect that SOLR could actually do the indexing but knowing what needs to be indexed is still a real issue. I think an ontology of software that includes more WHY particular things are done in programs or data needs to be included in current Software Engineering practices.

I disagree with CVEs like this that don't actually violate the security model of the product. Just because a product's security models is not tightening as fast as a competitor's (Office), I don't think that should be considered a CVE.

A downloaded file loading remote resources automatically (without prompting) can be a big problem, which is why nearly every other piece of productivity software has prompted before doing so for many years.

E.g. if someone built an API that used LibreOffice code to convert Office files to PDFs and hosted it using AWS, would they think to check to see if someone can reference the metadata URL and read their EC2 instance credentials? Or reference file:// URIs and read from the server's filesystem?

So is the problem that a random bash script can run "rm -r ~/*" and delete all of your files or a random exe on Windows can encrypt all of your files and ask for a ransom. The capabilities to do these bad things stems from a poor security model that does not fit the user's wants and needs. The capabilities are not coming from a vulnerability.

"Stealth mode" for what's effectively just "offline mode"? Who comes up with this crap, a name like that makes it seem like you're getting away with something sneaky ffs. When in reality it's the mode you're probably assuming as the default for such a tool.

Reply on news.ycombinator.com