Hacker News Reader

everyflavourvmson A plea not to use uv-build

> I don't follow.

I don't either. I used to run Gentoo for quite a few years in the past and build dependency updates would not trigger rebuilds of build-dependent packages.

Rebuilding the entire system with a new GCC was recommended by the documentation, but there was nothing in Portage forcing it. Neither would you rebuild the system if, e.g. make got an update.

everyflavourvmson MSI Center – How to gain SYSTEM privileges in seconds

Oh right, yes, either that, or one of them is bound to have a DLL hijack issue that can be taken advantage of.

everyflavourvmson MSI Center – How to gain SYSTEM privileges in seconds

Yep. There's a system of ACLs and integrity levels which determine whether you're allowed to do this or not (doesn't have to be a child process), but for the most common case:

* a process running at medium integrity level with the current user's token

* another medium integrity process with the same token can open it with PROCESS_CREATE_THREAD and PROCESS_VM_WRITE rights

everyflavourvmson MSI Center – How to gain SYSTEM privileges in seconds

> pipes only accept input from MSI signed software

This does not inspire confidence. I'm assuming the pipe exists so that some GUI process running as the current user can perform privileged actions since the other end of the pipe runs as SYSTEM. At this point, just inject a thread into that GUI process and send the command - the service will think it is coming from MSI software, because it is.

The "only invoke MSI signed executables" mitigation is a good one, but if these two things are all they have done, while leaving the "arbitrary registry write" primitive in, then this is still 100% vulnerable to local privilege escalation.

everyflavourvmson I fixed Windows native development

They've completely reworked release plans. 2026 LTSC will come out a year after the initial VS 2026 release (at the same time as VS 2027) and be supported for 1 more year. You pretty much have to get on the rolling updates train for the IDE, which is why the C++ toolchain now follows a different schedule and you're supposed to be able to install any specific toolchain side by side.

everyflavourvmson Pricing Changes for GitHub Actions

I haven't used Actions in a professional context so am just wondering (and this might help coming up with arguments should $c-suite start requiring a move): is a "runner" equivalent to an executor slot in Jenkins? As an example, we currently have some builders with 20 executor slots and they might all be orchestrating test runs in parallel (these do not consume much CPU as all they are doing is instructing _other_ VMs, created on the fly, to do the actual work). Would that count as 20 runners in Github Actions, hence costing $0.002/minute times 20?