Egregoros

Signal feed

API Docs

π–π–Šπ–—π–‹π–†π–˜π–˜π–šπ–“π–Œπ–˜π–˜π–ˆπ–π–’π–šπ–™π–Ÿ :sonnenrad:

@Verfassungsschmutz@nicecrew.digital

We must secure the existence of our people and a future for white children.

23

Posts

0

Followers

0

Following

Posts

Latest notes

π–π–Šπ–—π–‹π–†π–˜π–˜π–šπ–“π–Œπ–˜π–˜π–ˆπ–π–’π–šπ–™π–Ÿ :sonnenrad:

π–π–Šπ–—π–‹π–†π–˜π–˜π–šπ–“π–Œπ–˜π–˜π–ˆπ–π–’π–šπ–™π–Ÿ :sonnenrad:

@Verfassungsschmutz@nicecrew.digital remote
Open link
@teto @lolitechengineer @sun I mean, if you really think about it, it’s impossible to implement this with any amount of reliability unless you require biometric authentication AND NOTHING ELSE (and that won’t work because consumer level biometric shit is nowhere near reliable enough to not have a fallback).

As soon as your account has a password (or a hardware token) you can log in with, it could really be anyone using it. Even if they manage to enforce this somehow, and Microjeet accommodates, it’ll likely just lead to a massive black market for age-verified MS accounts.
π–π–Šπ–—π–‹π–†π–˜π–˜π–šπ–“π–Œπ–˜π–˜π–ˆπ–π–’π–šπ–™π–Ÿ :sonnenrad:

π–π–Šπ–—π–‹π–†π–˜π–˜π–šπ–“π–Œπ–˜π–˜π–ˆπ–π–’π–šπ–™π–Ÿ :sonnenrad:

@Verfassungsschmutz@nicecrew.digital remote
Open link
Well, Go really isn't inherently safer than Node, it has a similar package ecosystem that could be attacked in the same way.

The only reliable way to be safe when using ANY programming language with packages downloaded from the Internet (which is basically all modern languages) is to run them in a Docker container. That's gonna add a bit of overhead to your system (mostly increased RAM usage), and require downloading even more stuff, but at least whatever damage the thing can do will be contained to its own VM.

Now, what the hell does Playwright have to do with any of that?
π–π–Šπ–—π–‹π–†π–˜π–˜π–šπ–“π–Œπ–˜π–˜π–ˆπ–π–’π–šπ–™π–Ÿ :sonnenrad:

π–π–Šπ–—π–‹π–†π–˜π–˜π–šπ–“π–Œπ–˜π–˜π–ˆπ–π–’π–šπ–™π–Ÿ :sonnenrad:

@Verfassungsschmutz@nicecrew.digital remote
Open link

Right, that's why I said it's safe IF you use a local Python installation from a legit source (i.e. MS Store on Windows or your distro package manager on Linux).

But node doesn't have a built-in webserver (although it's trivial to write one), so running any node commands will definitely execute some sort of custom code. I looked at the repo, and in this case, npm run serve:dev will execute this package, which is downloaded when you run npm ci (short for clean-install).

It's likely safe, since it has a high version number, millions of downloads per week, and no updates in 4 years (meaning it's stable), but in general, this IS a possible attack vector, even if the package author is trustworthy – a few years ago, someone managed to hack a guy who owned hundreds of popular NPM packages, stole his keys, and used them to upload modified versions of some of his packages that contained malware, which would try to scan the system for API keys and login info for various web services and send them to a server he controlled, so he could start mining crypto on their AWS accounts or whatever.

So if you want to be on the safe side here, I'd say stick to the Python version, and make sure you use an official Python distribution.

π–π–Šπ–—π–‹π–†π–˜π–˜π–šπ–“π–Œπ–˜π–˜π–ˆπ–π–’π–šπ–™π–Ÿ :sonnenrad:

π–π–Šπ–—π–‹π–†π–˜π–˜π–šπ–“π–Œπ–˜π–˜π–ˆπ–π–’π–šπ–™π–Ÿ :sonnenrad:

@Verfassungsschmutz@nicecrew.digital remote
Open link
Nah I read that, and it makes sense.

Also, you're wrong about the Python approach. Yes, Python does run locally, but you're only using it to run a preinstalled web server module that it ships with, which will make all the files in the local directory accessible to the browser in a way that doesn't require breaking its sandbox.

As long as your Python installation is from a legit source, this is fairly safe. Running it this way will NOT execute any code from that directory – the browser will only be able to access files from the directory you started the server in, nothing else.

In that sense, the using Node is actually more risky, because that WILL run code outside the browser's sandbox, and they could technically smuggle anything in there.