Public
- Public
- Network
- Groups
- Featured
- Popular
- People

Conversation

Notices

Embed this notice
Eleanor Saitta (dymaxion@infosec.exchange)'s status on Tuesday, 10-Sep-2024 19:40:47 JST Eleanor Saitta

Dynamic typing is a mistake, and a vulnerability waiting to happen, again: https://tmendez.dev/posts/rng-git-hash-bug/
In conversation about 3 months ago from infosec.exchange permalink
Attachments
1. No result found on File_thumbnail lookup.
  
  Our RNG Git Hash Bug
  
  from Tim Mendez
  
  Background I work on the live services game Dragon Prince: Xadia. We have iOS/Android clients, hosted gameservers, and a platform. Our gameservers and clients need to be in sync, so we have a field in our platform’s YAML configuration: gameServerVersion: This way, we can tell clients when they are out of date and need to update. This value is set dynamically by a TeamCity deployment job. The Bug One day, a good long while after we put this system in place, our QA lead pings me in the #game-ops channel on Slack:
- Embed this notice
  Eleanor Saitta (dymaxion@infosec.exchange)'s status on Tuesday, 10-Sep-2024 19:40:47 JST Eleanor Saitta
  in reply to
  
  Yes yes, technically this is also a parser ambiguity issue; you can stop it either way and should fix both.
  
  In conversation about 3 months ago permalink
  
  Haelwenn /элвэн/ :triskell: likes this.

Feeds