Post #1821640

2026-04-30 13:37 UTC

So tired of &quot;security&quot; reports like &quot;if an attacker can place a symlink / set an env var / write a file in a higher directory&quot;. How did the attacker get there? That&#39;s the security issue. I think I need to add &quot;The system the app is deployed on is expected to be fully trusted and otherwise secure.&quot; to our security policy.

Replies (6)

@davidism@mas.to 2026-04-30 13:46

Turns out we already have that in our security policy, and people just ignore it. What a surprise 🙄 https://palletsprojects.com/security I added another sentence to make it even clearer.

Open ##1860132
@hugovk@mastodon.social 2026-04-30 13:44

@davidism PoC Step 1: Attacker already has complete control over your system Step 2: Attacker does something obscure with your software Step 3: You're hacked CVSSS urgent high severity 100 Except in many, many more words.

Open ##1860133
@kimvanwyk@fosstodon.org 2026-04-30 13:57

@davidism I'm reminded of Raymond Chan's frequent use of the Douglas Adams quote: "it rather depended on being on the other side of this airtight hatchway". https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283 is a particularly good example - he has many similar blog entries on the theme.

Open ##1860145
@davidfstr@mastodon.world 2026-04-30 14:50

@davidism Hey I think the security policy that Pallets has documented is pretty clear. 👍 I'll probably crib some of it when I get around to writing out my projects' security policies. https://palletsprojects.com/security

Open ##1860146
@glyph@mastodon.social 2026-04-30 17:53

@davidism *so many* bug reports like this and the slop engines are making so many more

Open ##1860147
@pradyunsg@mastodon.social 2026-04-30 18:50

@davidism my favourite example is "I can run code when you run Python during/after pip install (with extra conditions), give me remote RCE CVE rated 9+ plz". 😅

Open ##1860148