Hacker News: Allwinkthttps://news.ycombinator.com/user?id=AllwinktHacker News RSShttps://hnrss.org/hnrss v2.1.1Mon, 31 Aug 2026 08:13:31 +0000<![CDATA[New comment by Allwinkt in "Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel"]]>The worst part is that in 2020 they explicitly documented that the remote filename is attacker controlled,but still allowed it to reach system() This is C security 101: never pass untrusted input through a shell. This should have been caught in the review!

]]>Sun, 30 Aug 2026 12:09:54 +0000https://news.ycombinator.com/item?id=49497982Allwinkthttps://news.ycombinator.com/item?id=49497982https://news.ycombinator.com/item?id=49497982<![CDATA[New comment by Allwinkt in "Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel"]]>The worst part is that in 2020 they explicitly documented that the remote filename is attacker controlled,but still allowed it to reach system() That is C security 101: never pass untrusted input through a shell. This should have been caught in review!

]]>Sun, 30 Aug 2026 12:08:15 +0000https://news.ycombinator.com/item?id=49497970Allwinkthttps://news.ycombinator.com/item?id=49497970https://news.ycombinator.com/item?id=49497970