Post 9ukPABaKetsW2Hv4OO by chloekek@floppy.tokyo
 (DIR) More posts by chloekek@floppy.tokyo
 (DIR) Post #9ujzaqpjK6P2gcAygK by chuck@linuxlab.sh
       2020-05-05T15:40:45Z
       
       2 likes, 6 repeats
       
       🤕 oof, bad day to be a salt consumerhttps://saltexploit.com/Looks like salt has unwittingly distributed a WORM and is now being subject to crypto-mining backdoors, which is anyones guess what the actual use of these will be for...#exploit #salt #supplychainpoison
       
 (DIR) Post #9ujzar3uTNkHOaoIme by amolith@social.nixnet.services
       2020-05-05T15:42:12Z
       
       0 likes, 0 repeats
       
       @chuck And just after I had pretty much decided to use salt for building and deploying my systems this summer :blobcateyes:​ Maybe I do go with Ansible like I originally planned 🤔
       
 (DIR) Post #9uk0QK3uPYmU6eLrIu by tyil@soc.fglt.nl
       2020-05-05T15:51:38.220384Z
       
       0 likes, 0 repeats
       
       @chuck Why does that site depend on external JS...
       
 (DIR) Post #9uk1G0AlbY1lTkCZou by kravietz@social.privacytools.io
       2020-05-05T16:00:54Z
       
       0 likes, 0 repeats
       
       @chuck 1) People who expose their configuration management daemons to the Internet2) People who don't patch them when a HUGE REMOTE CODE EXECUTION HITS THE NEWS🤷‍♂️
       
 (DIR) Post #9uk3GatrFlYtIKheSm by chuck@linuxlab.sh
       2020-05-05T15:45:45Z
       
       0 likes, 1 repeats
       
       Looks like there's some help out there already, there's a CVE check in some python2 janky fashion...https://raw.githubusercontent.com/rossengeorgiev/salt-security-backports/master/salt-cve-check.pybut use your best judgement, its yet another script.
       
 (DIR) Post #9uk72QkaakbbZxrxqK by chloekek@floppy.tokyo
       2020-05-05T16:10:13Z
       
       0 likes, 0 repeats
       
       @tyil Here is the JS it loads in, along with a Markdown document: https://gist.github.com/taigrr/6520246a19d2e69985802a5d75a49279
       
 (DIR) Post #9uk72QwzqcWwCRfsBM by tyil@soc.fglt.nl
       2020-05-05T17:05:42.386973Z
       
       0 likes, 0 repeats
       
       @chloekek Fucking webshits
       
 (DIR) Post #9ukESqo926z1bR4sYy by chloekek@floppy.tokyo
       2020-05-05T17:33:15Z
       
       0 likes, 0 repeats
       
       @tyil Apparently you can take any gist url, add .js to it and it’ll render the markdown and document.write that.
       
 (DIR) Post #9ukESr0uGfBwF134SG by tyil@soc.fglt.nl
       2020-05-05T18:28:57.104752Z
       
       0 likes, 0 repeats
       
       @chloekek Horrendous. Just convert your markdown to a plaintext HTML file and host *that*. Why are people so hellbent on introducing complexity for no reason?!
       
 (DIR) Post #9ukPABaKetsW2Hv4OO by chloekek@floppy.tokyo
       2020-05-05T18:43:52Z
       
       0 likes, 0 repeats
       
       @tyil Well this is less work because you can update the gist and it will automatically reflect, and there’s no need for server-side code on your part.I guess you could do an iframe.
       
 (DIR) Post #9ukPABlK02fWaN3qWO by tyil@soc.fglt.nl
       2020-05-05T20:28:48.548483Z
       
       0 likes, 0 repeats
       
       @chloekek You still need to make a gist, an html page loading the gist, and all your users suddenly need javascript to read *plaintext*. It'd be simpler to just host it as a plaintext file, and more accessible.
       
 (DIR) Post #9ukiXGFtMJW4JI4jdw by vandys@mst.vsta.org
       2020-05-05T15:44:46Z
       
       0 likes, 0 repeats
       
       @chuck And the exploit documentation site only presents content if you load and run their JS.  Confidence == low.
       
 (DIR) Post #9ukiXGXcIPh7CGMtGq by nergal@linuxrocks.online
       2020-05-06T00:05:54Z
       
       0 likes, 0 repeats
       
       @vandys https://gist.github.com/taigrr/6520246a19d2e69985802a5d75a49279.js@chuck