repl.it
Dev tools
embeddable code runner
SHOW HN2015
How HN took it
1 positive, 0 neutral or asking, 1 mixed, 5 critical, out of 7 comments about the project. Thread score -0.13.
Privacy: 0 for, 4 againstIdea: 1 for, 0 againstPerformance: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Concept praised as something GitHub should have offered
From 1 comment
Finally, this is what GitHub should have in the first place. Thank you!
tux on HN
Front-end execution is nice and the concept is appreciated
From 1 comment
Your root user has no password, so executing 'su' just gives you a root shell. That's pretty much it. :) You can do it by hitting my link above, running the saved code, which…
hamburglar on HN
Objections
Shell execution and root access in the sandbox are a security risk
From 4 comments
http://repl.it/jM0 You may want to disable shell execution.
sarciszewski on HNBTW, using this trick, I managed to get root in your VM. I assume you have it logged and can see how (was hitting http://repl.it/jND/13 if that helps you locate it); it wasn't…
hamburglar on HN+1 for uid=0
sarciszewski on HNI'm not exactly sure what a root process in a docker container can do (probably depends a lot on the container configuration, plus is probably evolving as we speak, and is…
hamburglar on HN
Environment is too permissive for running arbitrary commands
From 2 comments
http://repl.it/jM0 You may want to disable shell execution.
sarciszewski on HNHere's a fun one for a ruby repl: ``` # spawn a poor man's shell from repl require 'Open3' Open3.popen3("/bin/sh -i") do |stdin,stdout,stderr,wthr| loop do ready =…
hamburglar on HN
Requests
Disable shell execution
From 1 comment
http://repl.it/jM0 You may want to disable shell execution.
sarciszewski on HN
Larger limit on saved script size
From 1 comment
Your root user has no password, so executing 'su' just gives you a root shell. That's pretty much it. :) You can do it by hitting my link above, running the saved code, which…
hamburglar on HN
Questions
What exactly was the privilege escalation and PoC
From 1 comment
I am. Thanks for letting me know. Can you provide some more details about how you escalated privileges and the PoC?
amasad on HN
Alternatives named
GitHub
From 1 comment
Finally, this is what GitHub should have in the first place. Thank you!
tux on HN