HackerTrans
TopNewTrendsCommentsPastAskShowJobs

AlexAltea

532 karmajoined il y a 12 ans
Security, reversing, mathematics.

Writing emulators and hypervisors.

Alexandro Sanchez <[email protected]> https://phi.nz/

Submissions

OpenCode AI coding agent hit by critical unauthenticated RCE vulnerability

github.com
3 points·by AlexAltea·il y a 6 mois·2 comments

comments

AlexAltea
·il y a 9 jours·discuss
GrapheneOS runs with a locked bootloader. You temporarily unlock during installation but after re-locking, boot integrity can be validated against GrapheneOS' verified-boot keys. See: https://grapheneos.org/articles/attestation-compatibility-gu...
AlexAltea
·il y a 10 jours·discuss
Only two things come to mind:

1. Provide or find pro bono legal resources deeply familiar with EU DMA and similar antitrust regulations, willing to proof-check and improve this report, and perhaps advise on better channels to submit it.

2. Locate more affected end-users, including applicable members of the GrapheneOS Foundation and developers behind other distributions, make them aware of these efforts so that hopefully we submit a joint complaint. (Might get more traction, though AFAICT reporting is limited to EU citizens).

Happy to fork this into its own repository if it helps with collaboration.
AlexAltea
·il y a 10 jours·discuss
FWIW, I submitted an EU DMA complaint (Art 27 report) against Alphabet for unfair gatekeeping against third-party distributions like GrapheneOS via Play Integrity. More info: https://github.com/AlexAltea/blog/blob/master/posts/2026-06-...

Convincing developers, especially bank and gov apps, is near impossible and won't scale well. Going after Alphabet for not meeting DMA obligations seems the easier path. Might not go anywhere but worth a shot.
AlexAltea
·il y a 6 mois·discuss
Related: https://news.ycombinator.com/item?id=46539718
AlexAltea
·il y a 6 mois·discuss
Probably nothing based on what? I have reproduced the finding locally...

Any website can trivially run arbitrary code as the current user if OpenCode is installed; that's CVSS ~10.