Hacker News new | past | comments | ask | show | jobs | submit login

How do you tell your trusted minifier has no exploitable bugs?



Exploitable by what?


Anyone who has ever pushed a patch to the project that you're running through the minifier.


What would be the point of exploiting the minifier? The purpose is to get the code to the Debian users, how does exploiting the minifier help with that? If you can put an exploit is the program's source, you just want it to be minified as-is so that it'll run on the end user machines.


Read the linked article: https://zyan.scripts.mit.edu/blog/backdooring-js/

It has the answer to your question. Namely, you can write bugs that are exploitable that aren't present in the original source, that only appear in the minified output. Which means that a) it is a whole lot harder for someone to find (especially if it's something that is "obviously" correct), and b) it's plausibly deniable.


It might be a lot harder to spot the exploit during review if it only works in conjunction with a minifier bug.


No, you want the minified source to do something different but predictable so that nobody reading the source could spot the backdoor without knowledge of the bug. Here's an example:

https://zyan.scripts.mit.edu/blog/backdooring-js/




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: