11:15:26 -xmr-pr- rating89us opened pull request #2903: Wallet: add isTrezor() function 11:15:27 -xmr-pr- > https://github.com/monero-project/monero-gui/pull/2903 13:00:27 -xmr-pr- rating89us opened pull request #2904: StandardDialog: new design 13:00:27 -xmr-pr- > https://github.com/monero-project/monero-gui/pull/2904 13:37:27 .merge+ #2896 #2894 #2896 #2897 #2899 #2901 #2903 13:37:27 Added 14:45:27 -xmr-pr- xiphon opened pull request #2906: cmake: rename monero-gui binary to monero-wallet-gui 14:45:27 -xmr-pr- > https://github.com/monero-project/monero-gui/pull/2906 14:45:27 -xmr-pr- xiphon opened pull request #2905: cmake: drop '-std=c++0x' compiler flag 14:45:27 -xmr-pr- > https://github.com/monero-project/monero-gui/pull/2905 17:11:42 .merge+ #2905 #2906 17:11:42 Added 20:57:31 I assume this channel has seen this issue? https://github.com/monero-project/monero-gui/issues/2902 21:07:28 I have not. 21:10:10 Ah ok 21:10:14 Well. There it is 21:10:36 Was reported (not via responsible disclosure) via twitter 21:10:43 Someone else posted as an issue 21:30:38 Looks like the fix she suggested is deprecated in Qt 5.15 and I can’t find a different method to disable this. 21:30:58 I’ll let xiphon take a look at this. 21:31:49 Worth mentioning to her on twitter? (I do not have an account, and do not want one) 21:32:09 It would show that the maintainers are aware of the issue now 21:48:03 I commented on Twitter. 21:52:26 Link? 21:58:03 https://twitter.com/selsta541/status/1260685096492978176 21:59:15 ty 21:59:25 Does it seem like a problem in practice? 21:59:29 sarang: i wouldn't say is a big issue (as big as it is promoted in the twitter post) 21:59:37 no, it does seem like a bs to me 21:59:58 Too bad that the twitter poster feels responsible disclosure is not worth it 22:00:00 although we can and probably will "fix" it (just in case) 22:00:06 (I wholeheartedly disagree with her mentality on this) 22:00:33 i still don't agree that it is a big issue 22:00:45 She does say that it's unlikely to be remotely exploitable 22:00:52 to do this, a user might explicitly want to "inject" some html code where it is not intended to be 22:00:53 but even so 22:01:08 sure, it is unlikely to be exploitable by anyone 22:01:55 Electrum had problems were nodes were able to send html responses which resulted in fake update client dialogs 22:02:02 but I don’t think this is possible here 22:04:09 i still would say that it is not a vulnerability at all 22:04:36 it is like a user entering "rm -rf" in the console 22:05:01 Perhaps a comment on the github issue would also be helpful 22:05:37 but is a bug, though. So we probably could sanitize a user's input 22:05:46 I think her Twitter post was more general and someone asked if this is possible with monero GUI, it didn’t seem like a vulnerability disclosure to me 22:05:48 just in case the user want to do something really dumb 22:06:22 selsta: perhaps, but the thread basically indicated that she didn't intent to responsibly disclose future flaws 22:06:33 a mentality that I think is reckless and unprofessional 22:06:42 but that is unrelated to this particular issue 22:12:38 sarang: read up on her previous tweets now, agree with you 22:12:43 The "I'm an asshole, look at me" mentality is prevalent among those who style themselves security researchers (no idea about this particular case). The apparent glory attracts that type of people. 22:13:14 I don't doubt that this researcher knows her stuff, FWIW 22:13:40 I just disagree with the conclusion that because some projects/companies don't respond well to disclosures, that responsible disclosure isn't still the right thing to do 22:14:17 But again, that's somewhat separate from this particular issue 22:14:20 "Some dude laughed at me when I said please, I won't say please to anyone ever again" 22:14:58 Granted, it's satisfying on the spot. 22:16:02 * moneromooo feels a sudden urge to be an asshole to someone... 22:18:34 nooo 23:37:36 been aware of QMLs behaviour on this for quite a while, I committed this on Dec 12 2018; https://github.com/monero-project/monero-gui/commit/fe6ce682bfd03b09b035f68944225a18b45e9873 23:39:13 AFAIK. QML's default text component is RichText which automagically resolves, for example, tags. This can be problematic with user-input. The attack that I came up with: 1) Create a wallet 2) Create a new contact 3) You give it a name with some HTML in it (had to use some modified monero-core code for this 4) It saves to wallet cache. 5) You send your wallet + wallet cache to victim 6) Victim opens 23:39:19 wallet in GUI which will ping back to you upon rendering. 7) You have his IP (h0h0h0) 23:39:38 I think we also discussed this around Dec 12 2018, specifically how Qt automagically resolves HTML tags in richtext components. Then 1.5 weeks later we get this: https://www.zdnet.com/article/users-report-losing-bitcoin-in-clever-hack-of-electrum-wallets/ 23:39:52 My conspiracy theory is that someone here read that. 23:40:04 <8') 23:58:47 dsc_: lol https://usercontent.irccloud-cdn.com/file/8a72UzHT/Screenshot%202020-05-14%20at%2001.58.32.png 23:59:12 hahaha 23:59:31 but like xiphon mentioned, no way to trigger this remotely 23:59:38 so its not really a vuln 23:59:48 but we have to be careful on where we place RichTexts