Hacker News

Did you really name your son Robert'); DROP TABLE Students;-- ?

In 2026, we still don't have a major OS that sandboxes everything.

I wouldn't mind, but there needs to be a way to remove the "training wheels".

I don't want my computer to always be as closed and restrictive as an iPhone. That's good sometimes and perfect for some users, but not for everyone or all the time.

These days, most things that I run that aren't from my distro's repos get their own bubblewrap. On top of this, I use opensnitch. Even if I trust the application (uncommon), I never trust npm, pypi, etc. any longer. It's tedious to set this up and OSes should be helping make this easy.

The problem is, peoples files are too valuable - even to the OS vendors - and also, there are simply too many valuable people on the Internet without the willpower to know how to manage their own filesystem.

If the OS vendors are motivated to harvest peoples data, why on Earth would they be motivated to make sure nobody can harvest peoples data?

I am in agreement. I am always curious as to the solution because VMs are not the solution and zero knowledge is helpful but not quite there.

macOS does it pretty well, right ?

Yes, this is exactly how Qubes OS works.

Not if I have anything to say about it. I want programs on my computing device to be able to access files and roam the internet at free will. In fact, I insist on it.

Agreed. I mean, AppArmor and SELinux exist to control file access, perhaps OSes should put more effort into user-friendly overlays to control processes and have audits to warn users when a piece of software has full system access.

As far as network control... We have open-source blacklists for various malicious websites. Perhaps we should also have "known-good" site whitelists and have OS-level blocking for that by default. Like, OSes running DNS-sinkholing of StevenBlack malware lists, and the option to enable "known-good" whitelists as well. Having a hosts file of 450,000 entries to sinkhole can bog down an interface coming up reliably... that process needs optimized.

There's a lot of money in the enterprise world doing similar things.

A lot of companies do this but I always get a ton of hate for saying this: Telegram is the worst offender I've seen. If you start digging through their apps, you see a ton of security practices that are anything but secure. And one of the hundreds of reasons I treat Telegram as the plague: get it away from me and burn it with fire.

All big companies pull these kind of tricks. Another variation is to retire the old setting and introduce a new one with a deceptive name that is default on again.

Can you please tell me what settings get auto re-enabled? I use Telegram as my primary messenger app. I just want to make a more informed decision if I should switch to Signal or something.

Presumably the risk is mitigated somewhat with the Flatpak version (`org.telegram.desktop`)?

This hasn’t happened to me absolutely ever in 10+ years.

For example?

Yes. I'm constantly annoyed by the dark patterns Zoom and Slack use to trick you into downloading their desktop apps. The web experience is practically indistinguishable and much more secure.

> Web versions are often more than good enough.

Except when you want actual end-to-end encryption, in which case web versions fundamentally cannot guarantee it today (and there are no plans to get there).

People using Telegram don't care so much about end-to-end encryption, so there maybe it makes sense to use the web version indeed.

When I really need to run an app on my Linux laptop, it always gets its own bubblewrap container.

Don't let yourself be fooled into thinking this is enough. Plenty of examples of, especially through wasm, being able to reach far beyond what they're supposed to.

It gets buttoned up fast and is always getting better, but its absolutely not a silver bullet.

Don't most things people use day-to-day for both work and entertainment require use of the actual app these days, or at least make it very difficult to do so?

Even on Mac, where apps like Dropbox showed you a FAKE DIALOG to STEAL YOUR ADMIN PASSWORD:

https://news.ycombinator.com/item?id=12463338

Or the reason to run Firefox in a FreeBSD jail to get server-grade security. But the question is can an attacker get access to the Firefox profile data? Because you cannot block that from Firefox, obviously.

I guess it also has access to the cookies for all your logins.

The little I have to run Telegram Desktop for, I run in a VM. I'd never let the little oligarch's code touch my desktop OS.

interesting you mention. because Firefox doesn't have a way to disable the single instance functionality which was used on this telegram vulnerability.

one long time Firefox contributor have been for a couple years now removing every part of the --noremote option. even botching (Ooops!) the console notice that the flag was no-op some time ago.

It is? I did suspect it could have been written and maybe found with AI, but I didn't notice many claudisms

It's annoying, yes, but I think in this case, the information is important enough that people should jump over their shadow and read it.

You wouldn't ignore a zero-day announcement either because the formatting is ugly.

Yes, just close your eyes, don't worry! Close the tab...

At the same time the mobile operating systems are vulnerable to vendor lock-in due to the absence of this functionality. It is clearly a worse problem that a user can't give their backup system access to the photos stored by other applications (often social media), or for instance reliably capture media streams to use in for instance a remixing application. Bringing custom clients when the software originally used to create the interesting files starts acting against the users by introducing subscriptions or being abandoned is another example of the user dictating what software accesses what files is critical to secure the users operations. Consumers need security against commercial interests infinitely much more than commercial interests need protections against consumers, and it would be unethical to enable commerce at the expense of individuals like the mobile operating systems do.

> It's not strictly-speaking a Telegram-specific vulnerability. It's a vulnerability of all modern desktop operating systems allowing any user process to read/write any user file.

No, it's definitely a Telegram specific vulnerability. It might be worse because of poor defense in depth, but without Telegram itself being vulnerable it wouldn't matter.

If you don't believe it's a vulnerability, then you must believe that tricking Telegram into uploading your messages database to the attacker, leaking all your private conversations, is A-OK? Telegram owns that file, after all.

Yes, and there are many ways for apps to opt into this, to limit their own blast radius in a case like this.

Does Telegram do that, or do they consider themselves beyond bugs, just like they consider themselves too clever and untouchable by anyone to need end-to-end encryption?

> vulnerability of all modern desktop operating systems allowing any user process to read/write any user file

not true on macos.

That's broadly-speaking a vulnerable design of all OSes, but strictly speaking it is a bug in Telegram that is now fixed at the app level. Though sandboxes / app isolation solutions exist even in the broadly vulnerable OSes, so apps could use them already today to avoid such issues in the future?

Telegram is available sandboxed from the Mac App Store on macOS.

> Ideally all programs should be isolated from the underlying filesystem and be able to read only their own files and files from per-program data directory

So how will you spam all the group chats you're on with meme gifs downloaded from facebook then? :)

MacOS sandboxes user folders by default. The user need to explicitly give a permission for every application.

> It's a vulnerability of all modern desktop operating systems

Uhm, OpenBSD would like a word, buddy.

https://man.openbsd.org/unveil

It is.

Not all user processes upload those files somewhere surreptitiously.

Of course operating systems should support that isolation (hopefully in some better way than the hell that smartphones are), but it's not like Telegram can blame the OS for this vulnerability.

It was reported to a third party platform which the author says is likely clogged up.

They are restructuring their companies regularly and keep the core company small.

Still we are using it, because UX kills any other app and people that are (probably) behind it will cause almost no harm to casual, not-interesting people :)

And yes, I know that by default chats are not E2E, that phone number has way too many effects on accounts etc. Still, UX and agencies interested in important people are more welcome than data selling, ad-based companies.

It was, but most people will believe what their peers (real or parasocial) say over the collective screams of every security researcher on the planet, so here we are.

Absolutely, but mostly for their protocols, statements, people and infrastructure.

A file exfiltration vulnerability is still noteworthy.

Here's one from Filippo

The Most Backdoor-Looking Bug I’ve Ever Seen - https://words.filippo.io/telegram-ecdh/

It has this feature where it tells you about other users that are on the platform. I mean it's not a huge leak, but right off the bat it's pretty poor security posture. For an app that competes with other chat apps on supposedly being more secure and privacy aware, it does worse than whatsapp on that end.

I heard Telegram client from aur repository on Arch Linux supports secret chats.

That is such a JiaTan grade feature because it’s an insane way to implement it but also plausibly deniable.

Yeah, something like that would not have prevented the account takeover part, though, which relies on Telegram's own files; or the access to cached files.

You would still get a notification inside Telegram that someone else logged in (plus it sends the login code to your session first before you can fallback to SMS) and you can log them out. The "attacker" can't delete your account or log out your sessions because he can't use certain features on a fresh login, there is a downtime. But yeah, he can read all your chats. Same should be true for any app that uses phone number login. That's why there is a password feature.

I guess that’s the idea with phone number based services. Imagine if you could not sign up for telegram/ WhatsApp/ whatever because someone used your number before you.

was a feature.

technically, this is one agency burning the feature of another agency.

Show us the backdoor https://github.com/signalapp/Signal-Android

With Telegram it is very easy: NOTHING is end-to-end encrypted by defaults, and group / desktop chats can't be end-to-end encrypted. So operating a honeypot server that gets access to billion users' data, is the most obvious honeypot out there.

Yet the oligarch who supposedly lives in exile has visited Russia over 60 times since https://kyivindependent.com/kremlingram-investigation-durov/

is that a threat or an ai doomsday whataboutism