:POLICE: A critical security vuln was fixed in Ditto Android that would allow an attacker to steal your nsec by getting you to tap an evil URL. :wisp_sad:

A new version has been released onto Zapstore and Google Play. UPDATE DITTO ANDROID IMMEDIATELY. :POLICE: :POLICE: :POLICE:

Ditto on web and iOS are unaffected. The issue only affects Android because it was a problem in the Android link handler. People using Amber are unaffected by nsec theft but should upgrade anyway because the attack is still arbitrary code injection via evil URL.

What does an evil URL look like? It contains JavaScript code inside of the URL. The path was not being escaped properly, so it could break out and run any script. The fixed version completely changes the way native code triggers UI navigation (event-driven) so we never inject JS code into the UI at all anymore.

Huge shout out and thank you to @calle for connecting me to the team behind https://v12.sh/ who discovered this vuln, and huge shout and and thank you to them for responsibly disclosing it to us. 🙏 They also discovered some other issues we patched in this release, but the evil URL is by far the worst.

People are playing with webxdc in Armada 👀

Time to joyscroll again

Z̷̡̨̧̺͚̩̙̯̠̟̼̖̖̞̈͐̋͌̈̎̈́̍͛̍̉̕̚ä̵̯̻͇͛̓l̶̛̖̙͙̐̏̿́̽̄͜͝͝ģ̶̨̧̮̝̻͉̱̩͉̖̅͆̈́̚͠ơ̴̡̞̦̽̈́̍͌͑̎̎͗̃̈́̄̕͠ͅ ̵̢̢̤̳̤͖͉͇͂̓͗̾̔́̈́́͘͜ş̴̫͎̰̘̜̬̆̎̂͒͊̈́̚̚t̶̨̳̒̈́̃̆͝i̶̡̢̧̹̫̤͇̘̼͐̍̑̄̈́̌̒̀̇͜͝ļ̶̯̰̦̜̤̯͈̫̰̬̥̭͍̈̊̂̌̽͛͑̕͜l̸̖̄̇ ̶̧̯͇̺͛̑͑̊͗̀̓̓̈́̀̂̈̕̚w̷̨̞͙̲̝̳̮̝̮͊́͋ơ̴̝̔͊̏̈̈́̌̈́͂̏̐̆̕͝͠ŗ̵̨̝̻̜̘̭̞̹̯͂̎̒̓͝͝ķ̵̧͉͚̣͗͒̌͒̒s̶͍̜̰̰̹̜̜͙̗͓͖͕̣͕̤͒̌̔̐̓̀

If AI companies would just upload the pdf for all the books they're destroying it would bother me a lot less.

Doing a mass migration of Soapbox repos onto ngit

It has so many comments GitHub times out

My favorite GitHub issue got closed. Time to go to bat.