Skip to content

Instantly share code, notes, and snippets.

@arubdesu

arubdesu/case785583.txt

Created February 11, 2015 16:57
Show Gist options
  • Save arubdesu/8272eddfe52601cac4c0 to your computer and use it in GitHub Desktop.
Save arubdesu/8272eddfe52601cac4c0 to your computer and use it in GitHub Desktop.
Download ZIP
Y'know. Box
Raw
case785583.txt
http://enterprisemac.bruienne.com/2015/02/07/box-cutting-how-i-stumbled-onto-a-serious-security-flaw-in-box-sync-for-mac/
So you rotated your API keys! Congratulations. Forcing a reboot with an auto-update is unacceptable. Especially if you didn't expose a way to turn off auto-updates to begin with. Don't do that.
Oh, and this document is wrong: https://support.box.com/hc/en-us/articles/201084243-What-features-from-Sync-3-x-have-been-removed-in-Sync-4-0-
where it says you cannot disable auto-updates.
$ sudo defaults write /Library/Preferences/com.box.sync.plist auto_update.enabled -bool False
Currently pushing this to my fleet hoping to race your auto-updater. Don't make me do that. It harms everyones productivity.
https://www.dropbox.com/s/2frza77m1il0hfk/baaaaaaad.png
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment