QML error makes me concerned for ProtonMail's security

Continuing the discussion from QT 6.8 - QML Error returns since update:

I simply wanted to add this reply but the thread is automatically closed, so replying has created a new thread. I really, really wanted to say this so badly, so forgive me for digging this up and making a new thread for it…

I can’t even add this reply to ProtonMail’s own issue thread because they locked that, they feel they are done with the topic. They keep repeating that they “don’t support Arch”, ignoring the many good points made:

  • The error is due to them using an older, unsupported version of QT, which has been in EOL for over a year, and was not even an LTS version
  • The argument that it’s “only interface code” is ignorant and that brings me to what I wanted to add

I think any decent programmer knows that’s a really bad conclusion - doesn’t matter where the weakness is, GUI code or not, which brings me to the part I wanted to say so badly;

Famously, the jailbreak hack for “Zelda: Twilight Princess” on the Nintendo Wii used a buffer overflow in the dialogue code… it simply used a hacked save file that stores a very long name for your horse Epona, and the save file puts you right next to an NPC who will try and say Epona’s name - you attempt to talk to him, and boom - suddenly the screen is full of linux commands scrolling by. System is hacked.

Hi Domarius, this bug has thankfully been fixed in the most recent release of Protonmail Bridge: https://github.com/ProtonMail/proton-bridge/releases/tag/v3.15.0 The Arch Linux package maintainer also kindly patched the package well in advance of that using a patch contributed by GitHub user Cimbali. :slight_smile:

With that said, I agree that their initial response was extremely disappointing for the reasons you have outlined.

2 Likes

Oh that’s a relief, thank you. I hadn’t noticed because I’d honestly given up on that ever changing and switched to starting it on the command line, I’m just so used to seeing things in the Linux space never get addressed after seeing that kind of response. But then, this is paid software so there should be a bit more accountability.

Can’t believe whoever was responsible for that initial response was allowed to respond and even lock the thread, in a company who’s whole point is security and we are paying them.

Yeah I absolutely agree that the developer response was terrible.

Brodie has a video on it and - what do you know - Arch is actually supported! https://www.youtube.com/watch?v=rGe64YdkZ1w

1 Like

Oh very cool - and it took me half the video to realise he has the same accent as me, great to see another Australian YouTuber, heheh. Good video, very cathartic, and I wonder if that exposure got the bug fixed…

It’s very clear this developer didn’t feel like understanding the issue and was just using the name of the platform to get out of it.