←back to thread

Helm local code execution via a malicious chart

(github.com)
171 points irke882 | 1 comments | 09 Jul 25 05:49 UTC | HN request time: 0.28s | source
Show context
ivan4th ◴[09 Jul 25 12:23 UTC] No.44509174[source]▶
Helm is an abomination, as the whole idea of using a text template engine to generate YAML is. And this vulnerability adds insult to injury ;)

Sorry, just can't really recover from trauma of counting spaces and messing up newlines, etc. when writing Helm templates. You know, Lisp "sucks" because "you need to count parenthesis" (you actually don't), yet Helm is a widely accepted technology where you need to count spaces for (n)indent ;)

replies(5): >>44511394 #>>44512692 #>>44512702 #>>44515521 #>>44516363 #
JohnMakin ◴[09 Jul 25 17:27 UTC] No.44512692[source]▶
This isn't a uniquely helm thing though, they mostly use modified go templating. Lots of other things do this with yaml as well.
replies(2): >>44515896 #>>44531265 #
1. moondev ◴[11 Jul 25 12:15 UTC] No.44531265[source]▶
The funny thing is helm is as good or bad as what you make it. When folks complain about helm they are actually complaining about their own self created charts or poor selection of charts they install.