101–110 of 113 posts
If you have the Cisco 9000 Series, patch them now! This SSH backdoor allows an unauthenticated, remote attacker to login as root.
Nexus 9000, running ACI, not normal NX-OS, as opposed to the ASR 9000 series which are common internet routers. Cisco model numbers are fun.
Earlier quoted context omitted.
And often neither.
Then from whence came their imperfection?
And my response to the OP was to push back on the idea that only "idiots" could make mistakes. To me that is an absurdly reductionist view of human nature.
Earlier quoted context omitted.
Then from whence came their imperfection?
Just stop. Is it really hard to understand that normal people can make mistakes without being malicious or incompetent? Imperfect and incompetent are not synonyms. And my response to the OP was to push back on the idea that only "idiots" could make mistakes. To me that is an absurdly reductionist view of human nature.
Earlier quoted context omitted.
Just stop. Is it really hard to understand that normal people can make mistakes without being malicious or incompetent? Imperfect and incompetent are not synonyms. And my response to the OP was to push back on the idea that only "idiots" could make mistakes. To me that is an absurdly reductionist view of human nature.
You tell me stop and then proceed to ask a question? How incredibly rude. I suggest you rethink your philosophy of discourse, and words (hint: most qualities such as incompetence and maliciousness exist on a continuum).
Earlier quoted context omitted.
You tell me stop and then proceed to ask a question? How incredibly rude. I suggest you rethink your philosophy of discourse, and words (hint: most qualities such as incompetence and maliciousness exist on a continuum).
Huh? You were labeling people as incompetent and supporting the OP's idea they were idiots. I was asking for empathy and understanding that people can make mistakes. And when I tell you to stop, I'm the rude one?
Earlier quoted context omitted.
Huh? You were labeling people as incompetent and supporting the OP's idea they were idiots. I was asking for empathy and understanding that people can make mistakes. And when I tell you to stop, I'm the rude one?
Yeah, telling somebody to cease communication and then asking them a question is absolutely rude. I think we're all incompetent to varying degrees in different domains, I don't think it's rude to express that. From my perspective I don't feel I was rude at all in this exchange until my last message with the snarky "hint" part, but I was okay with that since you had essentially just told me to shut up.
That is not the same thing as "Just stop communicating" or "shut up". I shouldn't have been so terse. Without the verbal cues you made a different assumption about what I was trying to say.
Earlier quoted context omitted.
Yeah, telling somebody to cease communication and then asking them a question is absolutely rude. I think we're all incompetent to varying degrees in different domains, I don't think it's rude to express that. From my perspective I don't feel I was rude at all in this exchange until my last message with the snarky "hint" part, but I was okay with that since you had essentially just told me to shut up.
You are misinterpreting my very terse "Just stop". If I were to expand it: "Just stop trying to convince me that people who make 'mistakes' can only be incompetent, malicious, or idiots" That is not the same thing as "Just stop communicating" or "shut up". I shouldn't have been so terse. Without the verbal cues you made a different assumption about what I was trying to say.
I never used the term idiots, that's you putting someone else's words in my mouth.
It's hard for me to imagine how a person can make a mistake in a given domain without being at least bit incompetent in it, hence my point about competence/incompetence existing on a continuum.
Edit: ...and if the person were malicious, it wouldn't be a mistake to begin with.
Earlier quoted context omitted.
You are misinterpreting my very terse "Just stop". If I were to expand it: "Just stop trying to convince me that people who make 'mistakes' can only be incompetent, malicious, or idiots" That is not the same thing as "Just stop communicating" or "shut up". I shouldn't have been so terse. Without the verbal cues you made a different assumption about what I was trying to say.
In this context I don't really see a difference between "stop making your point about the subject we've been communicating about" and "stop communicating in general." Am I supposed to talk about the weather, or engage in a lengthy meta-discussion about talking about the subject we've been talking about? I never used the term idiots, that's you putting someone else's words in my mouth. It's hard for me to imagine how…
We'll just have to agree to disagree regarding human nature.
Earlier quoted context omitted.
You are misinterpreting my very terse "Just stop". If I were to expand it: "Just stop trying to convince me that people who make 'mistakes' can only be incompetent, malicious, or idiots" That is not the same thing as "Just stop communicating" or "shut up". I shouldn't have been so terse. Without the verbal cues you made a different assumption about what I was trying to say.
In this context I don't really see a difference between "stop making your point about the subject we've been communicating about" and "stop communicating in general." Am I supposed to talk about the weather, or engage in a lengthy meta-discussion about talking about the subject we've been talking about? I never used the term idiots, that's you putting someone else's words in my mouth. It's hard for me to imagine how…
Mistakes aren't always made due to incompetency and extremely competent people still can make mistakes.
I think most of the "seven factors that lead to stupidity" could still affect someone very competent: https://fs.blog/2019/01/how-not-to-be-stupid/
Earlier quoted context omitted.
> I heard https://nvd.nist.gov/vuln/detail/CVE-2019-1804 is Cisco's ninth backdoor so far this year. Also the 9th they have fixed. > Not ninth security problem total, ninth backdoor. The ninth security problem Cisco shipped intentionally. How can you be sure it was intentional? > Meanwhile, the router that serves my office is from a company that's had fewer than nine security problems in the past ten years. How can y…
Backdoors aren't bugs like most others. Buffer overflows happen because someone mistypes or forgets a length check, etc. Backdoors are unusual: They happen because someone writes code of the form addAccount("s3kr3e", "s3kr3t"), and that's code that's written. You can typo and accidentally omit a bounds check, but you can't typo and accidentally end up with a valid SSH key pair and code that installs it. It's possible…
> Backdoors are unusual: They happen because someone writes code of the form addAccount("s3kr3e", "s3kr3t"), and that's code that's written. You can typo and accidentally omit a bounds check, but you can't typo and accidentally end up with a valid SSH key pair and code that installs it.
Not sure if you're intentionally trolling but a backdoor is simply some code which bypasses security that a particular person knows about. It does not have to be obvious. The ones that have plausible deniability are the better ones as that is considered a feature. That way the company can say "oops, we made a mistake".
To say that a backdoor must be obvious is absolute nonsense particularly for closed sourced binaries where disassembly and using simple tools like https://en.wikipedia.org/wiki/Strings_(Unix) would reveal the presence of such backdoor.
> (Personally I think shipping backdoors to test environments is fine. Including test environments at customers. Risky.)
It depends. Unless that "test build" specifically has an option that disables all "test related backdoors" then the answer is no. You cannot risk having something slip through to a production build.
As the previous poster said:
> I've worked for a company that built OS images for distribution to customers. Putting my SSH key in development image builds would have been convenient, but there was too much of a risk of exactly this problem; instead we just made it easy enough to download an SSH key on a development build (and start up an sshd) once you've booted it and have physical access to a terminal.
Another very common solution would be a template where at build time the keys are generated/imported by whatever build system is being used.
That way if something unintended happens or is "forgotten about", the build simply won't have a key at all and therefore will not work, rather than having a set of keys that are the same across all production builds.