Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Maybe you shouldn't install new software for a bit

xeiaso.net

Post reply on HN
Print view View original

181–190 of 497 posts

Re: Maybe you shouldn't install new software for a bit

#181

Post by jeroenhd »

zmj wrote: post #117
cbarnes99 wrote: post #7

It really pisses me off that responsible disclosure timelines are being ignored.

If the fix commit is public, so is the issue being fixed.

With copy.fail the security patch wasn't listed as such so there wasn't a lot of attention on the issue as it remained dormant in most kernels for a while.

I don't doubt that the patch reversal + exploit PoC made by a third party is the result of people figuring out how patches work in open source projects like these.

Anyone with access to a good enough LLM can scour through supposedly minor bug fixes that might hide a critical vulnerability rather than doing it all manually. The LLM will probably throw up tons of false positives and miss half the issues, it you only need one or two successes.

Re: Maybe you shouldn't install new software for a bit

#182

Post by oever »

dguest wrote: post #169
marcus_holmes wrote: post #57

This was always a nightmare waiting to happen. The sheer mass of packages and the consequent vast attack surface for supply chain attacks was always a problem that was eventually going to blow up in everyone's face. But it was too convenient. Anyone warning about it or trying to limit the damage was shouted down by people who had no experience of any other way of doing things. "import antigravity" is just too easy to…

Most people will avoid sticking things in their mouth by default. They don't wait for the microbial cultures to come back positive to say no. We need a cultural shift toward code hygiene, which isn't really any different from the norms most cultures develop around food. It's a mix of crude heuristics but the sense of "eeew" is keeping billions of people alive.

That means going back to disabling Javascript or only allowing widely used, well-maintained Javascript libraries.

Re: Maybe you shouldn't install new software for a bit

#183

Post by jeroenhd »

Georgelemental wrote: post #150
Gigachad wrote: post #120

Earlier quoted context omitted.

For ios, rebooting your phone is extremely effective at removing exploits. The boot chain attestation stuff can verify the system is in a known state. If you are ultra paranoid you could enable lockdown mode which preemptively disables the entrypoints for exploits. So far I don't believe there has been any exploit which works with lockdown mode enabled.

If you are already exploited though, I doubt it helps

Getting persistent root is actually quite difficult on mobile operating systems. iOS famously so, but unless you're running a custom ROM other than Graphene, Android has some solid protections as well.

Regular phone reboots are a security measure at this point.

Re: Maybe you shouldn't install new software for a bit

#184

Post by jeroenhd »

pjmlp wrote: post #151

Remember the whole discussion when UNIX was supposed to not need anti-virus and talking down PCs? Behaviours matter more than OS security primitives.

The whole (mistaken) belief that Linux and macOS didn't require AV was based on the execute bit being present, something Microsoft fixed back in XP by making downloaded files as such and preventing them from being opened trivially.

If you have code execution, you can attack the OS.

Re: Maybe you shouldn't install new software for a bit

#185

Post by Hfuffzehn »

teiferer wrote: post #165
tclancy wrote: post #65

Earlier quoted context omitted.

So, to play Pandora, what if the net effect of uncovering all these unknown attack vectors is it actually empties the holsters of every national intelligence service around the world? Just an idea I have been playing with. Say it basically cleans up everything and everyone looking for exploits has to start from scratch except “scratch” is now a place where any useful piece of software has been fuzz tested, property t…

What we are seeing so far come out of the AI agent era is reduced not increased code quality. The few advances are by far negated by all the slop that's thrown around and that's unlikely to change. > any useful piece of software has been fuzz tested, property tested and formally verified. That would require effort. Human effort and extra token cost. Not going to happen, people want to rather move fast an break things…

Isn't blaming AI for that similar to blaming C for buffer overflows?

More people are producing more code because of easier tools. Most code is bad. But that's not the tools fault.

And in the end it is a problem of processes and culture.

Re: Maybe you shouldn't install new software for a bit

#186

Post by cperciva »

JoshTriplett wrote: post #47
cperciva wrote: post #30

Earlier quoted context omitted.

Debian is probably the best of all the Linuxes, but still suffers from split-brain: If patches are sent upstream first, Debian can't start digesting them until they're already public. With FreeBSD there's never any question of "who should this get reported to".

> Debian can't start digesting them until they're already public Not sure what you mean by this. Debian is able to handle coordinated disclosures (when they're actually coordinated), and get embargoed security updates out rapidly without breaking the embargo. Is there some other aspect of this that you're referencing?

The key words there are "when they're actually coordinated". Debian doesn't own the Linux kernel, and the kernel developers don't bother with coordinated disclosure, so the happy path of coordinated disclosure only happens when reporters make the non-obvious choice of reporting vulnerabilities to people other than the maintainers.

Re: Maybe you shouldn't install new software for a bit

#187

Post by yxhuvud »

dguest wrote: post #169
marcus_holmes wrote: post #57

This was always a nightmare waiting to happen. The sheer mass of packages and the consequent vast attack surface for supply chain attacks was always a problem that was eventually going to blow up in everyone's face. But it was too convenient. Anyone warning about it or trying to limit the damage was shouted down by people who had no experience of any other way of doing things. "import antigravity" is just too easy to…

Most people will avoid sticking things in their mouth by default. They don't wait for the microbial cultures to come back positive to say no. We need a cultural shift toward code hygiene, which isn't really any different from the norms most cultures develop around food. It's a mix of crude heuristics but the sense of "eeew" is keeping billions of people alive.

Most people start out as kids that does exactly that.

Re: Maybe you shouldn't install new software for a bit

#189

Post by pjmlp »

jeroenhd wrote: post #184
pjmlp wrote: post #151

Remember the whole discussion when UNIX was supposed to not need anti-virus and talking down PCs? Behaviours matter more than OS security primitives.

The whole (mistaken) belief that Linux and macOS didn't require AV was based on the execute bit being present, something Microsoft fixed back in XP by making downloaded files as such and preventing them from being opened trivially. If you have code execution, you can attack the OS.

Indeed, when one installs dependencies all over the Internet, or even better, key projects use "curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh" as default suggestion on how to install them, attackers have the work done for them.

Re: Maybe you shouldn't install new software for a bit

#190

Post by foresto »

weregiraffe wrote: post #168
c7b wrote: post #162

Earlier quoted context omitted.

My pet theory is that package managers will one day be seen like we see object-oriented programming today. As something that was once popular but that we've since grown out of. It's also a design flaw that I see in cargo/Rust. Having to import 3rd party packages with who-knows-what dependencies to do pretty much anything, from using async to parsing JSON, it's supply chain vulnerability baked into the language philos…

But you can't expect the language std to supply you with every package under the sun.

A stdlib doesn't have to provide everything under the sun in order to be helpful here.

Languages with rich standard libraries provide enough common components that it's feasible to build things using only a small handful of external dependencies. Each of those can be carefully chosen, monitored, and potentially even audited, by an individual or small team.

That doesn't make the resulting software exploit-proof, of course, but it seems to me much less risky than an ecosystem where most programs pull in hundreds of dependencies, all of which receive far less scrutiny than a language's standard library.

Post reply on HN