Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

#include

blog.hboeck.de

Post reply on HN
Print view View original

121–130 of 132 posts

Re: #include </etc/shadow>

#121

Post by soraminazuki »

Ericson2314 wrote: post #119
soraminazuki wrote: post #78

Earlier quoted context omitted.

Nix won't help you secure your system from untrusted code written by internet script kiddies. It's a build tool and simply isn't designed for such things.

Um, yes it will? Linux namespeaces are linux namespaces; if you don't trust them we have bigger problems than Nix. It will certainly make sure the skids cannot do `#include ` and get useful information, for example.

That only works if you can turn your entire web application into a Nix build process, which is unrealistic at best. Nix is wonderful as a build tool, but it's quite a stretch to assume it's adequate for securing running applications. Plain containers, or even better, VMs are more suited for that purpose.

Re: #include </etc/shadow>

#122

Post by tlavoie »

boop-the-snoot wrote: post #100
softwarelimits wrote: post #82

Earlier quoted context omitted.

If that was my server I would of course put a joke in /etc/shadow - did you try to brute force the hashes? It would not be a great surprise to find some obvious funny content if you try?

That'd be pretty funny :D Like for example, if the entry for root in the joke /etc/shadow was the hash of "Thank you Mario! But our princess is in another castle!"

That's a pretty long passphrase, so someone would have to have put it in the word list directly to ever guess something that long. Would be fun though.

Re: #include </etc/shadow>

#124

Post by m463 »

ryanlol wrote: post #114
softwarelimits wrote: post #82

Earlier quoted context omitted.

If that was my server I would of course put a joke in /etc/shadow - did you try to brute force the hashes? It would not be a great surprise to find some obvious funny content if you try?

How many of your servers actually have jokes in /etc/shadow?

only the shadow knows

Re: #include </etc/shadow>

#125

Post by dang »

softwarelimits wrote: post #98
VBprogrammer wrote: post #86

Earlier quoted context omitted.

I'm trying to understand what your point is, are you denying that there was a vulnerability? As it stands it just sounds like you are just being a jerk on the internet.

I am asking for actual code that shows his statement is still true. The statements I read as an answer to my question contain zero value and still lots of very unrelated words. If you are sure there are vulns right now, please publish them. If not, shut up. Nillywilly "computers might be insecure" is on a level I would not expect to read on a side like this one. I just want to keep the quality level high for this new…

Can you please stop posting like this to HN? You've done this sort of haranguing a lot and it's not in the spirit of this site:

https://news.ycombinator.com/item?id=21812936

https://news.ycombinator.com/item?id=21812863

https://news.ycombinator.com/item?id=21812806

https://news.ycombinator.com/item?id=21656610

https://news.ycombinator.com/item?id=21656527

Please review the guidelines: https://news.ycombinator.com/newsguidelines.html. Note that they include: "Have curious conversation; don't cross-examine."

Re: #include </etc/shadow>

#127

Post by fghtr »

rbanffy wrote: post #126
fghtr wrote: post #92

Earlier quoted context omitted.

Not many if its Qubes OS.

One would be quite enough.

In fact, Qubes is using hardware virtualization IOMMU/VT-d [0], which has been escaped only once in 2006 by the project founder [1].

[0] https://www.qubes-os.org/doc/architecture/

[1] https://en.wikipedia.org/wiki/Blue_Pill_(software)

Re: #include </etc/shadow>

#128

Post by rbanffy »

fghtr wrote: post #127
rbanffy wrote: post #126

Earlier quoted context omitted.

One would be quite enough.

In fact, Qubes is using hardware virtualization IOMMU/VT-d [0], which has been escaped only once in 2006 by the project founder [1]. [0] https://www.qubes-os.org/doc/architecture/ [1] https://en.wikipedia.org/wiki/Blue_Pill_(software)

I trust Joanna Rutkowska's competence, but I wouldn't bet too much on chip makers not messing up again in the future.

It will be progressively harder, but it will happen.

Re: #include </etc/shadow>

#129

Post by Sohcahtoa82 »

didymospl wrote: post #52

On a related note, the XML standard defines a way to include external files in the document. If you come across a service which replies with a part of your request(e.g. validation errors) and uses XML parser with this feature turned on, which is true by default in many cases, this can be used to read arbitrary files. I wonder how many poorly maintained enterprise systems systems are vulnerable to that. https://www.ow…

XXE is a feature that never should have happened. Whoever decided that not only should it be a thing, but that it should be enabled by default, needs to have their keyboard taken away.
Post reply on HN