Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Cloudflare responded to the “Copy Fail” Linux vulnerability

blog.cloudflare.com

Post reply on HN
Print view View original

41–50 of 86 posts

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#41

Post by senko »

miki123211 wrote: post #33
Goronmon wrote: post #10

Earlier quoted context omitted.

If we are taking that attitude why not go all the way? Titles are standard clickbait.

With LLMs, you could actually do anti-clickbait titles. Extract the article text with something like r.jina.ai, and ask an LLM to generate a ~80-character summary that explains the main point of the article for people too busy to read it. I do think this would genuinely be useful.

You're absolutely right! (errm...oops....anyways...)

The fact that LLMs usually generate anodyne summaries is actualy a benefit here.

I used my website-to-markdown tool[0] to get the text, piped the output to claude -p and got a pretty decent "Patching Copy Fail at scale: how bpf-lsm bought us time before the kernel reboot" result.

[0] https://markshot.dev

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#42

Post by senko »

john_strinlai wrote: post #37
miki123211 wrote: post #33

Earlier quoted context omitted.

With LLMs, you could actually do anti-clickbait titles. Extract the article text with something like r.jina.ai, and ask an LLM to generate a ~80-character summary that explains the main point of the article for people too busy to read it. I do think this would genuinely be useful.

back in my day, people just used the thing that rattles around inside their skull for such tasks

To do that, you need to read the article first, which is the point of click-bait titles. The point of the defense is to avoid exposing your neurons to that stuff.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#43

Post by john_strinlai »

senko wrote: post #42
john_strinlai wrote: post #37

Earlier quoted context omitted.

back in my day, people just used the thing that rattles around inside their skull for such tasks

To do that, you need to read the article first, which is the point of click-bait titles. The point of the defense is to avoid exposing your neurons to that stuff.

i would hope that people are reading articles first and submitting them to hn because they are interesting, rather than submitting articles to hn blindly.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#44

Post by computerfriend »

mkj wrote: post #38

If they're already running a custom Linux kernel build, why did they have AF_ALG enabled? Seems the perfect situation to limit features to only those actually being used.

In the article they explain that some of their services use it.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#45

Post by senko »

john_strinlai wrote: post #43
senko wrote: post #42

Earlier quoted context omitted.

To do that, you need to read the article first, which is the point of click-bait titles. The point of the defense is to avoid exposing your neurons to that stuff.

i would hope that people are reading articles first and submitting them to hn because they are interesting, rather than submitting articles to hn blindly.

I agree with you on that, but that just holds true (we hope) for the OP.

HN already editorializes the title, to help everyone other than the OP (not all people agree over what's interesting to them). Now we're just arguing over the degree.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#46

Post by gamegoblin »

Velocifyer wrote: post #32
gamegoblin wrote: post #26

Earlier quoted context omitted.

I learned a few years ago that HN also editorializes by dropping "world's" from titles Before: Teens break record for world's longest kickball game After: Teens break record for longest kickball game

I do actually agree with that change.

It occasionally leads to kinda ambiguous headlines, e.g.

"China opens world's longest undersea tunnel"

vs

"China opens longest undersea tunnel"

It's a little unclear if it's the longest undersea tunnel in the world, or just in China

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#47

Post by tempest_ »

jmclnx wrote: post #23

> Linux kernel build based on the community's Long-Term Support (LTS) CopyFail only highlights why Companies want LTS. If there was a supported kernel built prior to 2017, most large companies would still be on that version, avoiding this issue all-together. The corporate mindset is usually "never upgrade unless there is new hardware needed or critical software failure". All CopyFail did was reinforce that mindset. I…

The longer you wait the more painful the switch will eventually be.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#48

Post by jmalicki »

Velocifyer wrote: post #32
gamegoblin wrote: post #26

Earlier quoted context omitted.

I learned a few years ago that HN also editorializes by dropping "world's" from titles Before: Teens break record for world's longest kickball game After: Teens break record for longest kickball game

I do actually agree with that change.

It doesn't give enough recognition to the true longest game of space kickball.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#49

Post by electra2012 »

> Despite our practice of deploying Linux patch updates every two weeks, we remained vulnerable because a month-old mainline fix had yet to be backported to our primary kernel line.

Hopefully a wake-up call to those who believe older distro LTS kernels are getting all the security fixes Canonical and Redhat would want you to believe.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#50

Post by parliament32 »

staticassertion wrote: post #25
parliament32 wrote: post #9

Earlier quoted context omitted.

It's curious they're just "monitoring" rather than preventing. In a serious environment you'd run IPE with dm-verity/fs-verity to ensure binaries are whitelisted and integrity-checked at every execution.

lol no one does that (edit: or, rather, that is extremely uncommon, even in "serious" environments, for a ton of reasons).

Look at the FedRAMP requirements around integrity protection, then look at how massive the list of complaint products is. I promise, pretty much everyone in regulated environments is. It's so prevelant Azure is even pushing a turnkey solution for k8s https://learn.microsoft.com/en-us/azure/aks/use-azure-linux-...
Post reply on HN