Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Copy Fail

copy.fail

Post reply on HN
Print view View original

401–410 of 545 posts

Re: Copy Fail

#401

Post by fuomag9 »

still_grokking wrote: post #260
staticassertion wrote: post #257

Earlier quoted context omitted.

The response from Greg was that Mythos proved that upstream was right all along and that they'll continue to do things the same way. That's my recollection, at least - pretty sure it was something like that, could have been even worse though and I'm misremembering. The stance was never sustainable, hence linux LPEs being constantly available. The solution is to treat your kernel as impossible to secure. Notably, gvis…

How about SELinux, like on Android?

selinux on enforcement mode did not mitigate the exploit when I tested today on fedora coreos :(

Re: Copy Fail

#402

Post by pelasaco »

Fun day for people running bare metal GPU nodes, where teams have been training models for months, and now it must be abruptly aborted to apply security patches... is that something that can be resumed, or do they have to restart from scratch?

Re: Copy Fail

#403

Post by Orygin »

otherme123 wrote: post #398
stingraycharles wrote: post #356

Earlier quoted context omitted.

I think they’re using it to promote their product, Xint Code, which was used to discover it. That’s the way I read it anyway.

I hope they sell a lot of Xint Code licenses, so they don't have to sell their findings.

Considering they kinda botched the disclosure to Linux distros, I guess they wanted something most sensational to sell more licenses.

Re: Copy Fail

#404

Post by a96 »

giis wrote: post #267

As soon as I read this >Shared dev boxes, shell-as-a-service, jump hosts, build servers — anywhere multiple users share a kernel. any user becomes root jumped out of bed and went straight into webminal.org servers as local user and ran the python code. It says permission denied on sock() call. Then I tested with local laptop with it: ``` $ uname -a Linux debian 6.12.43+deb12-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.4…

Beware that running this kind of thing even as a test on a host you don't own may well be a criminal offense!

Re: Copy Fail

#405

Post by Orygin »

vntok wrote: post #360
ramon156 wrote: post #347

Earlier quoted context omitted.

I dont really get why you'd - buy a domain - vibe code a page/artifact/whatever (which, given the quality of LLM wordings, only makes an argument less strong) - post it on HN with no further explanation in the title Why not write a detailed report? Even a tweet makes much more sense in my head than this. Even a logo?? Sorry if this comes over as salty, I guess I'm just not getting the thought process.

Definitely comes over as salty. Naming major flaws has been a tradition for decades. Remember Heartbleed? It had a site and a logo :) Shellshock, Meltdown, Spectre as well. A few more: https://github.com/hannob/vulns This site though is pretty useful; first it serves as a central location to point people to with short links in chats/emails/whatever, then it has a quick visual explainer and a link to the detailed tech…

It used to be done for fame and visibility. Give a marketable name and a website, your exploit will be talked about and your name will shine in the industry.

Now it's done by an LLM to sell more LLMs services. Disclosure is botched to have the most sensational title so more click more upsell.

Re: Copy Fail

#406

Post by Orygin »

2001zhaozhao wrote: post #192
phreack wrote: post #40

The page itself seems vibecoded and a bit of an advertisement, but it does look like the vulnerability is real and high risk. It does explain the big security update I just got, guess I'll prioritize updating today.

This is pretty obviously an advertisement but it's a pretty good advertisement imo, it pairs a meaningful contribution to the OSS ecosystem (discovering and patching a real bug) with selling your cybersecurity tool at the same time.

The incentive previously was having more secure software making a name for yourself. The incentive now is finding the most noisy vulnerability so you can push FUD to sell your AI software.

Re: Copy Fail

#407

Post by buckle8017 »

mihaaly wrote: post #364
buckle8017 wrote: post #276

Earlier quoted context omitted.

You should take note that this is written by the person that wrote the bad patch. So grain of salt.

But is it true or not? Whoever wrote it. (for objective truth the subjects are unimportant)

It might have been true in 2002 but it hasn't been true since at least about 2010.

You've almost certainly never had a system that supported any hardware accelerated crypto that also required a kernel module.

It's much easier to expose as cpu extensions.

Re: Copy Fail

#408

Post by angry_octet »

eqvinox wrote: post #388
angry_octet wrote: post #375

Earlier quoted context omitted.

All the uses of vmsplice etc are a bit tricky, and that points to the need for a better interface. But given you're using splice, why not do the crypto in user space? A belief that it is better to be fast and buggy than safe and slower?

If neither a hardware component nor kernel key management is involved, crypto should be done in userspace, end of sentence. The more I think about it, the more I think it should be behind CAP_SYS_ADMIN, or a new CAP_KCRYPT (better name TBD. CAP_CRYPT_OFFLOAD?)

Yes it should definitely require a capability.

Still a risk that some admin-enabled method (like enabling an IPsec VPN) provides a path to it, but would reduce the potential for crafting weird inputs.

Re: Copy Fail

#409

Post by angry_octet »

eqvinox wrote: post #388
angry_octet wrote: post #375

Earlier quoted context omitted.

All the uses of vmsplice etc are a bit tricky, and that points to the need for a better interface. But given you're using splice, why not do the crypto in user space? A belief that it is better to be fast and buggy than safe and slower?

If neither a hardware component nor kernel key management is involved, crypto should be done in userspace, end of sentence. The more I think about it, the more I think it should be behind CAP_SYS_ADMIN, or a new CAP_KCRYPT (better name TBD. CAP_CRYPT_OFFLOAD?)

I'm also wondering if it couldn't be rewritten to use io_uring interfaces.

Re: Copy Fail

#410

Post by Joe_Cool »

giis wrote: post #267

As soon as I read this >Shared dev boxes, shell-as-a-service, jump hosts, build servers — anywhere multiple users share a kernel. any user becomes root jumped out of bed and went straight into webminal.org servers as local user and ran the python code. It says permission denied on sock() call. Then I tested with local laptop with it: ``` $ uname -a Linux debian 6.12.43+deb12-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.4…

Anyone tried in an Azure Cloud Shell?

Asking for a friend ;)

EDIT: Don't. "/s" in case not obvious.

Post reply on HN