I get your point that the exploit existed before it was identified, but an unmitigated exploit that people are aware of is worse than an unmitigated exploit people aren't aware of. Security through obscurity isn't security, of course, but exploiting a vulnerability is easier than finding, then exploiting a vulnerability. There is a reason that notifying the company before publicizing an exploit is the standard for security researchers.
You're right that it's never an OK title, because fuck clickbait, but until it's patched and said patch propagates into the real world, more people being aware of the hole does increase the risk (though it doesn't sound like it's actually a huge show stopper, either).
Weakness and risk are distinct things, though—and while security-through-obscurity is dubious, “strength-through-obscurity” is outright false.
Conflating the two implies that software weaknesses are caused by attackers instead of just exploited by them, and suggests they can be addressed by restricting the external environment rather than by better software audits.
In my opinion Dan Goodin always reports as an alarmist and rarely gives mitigation much focus or in one case I recall, he didn't even mention the vulnerable code never made it to the release branch since they found the vulnerability during testing, until the second to last paragraph (and pretended that paragraph didn't exist in the last paragraph). I can't say in that one case, it wasn't strategic but it sure seemed that way.
For example, he failed to note that the openssh 9.6 patch was released Monday to fix this attack. It would have went perfectly in the section called "Risk assessment" or perhaps in "So what now?" mentioned that people should, I don't know, apply the patch that fixes it.
Another example where he tries scare the reading stating that "researchers found that 77 percent of SSH servers exposed to the Internet support at least one of the vulnerable encryption modes, while 57 percent of them list a vulnerable encryption mode as the preferred choice." which is fine to show how prevalent the algorithms are used but does not mention that the attack would have to be complicated and at both end points to be effective on the Internet or that the attack is defeated with a secure tunnel (IPSec or IKE for example) if still supporting the vulnerable key exchange methods.
He also seems to love to bash FOSS anything as hard as possible, in what to me, feels like a quest to prove proprietary software is more secure than FOSS. When I see his name as an author, I immediately take it with a grain of salt and look for another source of the same information.
For those of you who think you are using a local pharmacy, you might want to check whether or not they're owned by one of these. They buy out local pharmacies without obviously rebranding. And then they kill the store. At least, that's Rite Aid's MO.
It is crazy how in a country where everyone sues everyone all the time things like that happen. I had assumed that such a system would lead to a more robust system where every manager to ceo is vetting their business against these problems to not get sued. Apparently the liberal system of suing anyone all the time does not at all replaces a governmental body that defines strong consumer protection rights. Reading this, Turbotax and Wells Fargo News teaches me that a suing society is not cleansing itself from predatory behaviour.
Here is a list of the top 5 most litigious countries by capita: 1. Germany: 123.2/1,000 2. Sweden: 111.2/1,000 3. Israel: 96.8/1,000 4. Austria: 95.9/1,000 5. U.S.: 74.5/1,000. The Top 10 also includes the UK (64.4); Denmark (62.5); Hungary (52.4); Portugal (40.7); and France (40.3).
As you can see, the risk of lawsuits in the U.S. is less than in Germany, Sweden, Israel, and Austria, and not much greater than the other countries listed in the top 10. Simply stated, Americans are not as litigious as many believe. While the large verdict against McDonalds for serving hot coffee received enormous publicity, that judgment was significantly reduced on appeal and the plaintiff spent the left of her life being ridiculed.
I worked at a pharmacy and the only time it actually happened was when a patient tried to sell their Vicodin to an undercover cop outside the store. The cop came in and asked for the information about the prescription and we gave it to him.
Yeah, I didn’t say any of that but ok. HIPAA/employers actually require you to give law enforcement information in a variety of situations, including specifically the situation I mentioned:
To report PHI that the covered entity in good faith believes to be evidence of a crime that occurred on the covered entity’s premises (45 CFR 164.512(f)(5)).
Is that without a warrant? It wouldn’t be hard to impersonate a cop or even a cop with a grudge against someone to come find out what medications they are taking to dig further into someone’s lives and ruin said life.
Yes, without a warrant. It’s in the Privacy Notice in any retail pharmacy.
Impersonating a cop is a pretty big step that’s illegal in its own right but we did have moms trying to see if their adult daughter was on birth control, but that’s pretty easy to stop. Just lock their profile and ask the patient to make up a passcode or only deal with them in person.
What a sensational, over blown article. ArsTechnica this is shitty journalism and you should know it.
The headline would be about as correct if it said “SystemD update will bring Amiga’s Guru Meditation screen to Linux.”
This update has nothing to do with Windows. Error displays with additional information about the crash is not exclusive to windows, nor new. In fact a Kernel Panic screen happened in Unix.
The majority of linux articles have me checking the comments first to see if someone talks about ridiculous click bait crap, honestly saved me a lot of time.
I suppose that’s the main problem, I didn’t check the article since the title reeks clickbaity enough. However I wouldn’t share an article if the the title obviously is a clickbait, I’m sure there are bunch of respectable sources about this development.
As people have said in some of the many, many other threads on this subject, if they really wanted to copy someone else's style of full-screen error message they'd have done much better to go with "Guru Meditation"
At first I was like WTF but actually it makes sense. A screen showing an error code is much better than a hard reset, blinking cursor, kernel panic, or just black screen you usually get when something bad happens on linux.
The article didn’t mention this, but would disabling the UEFI logo in the boot screen mitigate the vulnerability until proper patches get rolled out? (Or honestly at this point, I’d keep it disabled even after it’s patched in case they didn’t patch it right. UEFI’s are all proprietary so it’s not like you can check.) Since the vulnerability is in the image parser, would bypassing that be enough?
I’ve never been a fan of the UEFI logo inserting itself into the boot screen. It’s basically just an advertisement for the hardware vendor because they’re jealous of the OS having the spotlight. And it’s an ad that, like so many other ads before it, screws over the security and privacy of the advertisee because fuck you that’s why.
I don’t know. It looks more aesthetically consistent. Your computer has to display something. Average users would be scared if it dumped logs on the display. so the vendor logo makes sense. It COULD just say loading, but this is a bit pedantic I think.
With UEFI, it goes “Motherboard Logo -> Motherboard Logo”
Sure, it’s more consistent, but the alternative is not user unfriendly, the only people it’s unfriendly to is the marketing wankers at Dell, Lenovo, Acer, etc.
When it comes to security, particularly at boot time, fuck the user. Users don’t interact with devices at boot time so it doesn’t matter if it shows a blank screen, a mile of logs or a screaming clown penis. If it was up to users no device or service would have a password or security of any kind, and every byte of information about your life would be owned by 'The Cloud." Let the marketing wanks insert their logo into the Windows boot process,
I want to insert my own logo into the boot process, and I want these ducking vendors to properly validate and assess their mother ducking software. But nooo, penetration tests and any remediations are too expensive for these pieces of bit. Why do it when you can just stick your dick in everyone’s face, right?
arstechnica.com
Newest