5 ms·
I think in many cases there's no conscious decision not to implement TLS or code signing. It could just be that no one who cares enough about security is in a p
by pfg 10y ago
I think in many cases there's no conscious decision not to implement TLS or code signing. It could just be that no one who cares enough about security is in a position to drive that change. There are many organizations that quite simply lack any kind of security culture.
- Dagwoodie 10y agoMy AC66U runs the linux 2.6.22.19 kernel which has a ton [0] of vulnerabilities in it. Hopefully they back-fix vulnerabilities without updating the kernel version but I doubt it. I would never trust this or any other consumer piece of hardware as a border device considering the sad state they are all in. Yet, millions of homes have this or worse sitting as their only gatekeeper into their networks. [0] https://www.cvedetails.com/vulnerability-list.php?vendor_id=33&product_id=47&version_id=123185&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=3&trc=345&sha=19caefbbd2f0eec2b469e364e001c747758306de https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
- icebraining 10y agoYet, millions of homes have this or worse sitting as their only gatekeeper into their networks. Which is why computer OSs should start treating these as the potential hostile devices they are. None of this "trusted network" nonsense, no unencrypted or unauthenticated connections between devices on the same LAN, etc.
- spdegabrielle 10y ago"We have met the enemy and he is us."
- snuxoll 10y agoNow that IPv6 deployment is getting up there it'd be really nice to see increased use of IPSec. No need to rely on the network that I'm on or the potential that some actor has attempted to MITM a TLS connection (because a lot of people are just going to ignore TLS warnings, unfortunately).
- bcook 10y agoThe Asus version of the 2.6.22.19 Linux kernel has many, many backports, so a simple vuln search for vanilla Linux 2.6.22.19 will not yield pertinent results.
- Raj123123 10y agoFine but many router vendors do not push updates for deployed routers. Majority of ordinary users barely know how to plug in an ethernet cable let alone download&update firmware.
- wmccullough 10y ago>It could just be that no one who cares enough about security is in a position to drive that change Bingo, I would also add that it isn't even a matter of caring. I suspect some of these people don't even know that they don't know. Which feeds exactly into your not caring statement. "Never attribute to malice that which is adequately explained by stupidity"
- headShrinker 10y agoI will be honest, I run a small web community of about 20,000 users, so it's different than hardware/firmware updates for potentially mission critical systems... That said, the reason I haven't implemented tighter security practices isn't so much a response to cost-benefit analysis. My users simply haven't made a lot of noise demanding more strict password tolerances, identity verification, or SSL. I have a limited amount of time I can apply to the demands of the community, 'more security' rarely if ever comes up.
- heinrich5991 10y agoYou should definitely set up SSL/TLS for your web site. Let's Encrypt lets you easily do that.
- kuschku 10y agoUntil it decides to completely fuck up your apache webserver config and you have to spend a whole day to properly configure your virtual hosts again. I’ve done it twice, never again.
- sleepychu 10y agoYou can do it in certificate only mode. I think DNS challenge is even enabled now so you don't need to let it touch your running server at all. Of course it's a bit of admin every ~90 days but 4 times a year for free SSL isn't bad.