4 ms·

References, CVEs, etc. etc. etc. Can you break into my PC if I give your an external IP address or not? I guess you can't that's why you give me all those link

References, CVEs, etc. etc. etc. Can you break into my PC if I give your an external IP address or not? I guess you can't that's why you give me all those links which mean sh*t. Let unpatched Windows 7 SP1 have 1000 critical remote vulnerabilities - show me at least one that you yourself can exploit. I guess you don't understand how vulnerabilities are discovered and published. And what the purpose of CVE is.

orf 10y ago
Ahh the old "hack me m8" defence. Nice one. Yet again I don't see any actual substance to your replies. If you could post something, just anything to back your frankly outlandish claims out that would be awesome. I work for an infosec company, and the answer is yes. Yes any number of us could dos, get an RCE or otherwise fuck with your unpatched windows 7 machine that is missing 5 years of critical updates. Just fire up nessus, point it at your machine, see what it comes back with and find an exploit for one of those issues from our extensive library, or on any number of public resources. Bread and butter. We'd be in the wrong industry if we couldn't, and it's not exactly hard. However it would be pretty unethical/illegal to do so and who the hell wants to waste time doing that to a crazy person on HN. It's clear you're clueless, and that's fine because its your choice to be uneducated. Just please don't spread this misinformation on your blog. Or better yet do: write a big blog post about how security patches are not needed along with a "hack me please" challenge at the end. You've not nothing to worry about, right?
- mynameislegion 10y ago
  I don't see any substance in your replies other trying to be menacing because you want to look like an authority in security. You're none to me - I know nothing about you or the company you work for - you might as well be BS'ing everyone here. Also you quickly found the words to weasel yourself out of the posed problem - you're talking too much, yet you admit that you're unable to hack into a 6 yo unpatched system. Six freaking years old system which, according to you, must be hackable using readily available exploits which take a few seconds to be found on Google. So much for a security (more like BS) expert. Again, your post is rife with name calling and no sound arguments. Dude, I really doubt your work for any security company after repeatedly calling me "clueless", "uneducated", "crazy". I have nothing to worry about - I can expose a VM running Windows 7 no problems. You surely look like a lame self proclaimed security "expert" if you thought I'd expose a real physical PC. In short: far too many scary words, little to no substance. Peace, dude. Go troll someone else. I yawned several times while reading your scary reply.
  - orf 10y ago
    Do you not see how ridiculous that request is? Seriously? You're like a security anti-vaxxer. "Security patches are not needed because I don't think I've ever been hacked and I know nothing about security" or something to that extent. I'm not going to put my job on the line or waste any more of my time, so I'll try summarize why your position is stupid the best I can in the paragraph below. I do hope you'll read it and understand. Here is a fact: If you have a system with an unpatched security issues then that system is vulnerable to those security issues, no matter how hard you argue on the internet that it is not. Yes, if you selectively patch any that are remotely exploitable over the internet (of which there are a few, if you read the links I posted above) then I can't sit here and hack you from afar. But that doesn't mean your secure, you might need to simply visit a web page or open a document that triggers any number of local security vulnerabilities you have not patched. All in all I still don't understand why the fuck you wouldn't just patch any security issues regardless whether there are public working exploits (and oh boy there are many). I do work for a security company and I have done for years, and I don't care if you don't believe that. But hey, you seem pretty adamant about your position and I'm not likely to change your mind. If you're so sure about the evils of having a secure system and want an authority figure to validate that then email/tweet tptacek[1] with "hey I've got a Windows 7 box here with some security vulnerabilities I have not patched, I'm fine right?". Seriously, do it. Confirm your belief by asking a verified security professional, you've got nothing to worry about because he will email back "yes that's fine even though there are like a thousand unpatched exploits in your system it's all cool because reasons". Or maybe he just won't email back, because you know, he's not stupid like me and wastes time replying to crazy people on the internet. 1. https://news.ycombinator.com/user?id=tptacek https://news.ycombinator.com/user?id=tptacek
  - dang 10y ago
    Please don't be uncivil in HN comments, even when someone else is breaking the site rules.
- sctb 10y ago
  Personal attacks are not OK on HN. Please don't do this.

orf 10y ago

Ahh the old "hack me m8" defence. Nice one. Yet again I don't see any actual substance to your replies. If you could post something, just anything to back your frankly outlandish claims out that would be awesome. I work for an infosec company, and the answer is yes. Yes any number of us could dos, get an RCE or otherwise fuck with your unpatched windows 7 machine that is missing 5 years of critical updates. Just fire up nessus, point it at your machine, see what it comes back with and find an exploit for one of those issues from our extensive library, or on any number of public resources. Bread and butter. We'd be in the wrong industry if we couldn't, and it's not exactly hard. However it would be pretty unethical/illegal to do so and who the hell wants to waste time doing that to a crazy person on HN. It's clear you're clueless, and that's fine because its your choice to be uneducated. Just please don't spread this misinformation on your blog. Or better yet do: write a big blog post about how security patches are not needed along with a "hack me please" challenge at the end. You've not nothing to worry about, right?

mynameislegion 10y ago
I don't see any substance in your replies other trying to be menacing because you want to look like an authority in security. You're none to me - I know nothing about you or the company you work for - you might as well be BS'ing everyone here. Also you quickly found the words to weasel yourself out of the posed problem - you're talking too much, yet you admit that you're unable to hack into a 6 yo unpatched system. Six freaking years old system which, according to you, must be hackable using readily available exploits which take a few seconds to be found on Google. So much for a security (more like BS) expert. Again, your post is rife with name calling and no sound arguments. Dude, I really doubt your work for any security company after repeatedly calling me "clueless", "uneducated", "crazy". I have nothing to worry about - I can expose a VM running Windows 7 no problems. You surely look like a lame self proclaimed security "expert" if you thought I'd expose a real physical PC. In short: far too many scary words, little to no substance. Peace, dude. Go troll someone else. I yawned several times while reading your scary reply.
- orf 10y ago
  Do you not see how ridiculous that request is? Seriously? You're like a security anti-vaxxer. "Security patches are not needed because I don't think I've ever been hacked and I know nothing about security" or something to that extent. I'm not going to put my job on the line or waste any more of my time, so I'll try summarize why your position is stupid the best I can in the paragraph below. I do hope you'll read it and understand. Here is a fact: If you have a system with an unpatched security issues then that system is vulnerable to those security issues, no matter how hard you argue on the internet that it is not. Yes, if you selectively patch any that are remotely exploitable over the internet (of which there are a few, if you read the links I posted above) then I can't sit here and hack you from afar. But that doesn't mean your secure, you might need to simply visit a web page or open a document that triggers any number of local security vulnerabilities you have not patched. All in all I still don't understand why the fuck you wouldn't just patch any security issues regardless whether there are public working exploits (and oh boy there are many). I do work for a security company and I have done for years, and I don't care if you don't believe that. But hey, you seem pretty adamant about your position and I'm not likely to change your mind. If you're so sure about the evils of having a secure system and want an authority figure to validate that then email/tweet tptacek[1] with "hey I've got a Windows 7 box here with some security vulnerabilities I have not patched, I'm fine right?". Seriously, do it. Confirm your belief by asking a verified security professional, you've got nothing to worry about because he will email back "yes that's fine even though there are like a thousand unpatched exploits in your system it's all cool because reasons". Or maybe he just won't email back, because you know, he's not stupid like me and wastes time replying to crazy people on the internet. 1. https://news.ycombinator.com/user?id=tptacek https://news.ycombinator.com/user?id=tptacek
- dang 10y ago
  Please don't be uncivil in HN comments, even when someone else is breaking the site rules.
sctb 10y ago
Personal attacks are not OK on HN. Please don't do this.