3 ms·

It's easy to read some tone in there that may not have been intended, but it's actually a really good question. Short answer - I don't know, but I think so. I

by Jedd 10y ago

It's easy to read some tone in there that may not have been intended, but it's actually a really good question. Short answer - I don't know, but I think so. In my particular case I'm not exposed (I use Debian pretty much everywhere, with a couple of Win7 VM's for work that are NAT'd and sandboxed, used almost exclusively for editing MS-Office applications, with minimal Internet access, etc). You said 'instead of one bad guy', but there's no evidence a single bad guy had the exploit, so I can't really quantify my risk prior to the announcement. Anyway, in the general case of your question - yes, I think I am safer if I have the same knowledge (about problems with my software) that everyone else has, rather than me not knowing but some unknown number of potentially very sophisticated attackers are confirmed to know and be using that knowledge.

cm2187 10y ago
I was a bit sarcastic, because in my mind this is a no brainer. As soon as a hacking technique becomes public, every script kiddie will get their hand on it, and then suddenly your server is not exposed to just a team of russian hackers that may have used it in a targeted attack completely unrelated to your business, but to anyone else on the web, potentially scanning all IPs. You might have actively looked into the technique used, understood it, and done something to mitigate it. What about the hundred of millions of Windows servers that rely on monthly updates for security patches, maintained by IT teams that do not have the resources or expertise to investigate every MSFT security bulletin in detail. They will become sitting ducks. Is that a good outcome? In my mind it is a rhetorical question.
- Jedd 10y ago
  Hey, I entirely get where you're coming from. But I'd suggest it's kind of a security by obscurity blanket (I know that's a horrendous aphorism - forgive me, please). I think the problem I have lies here: > As soon as a hacking technique becomes public, > every script kiddie will get their hand on it, At the time Google announced it we had no idea how many script kiddies (or worse) had their hands on it. Certainly it was known the number was > 0. So the question instantly becomes - is it safe to assume only relatively benign bad people know about, and are using, and other people (eg. swarms of script kiddies) don't know about it and won't for some weeks? I'm empathetic to people whose day job is not IT, and are stuck for various reasons using poorly maintained Microsoft software, but I genuinely do not believe we are all safer by assuming (hoping?) active exploits are minimally used. Anyway, Microsoft was well aware of Google's policy on announcements for actively exploited vulnerabilities, and didn't even choose to provide some mitigation advice prior to their (presumably upcoming) security patch.
  - cm2187 10y ago
    If Microsoft issues a patch that will break windows server, then we will have a Y2K bug-style scenario with all the infrastructures being disrupted, etc. I have some sympathy for Microsoft going through a period of testing before releasing a patch to Windows Server.
    - dvtv75 10y ago
      Sympathy aside, this is their flagship product and they claim it is superior to all others. They claim that they have superior support, and they state that they offer a more professional product. I have no sympathy for a business with delusions of superiority who won't even properly test their own software. Why do we pay a lot of money to beta test their software for them?

by Jedd 10y ago

cm2187 10y ago

I was a bit sarcastic, because in my mind this is a no brainer. As soon as a hacking technique becomes public, every script kiddie will get their hand on it, and then suddenly your server is not exposed to just a team of russian hackers that may have used it in a targeted attack completely unrelated to your business, but to anyone else on the web, potentially scanning all IPs. You might have actively looked into the technique used, understood it, and done something to mitigate it. What about the hundred of millions of Windows servers that rely on monthly updates for security patches, maintained by IT teams that do not have the resources or expertise to investigate every MSFT security bulletin in detail. They will become sitting ducks. Is that a good outcome? In my mind it is a rhetorical question.

Jedd 10y ago
Hey, I entirely get where you're coming from. But I'd suggest it's kind of a security by obscurity blanket (I know that's a horrendous aphorism - forgive me, please). I think the problem I have lies here: > As soon as a hacking technique becomes public, > every script kiddie will get their hand on it, At the time Google announced it we had no idea how many script kiddies (or worse) had their hands on it. Certainly it was known the number was > 0. So the question instantly becomes - is it safe to assume only relatively benign bad people know about, and are using, and other people (eg. swarms of script kiddies) don't know about it and won't for some weeks? I'm empathetic to people whose day job is not IT, and are stuck for various reasons using poorly maintained Microsoft software, but I genuinely do not believe we are all safer by assuming (hoping?) active exploits are minimally used. Anyway, Microsoft was well aware of Google's policy on announcements for actively exploited vulnerabilities, and didn't even choose to provide some mitigation advice prior to their (presumably upcoming) security patch.
- cm2187 10y ago
  If Microsoft issues a patch that will break windows server, then we will have a Y2K bug-style scenario with all the infrastructures being disrupted, etc. I have some sympathy for Microsoft going through a period of testing before releasing a patch to Windows Server.
  - dvtv75 10y ago
    Sympathy aside, this is their flagship product and they claim it is superior to all others. They claim that they have superior support, and they state that they offer a more professional product. I have no sympathy for a business with delusions of superiority who won't even properly test their own software. Why do we pay a lot of money to beta test their software for them?