4 ms·

I've met plenty of programmers who are stupid enough to do this kind of thing. Don't attribute to malice what could easily be attributed to stupidity.

wfunction 10y ago
Plausible deniability?
greglindahl 10y ago
I'm not a fan of conspiracy theories, but this vuln was not patched in 90 days. Kaspersky frequently patches things faster than that, and this sure sounds like it's a pretty trivial fix.
- tptacek 10y ago
  It's kernel TLS interception code. Not only is it not a trivial fix, but Tavis Ormandy had to revise his exploit model to account for functionality he hadn't noticed. It's not a conspiracy.
  - xorblurb 10y ago
    Fixing that kind of stupid hashing scheme and subsequent use of only 32 bits of the result? Might not be trivial, but, regardless of being in the kernel or not, SHOULD be easy enough to fix quickly. Even more so given how bad that hole is. So, they taking too much time to fix that? In every case one more reason to stay far far far away from their products.
    - tptacek 10y ago
      I'm not saying you should use Kaspersky AV. Don't do that.
- jonas21 10y ago
  Sounds like it was patched: > This issue was fixed on the 28th, there was some delay unrestricting this bug due to the holidays. And it's been less than 90 days since the issue was reported, so they wouldn't have disclosed yet if it wasn't.
  - greglindahl 10y ago
    Ah, sorry, Nov 1 -> Dec 28 is 58 days.
- deleted 10y ago
  [deleted]
egocodedinsol 10y ago
Don't attribute to malice what could easily be attributed to stupidity. I'm no fan of pitchforks, and I don't doubt plenty of people might make this mistake. But lots of malicious actors hide behind this response.
- throwaway91111 10y ago
  Perhaps we should just avoid drawing any conclusions about intent from a single line of code.
  - egocodedinsol 10y ago
    Yes. Although I suppose the probability you're a malicious actor given that you've produced a vulnerability rise substantially (though still remains quite small).
    - djrogers 10y ago
      > I suppose the probability you're a malicious actor given that you've produced a vulnerability rise substantially That's ridiculous on it's face - all software has vulnerabilities, and not all malicious actors produce vulnerabilities. Heck, the vast majority of malicious actors don't even discover vulnerabilities, they simply exploit them.
      - apendleton 10y ago
        You omitted the parenthetical "(though still remains quite small)," which was important. I think the point was: if you were (miraculously, in your view) to produce a piece of software that was free of vulnerabilities, I could safely conclude that you weren't trying to maliciously produce vulnerable software. If you instead produced a piece of software that contained vulnerabilities, it would at least be possible that you were such a malicious actor, so the probability would be higher, if still very small (small-but-nonzero vs. zero).
gertef 10y ago
You should treat stupidity the same way you treat malice, because it's just as dangerous. The fire doesn't care who set it or why.

wfunction 10y ago

Plausible deniability?

greglindahl 10y ago

I'm not a fan of conspiracy theories, but this vuln was not patched in 90 days. Kaspersky frequently patches things faster than that, and this sure sounds like it's a pretty trivial fix.

tptacek 10y ago
It's kernel TLS interception code. Not only is it not a trivial fix, but Tavis Ormandy had to revise his exploit model to account for functionality he hadn't noticed. It's not a conspiracy.
- xorblurb 10y ago
  Fixing that kind of stupid hashing scheme and subsequent use of only 32 bits of the result? Might not be trivial, but, regardless of being in the kernel or not, SHOULD be easy enough to fix quickly. Even more so given how bad that hole is. So, they taking too much time to fix that? In every case one more reason to stay far far far away from their products.
  - tptacek 10y ago
    I'm not saying you should use Kaspersky AV. Don't do that.
jonas21 10y ago
Sounds like it was patched: > This issue was fixed on the 28th, there was some delay unrestricting this bug due to the holidays. And it's been less than 90 days since the issue was reported, so they wouldn't have disclosed yet if it wasn't.
- greglindahl 10y ago
  Ah, sorry, Nov 1 -> Dec 28 is 58 days.
deleted 10y ago
[deleted]

egocodedinsol 10y ago

Don't attribute to malice what could easily be attributed to stupidity. I'm no fan of pitchforks, and I don't doubt plenty of people might make this mistake. But lots of malicious actors hide behind this response.

throwaway91111 10y ago
Perhaps we should just avoid drawing any conclusions about intent from a single line of code.
- egocodedinsol 10y ago
  Yes. Although I suppose the probability you're a malicious actor given that you've produced a vulnerability rise substantially (though still remains quite small).
  - djrogers 10y ago
    > I suppose the probability you're a malicious actor given that you've produced a vulnerability rise substantially That's ridiculous on it's face - all software has vulnerabilities, and not all malicious actors produce vulnerabilities. Heck, the vast majority of malicious actors don't even discover vulnerabilities, they simply exploit them.
    - apendleton 10y ago
      You omitted the parenthetical "(though still remains quite small)," which was important. I think the point was: if you were (miraculously, in your view) to produce a piece of software that was free of vulnerabilities, I could safely conclude that you weren't trying to maliciously produce vulnerable software. If you instead produced a piece of software that contained vulnerabilities, it would at least be possible that you were such a malicious actor, so the probability would be higher, if still very small (small-but-nonzero vs. zero).

gertef 10y ago

You should treat stupidity the same way you treat malice, because it's just as dangerous. The fire doesn't care who set it or why.