3 ms·
If they're not updating their main software, what makes us think they're patching the host? It makes me wonder what percent of those 1100 are compromised. For
by maerF0x0 8y ago
If they're not updating their main software, what makes us think they're patching the host? It makes me wonder what percent of those 1100 are compromised.
For example the 1213 days of presumably no updates by f2n (mentioned in another comment: https://news.ycombinator.com/item?id=17150526 https://news.ycombinator.com/item?id=17150526 )
- cesarb 8y agoThe attack surface matters. If the only exposed services are tor and sshd with public key authentication, one would need a vulnerability in either to compromise the host. How long ago was the last RCE on pre-authentication sshd? (Of course, the lack of patches means that, once someone gets a RCE on either of these daemons, it's probably game over for the host.)