3 ms·

If you need the last version of Wireshark, it’s getting complicated. And when you have a setup with Wireshark that works why update it? I am dubious that Wiresh

If you need the last version of Wireshark, it’s getting complicated. And when you have a setup with Wireshark that works why update it? I am dubious that Wireshark can be an attack vector so security updates won’t be useful. Installing last versions is very straight forward when you are on Osx or Windows. You just go to the website and download it. Plus you get the original binaries not a doctored version to fit whatever launcher and log organization is currenty trending at Ubuntu HQ. Don’t get me wrong I still love my Ubuntus. But this we need to rewrite all software to fit our distributions is not a strenght. I think this line of thinking is kind of shared by Linus himself.

mr_toad 8y ago
Going to dozens or even hundreds of different websites to download the latest versions of software and then manually installing them all isn’t fast at all. c.f. apt-get upgrade or similar, which takes a few seconds.
- sandov 8y ago
  >c.f. apt-get upgrade or similar, which takes a few seconds. Except when the package isn't included, or it isn't the version you needed, because then you have to spend 40 minutes trying to install all the dependencies and building the package from source, instead of the 3 minutes it would have taken to install an .exe on Windows.
  - ti_ranger 8y ago
    > because then you have to spend 40 minutes trying to install all the dependencies and building the package from source, instead of the 3 minutes it would have taken to install an .exe on Windows. No, you take 2 minutes to install it using flatpak, or download a .appimage file. And if neither of those are available, you spend that 40 minutes packaging the software, and submitting it to the distro you use for inclusion. (If it was already packaged, but not new enough, that's a ~5 min job to do the update for your distro)
yjftsjthsd-h 8y ago
> And when you have a setup with Wireshark that works why update it? I am dubious that Wireshark can be an attack vector so security updates won’t be useful. Ignoring feature enhancements and bug fixes for a moment, do you really think it improbable that there are security issues in a piece of software whose entire job is to sit on the network and record everything that it sees and then translate and interpret it?
- hartator 8y ago
  If an evil app is already communicating on the web and is already on your computer, what can it gain more?
  - yjftsjthsd-h 8y ago
    Wireshark (usually) runs in promiscuous mode; it'd be "an evil app is already able to send something visible from your network interface" - which to be fair, might help for internal uses. It does usually mean that anything on your local network can attack you.
  - crummy 8y ago
    Because the "evil app" is just a specially crafted JPG that your browser opened up that triggers some edge case in the old unpatched version of Wireshark that is inspecting traffic.
vlowther 8y ago
You have a very limited imagination. Wireshark is regularly attacked -- it parses random data it gets off the network, therefore it can be attacked using deliberately malformed packets. See https://www.wireshark.org/security/ https://www.wireshark.org/security/ for more info.
- hartator 8y ago
  Every single of these vulnerabilities are crashes and infinite loops. The worst thing you can do - if I am running a 5-year old Wireshark - is to make it crash if I am visiting one of your web services. And you probably can already do that in newer versions if you dig enough.

mr_toad 8y ago

Going to dozens or even hundreds of different websites to download the latest versions of software and then manually installing them all isn’t fast at all. c.f. apt-get upgrade or similar, which takes a few seconds.

sandov 8y ago
>c.f. apt-get upgrade or similar, which takes a few seconds. Except when the package isn't included, or it isn't the version you needed, because then you have to spend 40 minutes trying to install all the dependencies and building the package from source, instead of the 3 minutes it would have taken to install an .exe on Windows.
- ti_ranger 8y ago
  > because then you have to spend 40 minutes trying to install all the dependencies and building the package from source, instead of the 3 minutes it would have taken to install an .exe on Windows. No, you take 2 minutes to install it using flatpak, or download a .appimage file. And if neither of those are available, you spend that 40 minutes packaging the software, and submitting it to the distro you use for inclusion. (If it was already packaged, but not new enough, that's a ~5 min job to do the update for your distro)

yjftsjthsd-h 8y ago

> And when you have a setup with Wireshark that works why update it? I am dubious that Wireshark can be an attack vector so security updates won’t be useful. Ignoring feature enhancements and bug fixes for a moment, do you really think it improbable that there are security issues in a piece of software whose entire job is to sit on the network and record everything that it sees and then translate and interpret it?

hartator 8y ago
If an evil app is already communicating on the web and is already on your computer, what can it gain more?
- yjftsjthsd-h 8y ago
  Wireshark (usually) runs in promiscuous mode; it'd be "an evil app is already able to send something visible from your network interface" - which to be fair, might help for internal uses. It does usually mean that anything on your local network can attack you.
- crummy 8y ago
  Because the "evil app" is just a specially crafted JPG that your browser opened up that triggers some edge case in the old unpatched version of Wireshark that is inspecting traffic.

vlowther 8y ago

You have a very limited imagination. Wireshark is regularly attacked -- it parses random data it gets off the network, therefore it can be attacked using deliberately malformed packets. See https://www.wireshark.org/security/ https://www.wireshark.org/security/ for more info.

hartator 8y ago
Every single of these vulnerabilities are crashes and infinite loops. The worst thing you can do - if I am running a 5-year old Wireshark - is to make it crash if I am visiting one of your web services. And you probably can already do that in newer versions if you dig enough.