3 ms·
This is an issue that’s overblown, simply have a firewall that exposes used ports and you’re fine. There’s also an option within the release tool distillery to
by bdibs 7y ago
This is an issue that’s overblown, simply have a firewall that exposes used ports and you’re fine.
There’s also an option within the release tool distillery to limit it to the local network.
Not to mention even if an attacker found your unsecured setup, they’d also need to know your “cookie”/key to do anything. It’s no different than leaving SSH login with password enabled on any server.
- dhab 7y agoThe speaker claims that the cookie/key can be known by causing VM crash, which is done by exploiting the monotonic nature of cookie values which are stored as atoms which has a fixed cap on how many they can be, which when exceeded causes VM to crash. He estimates the time to do that be 10 mins (I forgot the exact memory limit)
- bdibs 7y agoThat’s definitely an issue, but again can be easily mitigated with a simple firewall that doesn’t allow every port to be open to the world.