5 ms·

Far more important than that what I want to know is whether I should even care, e.g. is there any evidence of Spectre being used in the wild or not.

bigato 7y ago
A vulnerability that has been shown to work should not be patched in the software more widely used around the world to connect all kinds of linux/unix servers and even other systems? They should wait for it to start getting exploited "in the wild"? I'm just glad that the security of my systems does not depend on people with this kind of attitude.
- mehrdadn 7y ago
  Where did I say it shouldn't be patched? I just said this is information I think a user would care to know along with the patch.
  - bigato 7y ago
    You said you shouldn't care if it was not found in the wild, this is just wrong
    - mehrdadn 7y ago
      You don't even know my requirements or how I use my computers. How do are you so confident it's "just wrong"?
      - bigato 7y ago
        If you want to know wheter it was found "in the wild" and think that this is a relevant factor in deciding if you should care, that is information enough about your usage to be confident it is wrong.
        mehrdadn 7y ago
        It's most definitely not, but I don't get the impression you're open to seeing things as nonbinary.
pixl97 7y ago
Ah yes, I too love the panicked rush of trying to force application vendors to patch once we we discover something is being exploited in the wild. Remember defense is depth is a valid strategy.
- mehrdadn 7y ago
  What I was trying to say was I think library users care to know how urgent it is. If this is being used in the wild then application vendors might need to provide out-of-band patches somehow, and end users should rush to get those patches. If OTOH this is known to be extremely hard to pull off and not known to be used, then it'd be nice for users to know that just the same. Nowhere was I trying to suggest they should avoid providing the patch altogether or something.
  - bigato 7y ago
    That's not how security works. If it can potentially lead to a software like openssh leaking secrets, it is of the highest urgency, period. It doesn't matter if it is thought to be hard to exploit and it doesn't matter if it was already found "in the wild".
    - joombaga 7y ago
      Okay, but if 1 of my 3 highest urgency vulnerabilities is known to have been exploited in the wild, and is easy to exploit, then I may want to focus on that one over the other 2.
      - bigato 7y ago
        Alright, I should have said it is "critical" instead
    - mehrdadn 7y ago
      > That's not how security works. If it can potentially lead to a software like openssh leaking secrets, it is of the highest urgency, period. It doesn't matter if it thought to be hard to exploit and it doesn't matter if it was already found "in the wild". Really? This isn't how security works? Yeah, I guess I forgot security is a 100% binary thing. That's why you never read actual security bulletins advising you when vulnerabilities are actively being exploited in the wild. It's insane to think that should matter or raise the urgency of a patch. [1] [2] [1] https://www.us-cert.gov/ncas/current-activity/2019/06/18/Mozilla-Releases-Security-Updates-Firefox-and-Firefox-ESR https://www.us-cert.gov/ncas/current-activity/2019/06/18/Moz... [2] https://www.mozilla.org/en-US/security/advisories/mfsa2019-18/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-1...
jnordwick 7y ago
None. There hasn't even been a real world demo where given normal conditions: a running sshd and other programs where a running browser script exfiltrates a key with meltdown. Spectre probably isn't possible either and that is the easy one. The load store buffer attack seems completely impossible. Even the POC had to essentially write a program specially to be exploited. The attacks are very interesting and neat, but I think things like this and other techniques effectively remove any last chance.
- bigato 7y ago
  Don't underestimate what hackers with enough motivation can achieve. Specially when the stakes are so high and the geopolitical power coming from a software vulnerability can be significant.

bigato 7y ago

A vulnerability that has been shown to work should not be patched in the software more widely used around the world to connect all kinds of linux/unix servers and even other systems? They should wait for it to start getting exploited "in the wild"? I'm just glad that the security of my systems does not depend on people with this kind of attitude.

mehrdadn 7y ago
Where did I say it shouldn't be patched? I just said this is information I think a user would care to know along with the patch.
- bigato 7y ago
  You said you shouldn't care if it was not found in the wild, this is just wrong
  - mehrdadn 7y ago
    You don't even know my requirements or how I use my computers. How do are you so confident it's "just wrong"?
    - bigato 7y ago
      If you want to know wheter it was found "in the wild" and think that this is a relevant factor in deciding if you should care, that is information enough about your usage to be confident it is wrong.
      - mehrdadn 7y ago
        It's most definitely not, but I don't get the impression you're open to seeing things as nonbinary.

pixl97 7y ago

Ah yes, I too love the panicked rush of trying to force application vendors to patch once we we discover something is being exploited in the wild. Remember defense is depth is a valid strategy.

mehrdadn 7y ago
What I was trying to say was I think library users care to know how urgent it is. If this is being used in the wild then application vendors might need to provide out-of-band patches somehow, and end users should rush to get those patches. If OTOH this is known to be extremely hard to pull off and not known to be used, then it'd be nice for users to know that just the same. Nowhere was I trying to suggest they should avoid providing the patch altogether or something.
- bigato 7y ago
  That's not how security works. If it can potentially lead to a software like openssh leaking secrets, it is of the highest urgency, period. It doesn't matter if it is thought to be hard to exploit and it doesn't matter if it was already found "in the wild".
  - joombaga 7y ago
    Okay, but if 1 of my 3 highest urgency vulnerabilities is known to have been exploited in the wild, and is easy to exploit, then I may want to focus on that one over the other 2.
    - bigato 7y ago
      Alright, I should have said it is "critical" instead
  - mehrdadn 7y ago
    > That's not how security works. If it can potentially lead to a software like openssh leaking secrets, it is of the highest urgency, period. It doesn't matter if it thought to be hard to exploit and it doesn't matter if it was already found "in the wild". Really? This isn't how security works? Yeah, I guess I forgot security is a 100% binary thing. That's why you never read actual security bulletins advising you when vulnerabilities are actively being exploited in the wild. It's insane to think that should matter or raise the urgency of a patch. [1] [2] [1] https://www.us-cert.gov/ncas/current-activity/2019/06/18/Mozilla-Releases-Security-Updates-Firefox-and-Firefox-ESR https://www.us-cert.gov/ncas/current-activity/2019/06/18/Moz... [2] https://www.mozilla.org/en-US/security/advisories/mfsa2019-18/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-1...

jnordwick 7y ago

None. There hasn't even been a real world demo where given normal conditions: a running sshd and other programs where a running browser script exfiltrates a key with meltdown. Spectre probably isn't possible either and that is the easy one. The load store buffer attack seems completely impossible. Even the POC had to essentially write a program specially to be exploited. The attacks are very interesting and neat, but I think things like this and other techniques effectively remove any last chance.

bigato 7y ago
Don't underestimate what hackers with enough motivation can achieve. Specially when the stakes are so high and the geopolitical power coming from a software vulnerability can be significant.