4 ms·

You're right. Commenters seem to comment based strictly on their perception of the title. I think however, that authors point was moot already - your network c

by hawski 6y ago

You're right. Commenters seem to comment based strictly on their perception of the title. I think however, that authors point was moot already - your network connected machine can't be static, it shouldn't be in years. There are constantly new RCE's and other exploits since ages. Your network connected machine must be maintained, whether it's a basic web server or your phone.

pmlnr 6y ago
> your network connected machine can't be static, it shouldn't be in years. Why not? Imagine if it's a purpose built webserver on a microcontroller[^1] which only serves strictly static pages or text files. [^1]: http://tuxgraphics.org/electronics/200611/embedded-webserver.shtml http://tuxgraphics.org/electronics/200611/embedded-webserver...
- pwinnski 6y ago
  Then it's pwned and useless-at-best as soon as an exploit is found, and can never be updated.
hrktb 6y ago
Wouldn’t there be a point where we run out of readily exploitable vulnerabilities against a specific platform ? For instance if I was running a server on an 50 yo IBM framework serving static pages, how many serious attack vectors have been left unpatched at this point ? (ignoring DDOS type of issues where the content is not compromised)
- lmm 6y ago
  There was a 26-year-old bash bug a few years back. How would you ever know when you'd found the last bug? Unless you do some formal verification of that 50yo IBM framework, I certainly wouldn't trust it to be exposed to the internet.
  - pmlnr 6y ago
    I would. It's so obscure that it deflects script kiddies with just that and the serious ones would break anything anyway.
    - lmm 6y ago
      You're modeling ability as a binary when it's more like a bell curve. Most attackers are somewhere in the middle and old systems are going to be most vulnerable to them.
josteink 6y ago
> There are constantly new RCE's and other exploits since ages. And many/most of them connected to the TSL/HTTPS-stack, due to the complexity it brings.

by hawski 6y ago

pmlnr 6y ago

> your network connected machine can't be static, it shouldn't be in years. Why not? Imagine if it's a purpose built webserver on a microcontroller[^1] which only serves strictly static pages or text files. [^1]: http://tuxgraphics.org/electronics/200611/embedded-webserver.shtml http://tuxgraphics.org/electronics/200611/embedded-webserver...

pwinnski 6y ago
Then it's pwned and useless-at-best as soon as an exploit is found, and can never be updated.

hrktb 6y ago

Wouldn’t there be a point where we run out of readily exploitable vulnerabilities against a specific platform ? For instance if I was running a server on an 50 yo IBM framework serving static pages, how many serious attack vectors have been left unpatched at this point ? (ignoring DDOS type of issues where the content is not compromised)

lmm 6y ago
There was a 26-year-old bash bug a few years back. How would you ever know when you'd found the last bug? Unless you do some formal verification of that 50yo IBM framework, I certainly wouldn't trust it to be exposed to the internet.
- pmlnr 6y ago
  I would. It's so obscure that it deflects script kiddies with just that and the serious ones would break anything anyway.
  - lmm 6y ago
    You're modeling ability as a binary when it's more like a bell curve. Most attackers are somewhere in the middle and old systems are going to be most vulnerable to them.

josteink 6y ago

> There are constantly new RCE's and other exploits since ages. And many/most of them connected to the TSL/HTTPS-stack, due to the complexity it brings.