5 ms·
The widespread use of unvalidated automatic updates will go down as one of the biggest security blunders of the last decade.
by hackinthebochs 6y ago
The widespread use of unvalidated automatic updates will go down as one of the biggest security blunders of the last decade.
- mdoms 6y agoOn balance, I don't think so.
- rossdavidh 6y agoThat's a pretty high bar, given the security blunders of the last decade.
- deleted 6y ago[deleted]
- tootie 6y agoThere was a fun one a few years ago when someone realized that Maven Central didn't require https so anyone could MITM arbitrary amounts of open source Java code. But I think this problem could be even more pervasive. Think about that giant green lock icon you see on secured sites. And then think about all the apps and devices making requests with no UI and we have no idea what they're all talking to until you have the patience and knowhow to operate wireshark. Off the top of my head, the only real solution is to feed a lot of this arbitrary traffic through trusted brokers which is going to make us even more dependent on Google, Microsoft or whoever else takes up that mantle.
- bink 6y agoUnvalidated by whom? From the info that has been released these updates were properly signed.
- hackinthebochs 6y agoI meant validate the code changes, either by the party that owns the system the software is being installed on, or some neutral third party.