4 ms·

Logout4Shell

• noodlesUK 5y ago
  Tbh I think that a major nation state’s national security agency should probably run something like this (publicly, with open source) and see if it’s a good tactic for use in the future against major bugs. They should also not use it to gain a foothold in their networks, but show that their defensive mission matters. It’s not really possible for a private company to do this kind of thing, but I think a state security agency could.
  • btown 5y ago
    How would you audit that their server is actually executing the open-source code that they say they are? The incentive for said server to, in certain cases or when detecting certain networks, also install a silent and subtle payload for future backdoor access (which every nation state has in its back pocket for a moment like this) is phenomenally high.
    • bigcoffeeguy 5y ago
      Not to mention that any decent network firewall with up-to-date signatures would probably just end up blocking the “patch.”
    • aaomidi 5y ago
      You wouldn't. Just like there's nothing to guarantee they're not using this exploit right now as we speak.
• Tepix 5y ago
  Note that in some legislations it may be illegal to use this against other people's systems without their consent. As long as it doesn't break stuff i guess you are unlikely to be sued.