4 ms·

It’s been 4 days since the last remote-exploitable, no-auth-needed RCE hole in Windows. If you were running this version of Windows, you would not get the patch

by nikanj 5y ago

It’s been 4 days since the last remote-exploitable, no-auth-needed RCE hole in Windows. If you were running this version of Windows, you would not get the patch automatically delivered to your device.

duskwuff 5y ago
Bonus thought experiment: this same criticism applies to most Chromium and Firefox forks. (Especially the ones that describe "no automatic updates" as a feature.)
- paxys 5y ago
  I wouldn't call it criticism. Software at this scale and complexity will have vulnerabilities. I'd be a lot more concerned about someone who claims that their code is fully secure and doesn't need any patching ever.
  - duskwuff 5y ago
    > Software at this scale and complexity will have vulnerabilities. Certainly. The question is what provisions the software has made to mitigate those potential vulnerabilities by notifying users that a patch is available and allowing them to automatically apply that patch. Deliberately removing these mitigations from a piece of software which is highly exposed to exploits, like a web browser or an operating system, is nothing short of irresponsible.
causality0 5y ago
When was the last RCE that didn't involve running Javascript on an untrusted URL?
- jonpalmisc 5y ago
  3 days ago. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26809 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
admax88qqq 5y ago
What was the vulnerability? Was it in a component that is stripped in this project?
JoeMamaAME 5y ago
Windows Ameliorated ships with a non-administrator user, thereby requiring a password for temporary admin privilages. Most no-auth exploits take advantage of the user already being an administrator, and then bypassing UAC for example. The configuration mentioned above would likely mitigate this issue, although I'm not educated enough on this subject to say for sure
- nikanj 5y ago
  The hole is in SMB (Windows remote file&printing services), which run as SYSTEM, not the currently logged-in user.
  - JoeMamaAME 5y ago
    I see, thank you for the information.

by nikanj 5y ago

duskwuff 5y ago

Bonus thought experiment: this same criticism applies to most Chromium and Firefox forks. (Especially the ones that describe "no automatic updates" as a feature.)

paxys 5y ago
I wouldn't call it criticism. Software at this scale and complexity will have vulnerabilities. I'd be a lot more concerned about someone who claims that their code is fully secure and doesn't need any patching ever.
- duskwuff 5y ago
  > Software at this scale and complexity will have vulnerabilities. Certainly. The question is what provisions the software has made to mitigate those potential vulnerabilities by notifying users that a patch is available and allowing them to automatically apply that patch. Deliberately removing these mitigations from a piece of software which is highly exposed to exploits, like a web browser or an operating system, is nothing short of irresponsible.

causality0 5y ago

When was the last RCE that didn't involve running Javascript on an untrusted URL?

jonpalmisc 5y ago
3 days ago. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26809 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

admax88qqq 5y ago

What was the vulnerability? Was it in a component that is stripped in this project?

JoeMamaAME 5y ago

Windows Ameliorated ships with a non-administrator user, thereby requiring a password for temporary admin privilages. Most no-auth exploits take advantage of the user already being an administrator, and then bypassing UAC for example. The configuration mentioned above would likely mitigate this issue, although I'm not educated enough on this subject to say for sure

nikanj 5y ago
The hole is in SMB (Windows remote file&printing services), which run as SYSTEM, not the currently logged-in user.
- JoeMamaAME 5y ago
  I see, thank you for the information.