3 ms·

LTT has already replied to this, and no, it's still very much a problem. https://youtu.be/Luz82RG5PqA?t=160 https://youtu.be/Luz82RG5PqA?t=160

Godel_unicode 4y ago
Is this the video where Linus talks about how RCE is only something that happens in the movies? I wish he would realize that people actually think he knows what he’s talking about and be a bit more careful.
- francislavoie 4y ago
  You misunderstood that then. He wasn't saying that at all. He was just saying that simply having a port open isn't an automatic RCE, because there needs to be something that listens on that port that has a vulnerability to exploit. A simple web API is not that likely to have a vulnerability if the dev of the API did their job correctly.
  - jeroenhd 4y ago
    > if the dev of the API did their job correctly You're not wrong, but we can see the current setup the devs came up with and I don't think they have either the time or skill to build a secure local server app. The sad fact of the matter is that most IoT devices with publicly accessible web servers are feeding grounds for botnets within a few years after release.
  - Godel_unicode 4y ago
    Sounds like you have the same misunderstanding that Linus has. Shellshock would like a word with you. Imagemagick is in line behind it, and after that are the majority of IoT devices (including several camera manufacturers).
  - moistly 4y ago
    Given the hourly updates from CVE, I am exceedingly sceptical that an online device, let alone a cloud system, can be invulnerable. https://twitter.com/CVEnew/ https://twitter.com/CVEnew/
  - wackadack 4y ago
    Did you know Microsoft Defender had a wormable RCE not long ago? It executed things it thought looked like javascript. Oh and by the way, it runs with the highest privilidges in Windows :)
alphabettsy 4y ago
Linus was out of his depth with this discussion. When it was brought up on the WAN show it was clear to me he didn’t understand enough to offer an educated opinion.

Godel_unicode 4y ago

Is this the video where Linus talks about how RCE is only something that happens in the movies? I wish he would realize that people actually think he knows what he’s talking about and be a bit more careful.

francislavoie 4y ago
You misunderstood that then. He wasn't saying that at all. He was just saying that simply having a port open isn't an automatic RCE, because there needs to be something that listens on that port that has a vulnerability to exploit. A simple web API is not that likely to have a vulnerability if the dev of the API did their job correctly.
- jeroenhd 4y ago
  > if the dev of the API did their job correctly You're not wrong, but we can see the current setup the devs came up with and I don't think they have either the time or skill to build a secure local server app. The sad fact of the matter is that most IoT devices with publicly accessible web servers are feeding grounds for botnets within a few years after release.
- Godel_unicode 4y ago
  Sounds like you have the same misunderstanding that Linus has. Shellshock would like a word with you. Imagemagick is in line behind it, and after that are the majority of IoT devices (including several camera manufacturers).
- moistly 4y ago
  Given the hourly updates from CVE, I am exceedingly sceptical that an online device, let alone a cloud system, can be invulnerable. https://twitter.com/CVEnew/ https://twitter.com/CVEnew/
- wackadack 4y ago
  Did you know Microsoft Defender had a wormable RCE not long ago? It executed things it thought looked like javascript. Oh and by the way, it runs with the highest privilidges in Windows :)

alphabettsy 4y ago

Linus was out of his depth with this discussion. When it was brought up on the WAN show it was clear to me he didn’t understand enough to offer an educated opinion.