6 ms·
That's quite the sensationalist title for something that was recently patched.
by binkHN 3y ago
That's quite the sensationalist title for something that was recently patched.
- ssgodderidge 3y agoAgreed. Also, "just got a lot weaker" is misleading, as the vulnerability already existed, it was just discovered. "was weaker than we thought" is a bit less exciting, but more accurate.
- abtinf 3y agoThe headline is the opposite of the truth: it is now stronger than ever. By the logic of a headline, a person cured of a disease is weaker afterward.
- pas 3y agogoing through a long sickness usually leaves one weaker afterward, even if one is cured, no? and in some cases there might be a slight upside in acquiring a certain degree of protection from future illnesses from that disease through various immunity mechanisms (which are of course far from perfect).
- Filligree 3y agoOkay, yes, that's one way the analogy breaks down.
- eslaught 3y agoIt's more like you always had a disease and just didn't know it. Celiac comes to mind as a common example. I know people who improved a lot once they got diagnosed, and just never realized the symptoms meant anything before that.
- pas 3y agoyep, but that's not curable (yet!)
- commandersaki 3y agoAlso while the attack is novel it is hard to launch in practice (requires MITM) and even if you manage to pull that off, there isn't much to be gained (even with the downgrade for authenticated data to use SHA1 as it isn't practical to attack an interactive session).
- dt3ft 3y agoPatched by how many of the 80% mentioned?
- binkHN 3y agoThe patch was just released two days ago.
- everforward 3y agoI wouldn't get too excited; it requires a MITM so abusing it at scale would be difficult. Big targets should be wary, people's Hetzner servers and VMs are probably safe. They're not worth the effort to get a MITM on.
- progval 3y agoInteresting choice of example, two months ago an organization found their Hetzner server was MITMed https://news.ycombinator.com/item?id=37955264 https://news.ycombinator.com/item?id=37955264
- tw04 3y agoThere are hundreds of thousands of devices out there running older versions of SSH that can't or won't ever be patched. Sure, for folks running a modern full OS that can just patch at will, they're great. I think the title is far less sensational than you give credit.
- taskforcegemini 3y agothese devices should not be directly reachable ovee internet to begin with
- tw04 3y agoBut they are, which is why this is an issue. Posting on HN "don't do that" isn't going to change the reality we live in.