3 ms·
Non-sysadmin here. For static HTML, why is server patching/OS needed if things are locked down?
by tomrod 3y ago
Non-sysadmin here. For static HTML, why is server patching/OS needed if things are locked down?
- bayindirh 3y agoA webserver like Apache and NGINX are way more complex than they look. It's sometimes possible to exploit bugs with benign/simple requests, even if you don't run advanced stacks on them. See [0] for example. If you're not running strict firewall rules to limit your SSH access and if you expose other services outside, they also need constant patching against newer attacks. Lastly, security standards evolve. Your SSH and SSL layers need to be kept up to date to patch holes and add newer algorithms while deprecating others, further reducing the attack surface [1]. [0]: https://www.exploit-db.com/exploits/50383 https://www.exploit-db.com/exploits/50383 [1]: https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-January/000156.html https://lists.mindrot.org/pipermail/openssh-unix-announce/20...
- toyg 3y agoBecause no software is perfect, which means every lock has weaknesses that sooner or later get found out. Chances are that, say, a Linux 2.x server that was considered "very secure" in 2005 would now be pwned in a few hours.
- mschuster91 3y agoBecause both the Linux kernel and whatever SSL and web server stack you use regularly have their remotely exploitable vulnerabilities.
- boring_twenties 3y agoStatic HTML means you don't have your own code to worry about vulnerabilities in. Vulnerabilities in the server or OS software don't just go away.