4 ms·

like most products connected to the internet, VPNs and firewalls can have vulnerabilities too. As long as its not super low hanging fruit that should have been

like most products connected to the internet, VPNs and firewalls can have vulnerabilities too. As long as its not super low hanging fruit that should have been caught or is a bad default configuration, its the response that matters the most to me.

katehikes88 3y ago
But it's the exploit of the week! How can you not be excited about shaming the company for this amazing fuck up! Positive feedback for is completely missing from the field. Instead security professionals mock developers and celebrate their human errors. This blog post is a good example of that. Everyone has vulnerabilities and security oopsies in their processes. Instead of cataloging individual vulnerabilities it would make sense to catalog the types of responses and claimed process improvements vendors and projects have.
- HoochTHX 3y ago
  I like the idea of that, that would allow us to judge a Product/Company based on a history of actions.
kstrauser 3y ago
This was super low hanging fruit that should have been caught.
redprince 3y ago
> like most products connected to the internet, VPNs and firewalls can have vulnerabilities too. Except being exposed without protection to the hostile internet is their very reason to exist. I expect such devices to be developed with the awareness that they are going to be attacked by capable adversaries. Thus secure coding practices are to be followed and state of the art exploit mitigation techniques employed on the OS level. There's no excuse for high severity vulnerabilities to be found in these kinds of products.
- katehikes88 3y ago
  You ought to adjust your expectations because they don't line up with reality. There is nothing particularly surprising or noteworthy about this vulnerability.
- Wheaties466 3y ago
  take a look at the history of pwn2own. It could be said that google chrome is one of the most actively developed projects period and people still find crazy 0 interaction exploits for this product. You just need to threat model around that and limit exposure in case something like this happens. Most orgs dont get hit with 0 days. Therefore the best thing you can do is patch often, when possible.

katehikes88 3y ago

But it's the exploit of the week! How can you not be excited about shaming the company for this amazing fuck up! Positive feedback for is completely missing from the field. Instead security professionals mock developers and celebrate their human errors. This blog post is a good example of that. Everyone has vulnerabilities and security oopsies in their processes. Instead of cataloging individual vulnerabilities it would make sense to catalog the types of responses and claimed process improvements vendors and projects have.

HoochTHX 3y ago
I like the idea of that, that would allow us to judge a Product/Company based on a history of actions.

kstrauser 3y ago

This was super low hanging fruit that should have been caught.

redprince 3y ago

> like most products connected to the internet, VPNs and firewalls can have vulnerabilities too. Except being exposed without protection to the hostile internet is their very reason to exist. I expect such devices to be developed with the awareness that they are going to be attacked by capable adversaries. Thus secure coding practices are to be followed and state of the art exploit mitigation techniques employed on the OS level. There's no excuse for high severity vulnerabilities to be found in these kinds of products.

katehikes88 3y ago
You ought to adjust your expectations because they don't line up with reality. There is nothing particularly surprising or noteworthy about this vulnerability.
Wheaties466 3y ago
take a look at the history of pwn2own. It could be said that google chrome is one of the most actively developed projects period and people still find crazy 0 interaction exploits for this product. You just need to threat model around that and limit exposure in case something like this happens. Most orgs dont get hit with 0 days. Therefore the best thing you can do is patch often, when possible.