3 ms·

I panicked a little when I heard the news as I run a cupsd open on the Internet. But as it turns out, the issue is misrepresented in headlines, just like here.

I panicked a little when I heard the news as I run a cupsd open on the Internet. But as it turns out, the issue is misrepresented in headlines, just like here. This is not an issue in the core cupsd, but in a separate package/component, called cups-browsed. My distribution of choice for servers, Gentoo Linux, ships cups-browsed in a separate package which I had not installed, meaning I, as well as most other cups users that did not install this additional package, am not affected by this bug. Saying that all systems running cups can be hacked is a misrepresentation of the scale of the issue.

iforgotpassword 2y ago
I've always disliked how on Debian, usually being rather conservative, cups-browsed gets pulled in by default if you install cups. I think "no install recommends" fixes that, but iirc some add-ons like that hplip driver pull it in again. In my home setup I just disabled the service, but it's rather annoying how more and more software spirals out of scope and makes components that could be optional a requirement. Very related is avahi-daemon. Take a desktop Debian/Ubuntu and try to uninstall it; there's a good chance it's going to remove a couple other software where you wonder why avahi would be a hard dependency.