5 ms·
LPE = local privilege escalation Too many darn acronyms. This one wasn't too hard to figure out from context but I wish people would define acronyms before usi
by hackernudes 5mo ago
LPE = local privilege escalation
Too many darn acronyms. This one wasn't too hard to figure out from context but I wish people would define acronyms before using them!
- jjordan 5mo agoGood writing for a broad audience requires it. Unfortunately the LLMs don't tend to adopt this guideline.
- boston_clone 5mo agoit’s a CVE write up; the audience for these knows what an LPE is.
- hackernudes 5mo agoI've read many CVEs (somehow that acronym is ok... heh) but have never seen LPE despite being familiar with the concept.
- staticassertion 5mo agoThat seems literally borderline impossible.
- smaudet 5mo agoYou should re-evaluate your probabilities, I too have heard frequently of CVEs, but never of an LPE.
- staticassertion 5mo agoI'm sure lots of people have heard of CVEs, but have you actually read many? LPE is an extremely common term. It's like not knowing RCE. These are the terms used.
- cynicalkane 5mo agoI'll raise my hand here and risk downvotes from very smart people who are smarter than me, but I've heard of CVE but not LPE or RCE. I know what the latter two terms are but am not used to seeing them in acronyms. So what's missing is that keeping up-to-date with CVEs is important and some CVEs are Internet-nerd famous. Remember Heartbleed? Even some casual gamers I know had heard of it. And everyone who's mildly serious about sysadmin knows you want to defensively keep systems patched against important CVEs. The second layer of that, what the exploits actually are or do, is a second-layer term of art, one that one might miss the jargon for even if one has familiarity with the concepts. To me, the fact that the page is obviously AI-assisted is way more upsetting than some guy not knowing what an acronym means. There's something about AI prose that is just so fucking tedious. It makes the mind glaze over.
- staticassertion 5mo agoTo be clear, I'm not suggesting that you if have heard of CVEs therefor you must have heard of LPE. I'm saying if you have read many of them you would have seen these terms. I obviously do not expect someone who has merely heard of various CVEs before to know anything about the contents of those CVEs. The other poster said they had "read many CVEs", which I took to mean they have read many CVE disclosures, where the term is extremely common. Perhaps they meant that they've read about CVEs, in which case I can see why the term would not be on their radar.
- plg94 5mo agosome people just don't have a good memory for acronyms. It's one thing to learn the concept of a privilege escalation, but an entirely different thing to play mental memory with TLAs (three letter acronyms). Acronyms remove all the context from a term which makes them way harder to memorize. A bit like knowing your friends vs knowing their phone numbers.
- busterarm 5mo agoI'm as stunned as you are. I have to read CVEs on a weekly cadence (like contractually required to) and LPE/RCE are kind of the main keywords we look for in them. Also increasingly TOCTOU. If anyone who actually has to respond to CVEs told me they had never seen these terms before I would judge them as being unserious.
- deleted 5mo ago[deleted]
- stackghost 5mo agoI could see it for someone who is only somewhat in tune with security work today. Back in the day those of us breaking into shitty php sites didn't use LPE, we used "privesc", IIRC.
- dataflow 5mo agoI think they've almost certainly seen it written out, just not as an acronym. I figured out what it stood for based on context and knowing the full phrase, but I don't recall actually seeing the LPE acronym in recent memory. Whereas with CVE it's the opposite: I almost never see it written out, and even now find it non-obvious what the E stands for, bizarrely enough.
- acdha 5mo agoThat’s very optimistic. I’d bet there are an order of magnitude more people wondering how exposed they are than security researchers reading this.
- staticassertion 5mo agohttps://duckduckgo.com/?q=LPE+security&ia=web https://duckduckgo.com/?q=LPE+security&ia=web wow
- acdha 5mo agoSure, nobody’s saying it’s an inscrutable mystery but if your goal is to inform a wide audience it’s considered good form to expand all but the most common acronyms. It’ll even get you more internet points than petty smugness.
- staticassertion 5mo agoI think sysadmins should learn the term LPE tbh
- no-name-here 5mo agoContent at the OP link http://copy.fail http://copy.fail seems fairly different from any normal CVE I’ve seen.
- arcfour 5mo agoLPE is a very well-known acronym within the security community, it's not purely academic or obscure or anything. I agree that it would be a good idea to define it explicitly when writing for a broader audience, but I don't think it's particularly egregious that they didn't. It's certainly something I could see myself forgetting. Then again, the whole writeup appears to be AI-generated, so...
- globular-toast 5mo agoSure, but the target audience of copy.fail is surely not the security community but regular sysadmins who probably don't otherwise follow as closely.
- a96 5mo agoI would absolutely expect a sysadmin in particular to know and understand the term and acronym.
- SoftTalker 5mo agoIt's still just courteous to define acronyms on first use, it doesn't take any real effort to do that.
- a96 5mo agoVery much true, and I would never criticize that. Just that this term would be particularly obscure to a sysadmin which seems completely backwards.
- plg94 5mo agoUnderstanding a term with the help of context is very different from guessing what the letters of an acronym might mean. The latter is more like a crosswords puzzle, and a totally unneccessary task for the reader.
- globular-toast 5mo agoWell I would expect a sysadmin to have already been following the kernel mailing lists and not even need to look at copy.fail. In fact, why do people even write stuff down? Everyone should just know everything.
- 1970-01-01 5mo agoI don't know why, but newer writers have never been taught to expand their acronyms on first use. I blame the US education system.
- ButlerianJihad 5mo agoTo be fair, I just consulted 3 cybersecurity glossaries (SANS.org, NIST CSRC, Huntress), and none of them list "LPE" nor "Local Privilege Escalation". If you type "LPE" into English Wikipedia's search bar, and press "Enter", you'll be sent to a disambiguation page which contains a link to the relevant article. https://en.wikipedia.org/wiki/LPE https://en.wikipedia.org/wiki/LPE