4 ms·

Counterpoint. End users have a right to mitigate this issue on their systems. It is a really really bad look for Linux, puts a bit of water on all hype around

Counterpoint. End users have a right to mitigate this issue on their systems. It is a really really bad look for Linux, puts a bit of water on all hype around switching from Windows.

jasonmp85 6mo ago
[dead]
roxolotl 6mo ago
It does? The disclosure even says the concern for single user systems is very low. If someone has access to your single user system, remote or otherwise, you’ve already lost on the sort of device people would be switching from windows to Linux on.
- 999900000999 6mo ago
  Someone like an AI coding agent perhaps ? This is the type of thing Prompt injection was made for. No OS is perfect. The awkward rollout for this bug fix is proof of that.
  - Filligree 6mo ago
    Root access does not typically add anything interesting, for a desktop system. All the valuable stuff is already owned by the single user.
- m3047 6mo ago
  > The disclosure even says the concern for single user systems is very low. For single user systems (not rigorously defined, I presume it's the intersection of our two definitions which we might be talking about) the nature of the exploit is local privilege escalation, of which there could be many possible, and many mitigations / countermeasures against. This could have suddenly appeared from the ether of "unknown unknowns" for some people. Those people farther up the food chain still potentially have service accounts, maybe even user accounts for some purposes, perhaps "trusted" services which deliver them code which they deserialize and run once. (Have a pickle.) severity * impact * likelihood Not everyone looking to migrate from Windows 95 plans to run everything as root afterward. On the copy.fail site: echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf rmmod algif_aead 2>/dev/null || true Not everybody needs or wants to wait for their distro, or plans to patch their IC firmware when a config change will do.
vhantz 6mo ago
As opposed to all other operating systems with no CVEs ever?
weavejester 6mo ago
Hype around switching from Windows servers?
johnbarron 6mo ago
>> puts a bit of water on all hype around switching from Windows. Said no one ever...present post excluded :-))
cbarnes99 6mo ago
You clearly have no idea how often windows has unpatched privesc exploits.
windexh8er 6mo ago
[flagged]
ddtaylor 6mo ago
What happens if someone does the exploit in WSL?

Counterpoint. End users have a right to mitigate this issue on their systems. It is a really really bad look for Linux, puts a bit of water on all hype around switching from Windows.

jasonmp85 6mo ago

[dead]

roxolotl 6mo ago

It does? The disclosure even says the concern for single user systems is very low. If someone has access to your single user system, remote or otherwise, you’ve already lost on the sort of device people would be switching from windows to Linux on.

999900000999 6mo ago
Someone like an AI coding agent perhaps ? This is the type of thing Prompt injection was made for. No OS is perfect. The awkward rollout for this bug fix is proof of that.
- Filligree 6mo ago
  Root access does not typically add anything interesting, for a desktop system. All the valuable stuff is already owned by the single user.
m3047 6mo ago
> The disclosure even says the concern for single user systems is very low. For single user systems (not rigorously defined, I presume it's the intersection of our two definitions which we might be talking about) the nature of the exploit is local privilege escalation, of which there could be many possible, and many mitigations / countermeasures against. This could have suddenly appeared from the ether of "unknown unknowns" for some people. Those people farther up the food chain still potentially have service accounts, maybe even user accounts for some purposes, perhaps "trusted" services which deliver them code which they deserialize and run once. (Have a pickle.) severity * impact * likelihood Not everyone looking to migrate from Windows 95 plans to run everything as root afterward. On the copy.fail site: echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf rmmod algif_aead 2>/dev/null || true Not everybody needs or wants to wait for their distro, or plans to patch their IC firmware when a config change will do.

vhantz 6mo ago

As opposed to all other operating systems with no CVEs ever?

weavejester 6mo ago

Hype around switching from Windows servers?

johnbarron 6mo ago

>> puts a bit of water on all hype around switching from Windows. Said no one ever...present post excluded :-))

cbarnes99 6mo ago

You clearly have no idea how often windows has unpatched privesc exploits.

windexh8er 6mo ago

[flagged]

ddtaylor 6mo ago

What happens if someone does the exploit in WSL?