4 ms·
Why are you sure of that? I wouldn't design a critical system that relied on the difference between root and non-root accounts to protect private keys. I would
by js2 5mo ago
Why are you sure of that? I wouldn't design a critical system that relied on the difference between root and non-root accounts to protect private keys. I would design a system assuming the attacker can trivially escalate to root privilege. Because historically you just cannot rely on the difference. LPE attacks simply happen on too regular a basis.
- fragmede 5mo agoI'm not sure of anything. I agree that priv escalation regularly happens, I was around for cve-2010-4258, before they got all branded and named. GP was asking why Cloudflare should be so afraid that they wrote that post and I'm saying their fear is reasonable. https://blog.nelhage.com/2010/12/cve-2010-4258-from-dos-to-privesc/ https://blog.nelhage.com/2010/12/cve-2010-4258-from-dos-to-p...