akerl_

10 ms·

241.
by akerl_ 5mo ago
Nobody had to hack it. A system at DENIC broke, and so Cloudflare turned off DNSSEC validation for all of their users accessing .de. If DNSSEC was actually important for the security model of those users, that would be a huge deal.
242.
by akerl_ 5mo ago
I think you may have misread my comment. The post asked "What is your move?". And my answer is that I guess I'd go work at McDonalds, in a world where the pay for that vs writing code were equivalent.
243.
by akerl_ 5mo ago
Looking at the complaint ( https://publishers.org/wp-content/uploads/2026/05/2026-05-05... ), that seems like the part that's got the most solid foundation, especially given that while torrenting th
244.
by akerl_ 5mo ago
Isn't this what https://news.ycombinator.com/show is for?
245.
by akerl_ 5mo ago
I guess go work at McDonalds.
246.
by akerl_ 5mo ago
A complex thing where making a mistake makes your domains drop off the internet seems like a pretty big "only problem".
247.
by akerl_ 5mo ago
Presumably if LetsEncrypt goes down and stays down for a week, the sites that go down are the ones that see that their CA went down and at no point in the week take the option to get certs from a different CA?
248.
by akerl_ 5mo ago
I don't know why you're so aggressively attacking the idea of people making projects to show off. The claim isn't that zero people use them, or that all TUI projects are made to show off. But most of the TUIs you see land on
249.
by akerl_ 5mo ago
https://hn.algolia.com/?dateRange=pastWeek&page=0&prefix=fal... That's a good start.
250.
by akerl_ 5mo ago
The guidelines are pretty clear that basically all of this comment is not ok, and that this kind of comment is net negative for the quality of the site. > Be kind. Don't be snarky. > Edit out swipes. > When disagreeing, please
251.
by akerl_ 5mo ago
You have a right to free speech. Other people have the right to say they disagree with you, or refuse to do business with you because of your speech.
252.
by akerl_ 6mo ago
Again, the current flow was that the researchers only reported the vuln to kernel devs, who then committed a fix with no flag that it was a security fix. A proposal where there is an unmarked commit and then anybody tells anybody anything a
253.
by akerl_ 6mo ago
In a story that includes an RCE, you basically just assume LPE. The LPE isn’t a reward, it’s just table stakes. It’s the RCE that would be noteworthy. Your assessment of the impact of this vulnerability is just wrong, and your level of pani
254.
by akerl_ 6mo ago
The information exposed in the current process was: code changes in the git commits and a commit message that did not mention the vulnerability. In the current model, attackers are actively looking at all commits as potential vulnerabilitie
255.
by akerl_ 6mo ago
I’m saying it doesn’t matter how innocuous you try to make the patch when there are known bad actors directly evaluating every commit for “so did this close a vuln”, using both AI and human expertise. This is true no matter what, but the co
256.
by akerl_ 6mo ago
There isn’t such a thing. Coordinated disclosure (sometimes called responsible disclosure by people who want to inject their morals into one available option so as to paint the others as irresponsible) exists. As has been noted, some large
257.
by akerl_ 6mo ago
Coordinating disclosure involves keeping things secret for an amount of time.
258.
by akerl_ 6mo ago
> Could be done without revealing what the vulnerability actually is in most cases No it can’t. The bad actors that should actually worry most people are actively combing through commits on mainstream codebases, using a combination of au
259.
by akerl_ 6mo ago
Ah yes, all those nihilists spending their spare time volunteering as developers and maintainers of open source projects.
260.
by akerl_ 6mo ago
It’s a commonly followed practice for some people. Notably it’s what was done here: they coordinated disclosure with the Linux kernel devs. And now folks are angry that they didn’t also coordinate with yet more downstream projects. > For
261.
by akerl_ 6mo ago
Is that a rule? Are there rules? These researchers found a vulnerability in the Linux kernel. They could have just written a blog post and put it online, or not told anybody, or sold it. But instead they decided to tell the Linux kernel dev
262.
by akerl_ 6mo ago
Again, Linux LPE via either vulns or misconfigured permissions / binaries is common. People who run servers that give out shell access to uses or randos already needed to contend with this. Added later: you may find https://
263.
by akerl_ 6mo ago
How many people do you let have local code execution on your systems? This is a local privilege escalation. They are relatively common. They are a big deal if you run a system that lets multiple untrusted users commingle code on a shared op
264.
by akerl_ 6mo ago
How do you get a system without somebody (or multiple somebodies) being responsible for it?
265.
by akerl_ 6mo ago
I think you’re reading a ton into this vulnerability that is not there.
266.
by akerl_ 6mo ago
Why not?
267.
by akerl_ 6mo ago
Have you considered that maybe it’s not the way it’s done? It’s certainly a thing some people do. But there is not a unified consensus on how to handle vulnerabilities. Different security researchers (or, in fact, the same researchers relea
268.
by akerl_ 6mo ago
It seems odd to call me utterly miserable and then suggest I’m not communicating in good faith. We don’t have to agree, but the site rules are pretty clear that swipes like that aren’t ok. That kind of distro maintainers and kernel devs com
269.
by akerl_ 6mo ago
I disagree that it sucks. It leverages a ton of people putting in their time and resources, and relies on system operators being active participants. This vulnerability is, for some threat models, a really big deal. A security group found t
270.
by akerl_ 6mo ago
To be more blunt: if you’re paying for a product, the vendor owes you whatever things they committed to. If you’re a Redhat customer and your agreed SLA with Redhat for this kind of security fix was passed by, go be mad at Redhat. (I don’t

More ›