this post was submitted on 14 Apr 2024
28 points (100.0% liked)
TechTakes
1489 readers
34 users here now
Big brain tech dude got yet another clueless take over at HackerNews etc? Here's the place to vent. Orange site, VC foolishness, all welcome.
This is not debate club. Unless it’s amusing debate.
For actually-good tech, you want our NotAwfulTech community
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
From the over-active imagination news article:
Is anyone under the impression that ignoring a vulnerability after it's been publicly disclosed is safe? Give me any straightforward C++ vulnerability (no timing attacks or ROP chains kthnx), a basic description, the commit range that includes the fix, and a wheelbarrow full of money and I'll tell you all about how it works in a week or so. And I'm not a security expert. And that's without overtime.
Heck I'll do half a day for anything that's simple enough for GPT-4 to stumble into. Snack breaks are important.
mild take: most people running windows servers on the internet, many wordpress sites, ...
some people don't upgrade because they need to pay for the new version, or the patch is only in a version with different capabilities, or they don't know how to, or they're scared of changing anything, etc. it's one of the great undercurrent failures in modern popular computing, and is one of the primary reasons it's possible for there to be so much internet background ~~radiation~~ noise
and to many of these people, "for them" it's "safe", because they never personally had to eat shit, on pure chance selection
I heard that in some cases the timeline of 'fix released' -> 'reverse engineered exploit out in the wild' is already under 24h (And depending on skill, type of exploit, target, prebuild exploit infrastructure it might even be hours). So I'm not sure threat actors need this kind of stuff anyway.