Hacker Newsnew | past | comments | ask | show | jobs | submit | itintheory's commentslogin

Same. I have used the controller as a container. Take a backup of the configuration and you don't even need to keep it running. I returned to a network after two years, fired up a controller, imported the config backup and g2g

Gonna need a description of the correct way to do these things. I have a feeling I'll be one of today's lucky 10,000.

Rolling up headphone wires (or any wires) works best when you create a looped bundle and alternate between overhand and underhand. It stops it from getting twisted and tangled. When done right, you can hold one end, throw the under end, and it all unfurls neatly.

Learned this from a theatre stagehand and have been using it ever since.

https://youtube.com/watch?v=CYdu7aW_pm8


It has a name in the security industry, Insecure Direct Object Reference (IDOR) [1]. Somewhat related to Path Traversal [2]. Unfortunately CFAA is very broad and can be (mis)interpreted in wild ways.

[1] https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Dire... [2] https://owasp.org/www-community/attacks/Path_Traversal


There are many good options. [1]

[1] https://news.ycombinator.com/item?id=48321089


I was thinking along similar lines to what you've suggested here, but then I considered how many VPS might be configured by folks following some random web tutorial, to set up their LAMP stack (or whatever), that end up doing something like what was described.

A lot of those VPS instructions these days recommend a reverse proxy like Caddy or Traefik for that exact reason. I think it's also a valid argument to say that anyone playing around on a VPS without knowing what they're doing is probably going to learn some hard lessons, and that's kind of the point.

But there it's a feature.

Except for the M in LAMP.

Let's hope the M at least has a root password.

But you are right, that would be nasty. In my time the LAMP tutorials used the distribution packages so they always had sensible defaults.


This feels like using sudo is just inherently unsafe.

This but unironically. There's no way to ensure that nobody overwrote your .profile or .bashrc with a backdoored sudo that steals your password, or runs your command and then runs an evil command afterwards.

`which sudo`?

`/usr/bin/sudo`?


If they can override sudo, they can override which.

if you use \which it'll always be a shell built-in ;) though someone can put a different shell in your .zshrc

  $ which() { echo foo; }
  $ \which
  foo
The backslash only prevents alias expansion.

He meant `command which`

> it'll always be a shell built-in

`command which` wouldn't have been the built-in


`exec /tmp/fake-bash` in bashrc to intercept everything?

Then use the absolute path.

It is. That's why SELinux and AppArmor were invented.

Instead of having "root" and "user", both of these provide sets of permissions that can be granted to apps.

In this case, SELinux would've stopped this. Codex could've still relabelled the files when mounting but this can be blocked for sensitive directories like /etc.


This feels like using a computer is inherently unsafe.

On the plus side, once we outlaw them we'll shut down the ability for conspiratorial thinking to spread easily and the world will slowly heal from the last couple of decades (the previous one in particular).

Hooray! We're finally doing something about the harms of social media. Smash your computer today!


Safety meeting. Nobody works, nobody gets hurt.

Ah yes, it’s the conspiratorial thinking dividing society,

not humans being humans,

not the people at the highest echelons of society being corrupt (Epstein called).

It’s the people trying to piece that evil together so they know what to tell their kids - they’re the problem.

Sure.


I think we're only a few decades away from these things being said unironically.

It's already here, mobile OSes are just computers with ton of guardrails and you can't do whatever you want with it, for the sake of security. I mean we almost got an Android where you can't install the APK you want.

Where's that guy with the ButlerianJihad username when you need him?

Parallel construction is when they use illegally obtained evidence to construct a separate set of ostensibly legitimate evidence. Like, an illegal wiretap might lead to someone being in the right place at the right time to witness a crime.

<always has been meme>

While containers have some useful properties, it was never intended to be, and never really functioned as a strict security boundary. We've duct-taped around that, and it's reasonably good now, but that only goes so far.


The fundamental problem is that the kernel is just too huge of an attack surface. It is probably always going to have exploitable bugs. A VM (especially hardware assisted) is a relatively tiny attack surface and it shows in the amount of bugs found.

I typically say that containers (and any other isolation that shares a kernel) are good for "mostly trusted" workloads, like different teams at the same company. You want isolation against accidents more than intentional attacks.

VMs are good for just about everything if you are careful (for example what devices and hardware are exposed) but if you want ultimate isolation you want completely separate hardware. It is the only way to be sure against hardware bugs and side-channels or VM bugs.


I'm surprised that this has apparently been ongoing for 6-7 months. I thought outfits like GitGuardian, or solo researchers with trufflehog (etc) would find leaked keys in days, not months. Maybe this is related to the major growth of github? The scanners can't keep up?


Sounds like this one is in the same kernel modules as dirtyfrag, so the existing mitigations (if in place) are sufficient.


RedHat's mitigation is this:

  $ cat /etc/modprobe.d/dirtyfrag.conf
  install esp4 /bin/false
  install esp6 /bin/false
  install rxrpc /bin/false
Are those correct for this exploit?

https://access.redhat.com/security/vulnerabilities/RHSB-2026...


Yep, that's the advice from AWS for the previous set of vulnerabilities:

https://aws.amazon.com/security/security-bulletins/2026-027-...

That one also includes disabling user namespaces. Could be problematic if they're in use.


I don't know, but the problem with blocking esp4 and esp6 is that IPsec stops working, as I understand it.


For those who can I would recommend upgrading to Wireguard.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: