[HN Gopher] Frustrated dev drops three zero-day vulns affecting ...
___________________________________________________________________
Frustrated dev drops three zero-day vulns affecting Apple iOS 15
Author : LinuxBender
Score : 136 points
Date : 2021-09-26 19:29 UTC (3 hours ago)
(HTM) web link (www.theregister.com)
(TXT) w3m dump (www.theregister.com)
| saurik wrote:
| There were a ton of comments about this a few days ago:
|
| https://news.ycombinator.com/item?id=28637276
| userbinator wrote:
| Unfortunately it doesn't sound like these could be used for
| jailbreaking. Maybe that's why Apple didn't care so much...
| amelius wrote:
| Apple's acting more and more like a government, also with their
| regulated app market.
| riknos314 wrote:
| >he told The Register, "Talking to Apple Product Security is like
| talking to a brick wall."
|
| >The Register asked Apple to comment, but the brick wall did not
| respond.
|
| Seems about right.
| TameAntelope wrote:
| Very presumptuous of me to say this, but I wonder if the "brick
| wall" a non-technical PR type who has been put in the center of
| many very technical questions, and has realized that his/her
| boss doesn't yell at him/her if he/she simply doesn't respond
| very much to external queries.
|
| It can be hard when your job mostly consists of talking to
| extremely knowledgable people (such as many researchers in this
| field are) without yourself being at least broadly knowledgable
| on nearly everything technical.
| twiceaday wrote:
| https://tenor.com/view/dono-wall-talking-wall-bricks-gif-177...
| JonathanBeuys wrote:
| I am always shocked when I find out how lax security is handled
| even by parties of whom I thought they would take security very
| serious.
|
| Did you know that you can bypass the lockscreen on Linux Mint by
| plugging in an external monitor?
|
| https://github.com/linuxmint/cinnamon/issues/9123
|
| Did you know that when you use Chromium on an up-to-date Debian
| stable, it has over 100 unpatched security holes?
|
| https://security-tracker.debian.org/tracker/status/release/s...
|
| If you cannot trust Debian - whom can you trust? Any suggestions
| which distro takes security serious?
| bgro wrote:
| Reminds me of the Windows XP (I think) days where you could
| bypass the login screen by pressing cancel.
| userbinator wrote:
| 9x. They were single-user and the credentials were only for
| network access (file shares etc.) The NT series were all
| multiuser so that didn't work.
| dharmab wrote:
| Foxboron on the Arch team is very serious about security. Check
| out the Security page on the archwiki for guidance on building
| your own hardened Arch system.
| WastingMyTime89 wrote:
| > If you cannot trust Debian - whom can you trust?
|
| When did Debian become a model of trustworthiness regarding
| software security?
|
| We are talking about one of the distributions applying the most
| patches to its repository for reasons which are often dubious
| and with little general oversight.
|
| Debian is famous for being run by volunteers but it has always
| been kind of dodgy. We are talking about the distribution which
| made it's version of openssl vulnerable by breaking its random
| generator in order to silence a Valgrind warning.
| orra wrote:
| Eh, OpenSSL was invoking blatantly undefined behaviour. The
| diff applied by Debian? GCC and Clang are perfectly entitled
| to behave the same.
| WastingMyTime89 wrote:
| But neither GCC nor Clang did and the diff applied by
| Debian actually triggered the bug without fixing anything.
| The fact that OpenSSL also happened to be a terrible piece
| of software doesn't exonerate Debian.
| amelius wrote:
| > Any suggestions how to run a secure Linux machine?
|
| Prevent physical access, install only ssh for external access
| and run Sshguard. And use Firefox as a browser.
| JonathanBeuys wrote:
| Hmm.. that is not what I meant. Rephrased it to "Any
| suggestions which distro takes security serious?" now.
|
| Since it seems that Debian has decided to not patch Chromium
| for months now, how do I know they won't do the same for
| Firefox at some point? Or any other software in their repos?
|
| I would prefer a distro which promises to keep all software
| in their repos secure for a certain amount of time. Even if
| that means having fewer packages than other distros.
| omnicognate wrote:
| If bang up to date software is what matters to you,
| Debian's the opposite of what you want. Maybe try Arch,
| which operates a rolling release approach and is well known
| for following the bleeding edge. FWIW, its firefox [1] and
| chromium [2] packages are currently at the latest versions
| and were both published on the day of the upstream release.
|
| [1] https://archlinux.org/packages/extra/x86_64/firefox/
| [2] https://archlinux.org/packages/extra/x86_64/chromium/
| (latest update was 24th sept, but there was also a 94
| version published on 21st, the day of the stable release)
| amelius wrote:
| Good question. Perhaps NixOS, because it allows you to
| easily compile your own packages (?)
| edoceo wrote:
| You're just compiling the same broken code.
| amelius wrote:
| The idea is that you download the most recent version of
| the source code of the package.
| tossaway9000 wrote:
| Its the same problem just at a different point in time.
| The latest code introduces the latest bugs and security
| vulnerabilities too.
| edoceo wrote:
| I'm on Gentoo 15+ years, am familiar with this theory and
| process.
| easton wrote:
| Why don't they keep Chromium up to date like they do with
| Firefox? Ubuntu (to my knowledge) exempts browsers from
| their LTS policy because of security fixes being bundled
| with feature updates.
| vadfa wrote:
| >Did you know that when you use Chromium on an up-to-date
| Debian stable, it has over 100 unpatched security holes?
|
| What do you expect when you use Debian stable? Precisely people
| choose Debian stable because it gets no updates. (I'm only half
| kidding)
| Mrnothing_ wrote:
| Thats why Firefox have lts realices
| foxpurple wrote:
| X11 screen lockers are not secure at all if you can get them to
| crash in any way, they revert to showing the full desktop
| unprotected.
| calvinmorrison wrote:
| fwiw TDE implements SAK. Don't know about anyone else.
| kevincox wrote:
| This isn't quite true. There are some X11 screen lockers
| (maybe only GNOME?) that coordinate with the login manager so
| that a crash just leads to a restarted login manager.
|
| ...but yes, most X11 screen lockers have this flaw.
| smoldesu wrote:
| I'm not surprised that Linux Mint has egregious security
| issues, the developers are paid nothing to make it and there's
| basically no corporate incentive to secure it. On the other
| hand, Apple and Google have quite literally _trillions_ of
| dollars at their disposal. Their security teams ought to be the
| largest and most advanced in the world, but they aren 't.
| They're criminally understaffed and have their hands tied by
| upper management when it comes to accepting help from third-
| parties like Corellium _who actually know what they 're doing_.
| Instead, everyone shuts each other out to pretend like they
| know what they're doing, only to get clowned on when some
| 13-year-old takes down their homepage with SQL injection.
|
| I'm tired of pretending like security is anything other than
| theater and optics at this point. You either accept humility
| and design transparent software, or embrace complexity and let
| the machine consume you. The business of building software has
| started shifting to the latter paradigm, and now they're paying
| the price for it. If we're lucky, we might see a reprieve of
| the late-80s within the decade, where the internet is saturated
| with buggy and proprietary servers ripe for the hacking.
| JonathanBeuys wrote:
| the developers are paid nothing to make it
|
| Isn't Mint the second most used Linux distro or so? Shouldn't
| selling the default search engine alone bring in a boatload
| of money?
|
| On their blog they say: Search engines who
| do not share the income generated by our users, are
| removed from Linux Mint and might get their ads
| blocked.
|
| https://blog.linuxmint.com/?p=1851
| edoceo wrote:
| Debian can't be held responsible for flaws in Chromium can
| they? Wouldn't those same issues exist on all distros with the
| same version of Chromium? Doesn't the distro just package what
| they can as best they can?
| JonathanBeuys wrote:
| I am confused about your question. Can you elaborate? Distros
| usually provide patches for known security holes in their
| repos. Why would one not hold them responsible to do so?
| edoceo wrote:
| How could Debian be the security gate for literally 1000s
| of packages?
|
| Chromium is a huge beast of code, should Debian maintainers
| be debugging and coding patches to various packages?
|
| I think we can't expect the distro to fix the security
| issues in everything. It's upstream responsibility to
| handle their own CVE.
| JonathanBeuys wrote:
| Upstream has done that already. Google patched those bugs
| months ago.
| edoceo wrote:
| Are we helping Debian get those processed into Bullseye?
| Or we just barking ideals? We all know FOSS is under
| staffed and under funded.
|
| Perhaps Google should have one FTE for each major distro
| to help keep that beast of a codebase up to the standard
| these threads seem to expect.
|
| It's a heavy burden to place on Debian - and I don't
| think it's fair to expect them to have eg Chromium and
| the 10-hundred other packages perfect.
|
| Debian is fscking awesome, they are doing amazing work.
| Hip Hip Hooray!!
| fiddlerwoaroof wrote:
| The whole maintainer model exists in Debian because
| Debian tries to do its own maintenance on packages, even
| if the original developers are unwilling to accept the
| fix back.
|
| Chromium and Firefox are sort of monster code bases,
| though, it's not surprising to me that distros are
| reluctant to change it in key ways.
| hakre wrote:
| No, software developers and package maintainers do. A
| distro is where it goes all together and normally under a
| license.
|
| Even licenses are different across packages in a repo, they
| normally all have a pretty clear wording how much you can
| hold responsible them for that (hint: no warranty, no
| fitness for a particular purpose).
|
| Read it before use and think first, e.g. how that software
| comes to life and is managed / maintained. Debian =/=
| Apple.
| JonathanBeuys wrote:
| The software developer (Google) patched those bugs months
| ago.
|
| Not sure what that has to do with licenses.
| mwcremer wrote:
| > Any suggestions which distro takes security serious?
|
| OpenBSD.
| ncmncm wrote:
| On the "base install". OpenBSD's attitude is, if you install
| insecure 3rd party code, it's on you.
|
| QubesOS, based on Xen hypervisor, provides compartmented
| security: a hole in an app need not provide access to
| anything else. You have multiple mostly long-running VMs for
| different roles. Hardware access is managed in VMs that do
| not run app code. 16GB RAM is just barely enough, and apps
| get no access to a GPU. But it's solid and mature. The 4.1
| release, due someday, has had a lot of UX attention.
|
| SpectrumOS is an an attempt at lighter-weight security. Based
| on NixOS, apps run in a minimal, temporary VM spun up just
| for the app, sub-second, for experience more like Docker than
| Virtualbox. Still very much under development. Donate to
| Alyssa Ross on Github to accelerate dev work.
| lokedhs wrote:
| This is the best answer. Qubes OS is really the only
| practical way to run Linux in a secure manner right now.
| Its isolation features are not just useful for security, it
| makes experimentation really easy as one of never has to
| worry about messing up the installation.
|
| Spectrum may be an option in the future, and I really hope
| it succeeds.
| messe wrote:
| Fedora Silverblue is becoming interesting as well,
| especially with "Toolbox" a tool that lets you quickly
| spin up relatively isolated containers as long-lived
| development environments, separated from the main OS-
| installation.
| [deleted]
| rado wrote:
| > Apple is shipping iOS with known bugs
|
| Shocker
| xchaotic wrote:
| it's working fine for the bottom line and stock price so why
| should they care more?
| shreddit wrote:
| This is not about bugs, there will always be bugs. These are
| security HOLES.
| [deleted]
___________________________________________________________________
(page generated 2021-09-26 23:00 UTC)