7 ms·
Golden rule to get exploited
by hoffs 2y ago
Golden rule to get exploited
- 38 2y agothe "but muh security" argument is absolute horseshit 99% of the time. and the 1% that actually need it, are going well beyond automatic updates to secure their systems.
- trog 2y agoIf you look at the background radiation of the Internet of automated things just hitting services to probe for exploits, they are most commonly looking for exploits from bugs in older software. There's a timing argument - that unless you're at risk of zero days (like you're the DOD) - that you probably don't need to upgrade immediately. But it seems unarguable to me that the longer you wait, the greater the risk from a security perspective. As always, security is a trade off. Risk of breaking from an update has to be balanced against risk of exploit. I'd argue the latter is going up more quickly than the former.
- thot_experiment 2y agoHow many actual zerodays are there that don't require you to ALSO be doing something dumb per year? It seems exceedingly rare. I understand the argument if you're talking about like, a server running some CMS or whatever, sure that's gonna get pwned because it's a big target so it's worth going after. Your natted personal machine? You're fine unless you're running executable off random russian sites (and even then you're probably fine if you're getting your shit from reputable shady sites)
- l33t7332273 2y agoThere was that Windows IPv6 no click zero day within the last couple of weeks
- thot_experiment 2y agogood thing i disable IPv6 at home because it's an annoying pita and i run no machines with windows in the cloud, checkmate :P on a more serious note though I don't think machines with ipv6 enabled that are behind a NAT are likely to be vulnerable to this, i suppose maybe wormable if you can natpunch through some p2p voip or gaming service, it's the sort of patch i would probably install if i were made aware of it (if i had ipv6 enabled), but being made aware of it doesn't like, leave me worried, and i don't consider it to be likely to affect me unpatched
- BSDobelix 2y ago>I don't think machines with ipv6 enabled that are behind a NAT are likely to be vulnerable to this Would you be interested in educate yourself about IPv6? https://ipv6.he.net/certification/ https://ipv6.he.net/certification/
- thot_experiment 2y agoNo, I'd rather just keep turning it off. Though if you're interested in telling me why I'm wrong concisely instead of being snarky I'll read that.
- BSDobelix 2y agoNAT and IPv6......you really should educate yourself about it IPv6 is not "that" new...trust me (bro). You know, keep learning is a big part of life ;)
- LorenzoGood 2y agoNo, this is a crazy take, old versions of software are usually rife with exploits, where everyone knows about the bug.
- thot_experiment 2y agoIt's really not, I never upgrade anything and I haven't been pwned in like a decade. (Or maybe I have been pwned but not in a way that's affected me at all so you know, whatever)
- LorenzoGood 2y agoOn an internet exposed server?
- 38 2y agothats not what the discussion is about, stop hijacking the thread to push your narrative.
- LorenzoGood 2y agoI understand that auto updates aren't ideal, because they cause breakage (most of my systems dont auto update), but I don't get not updating your systems at all.
- thot_experiment 2y agoWhile sibling comment is correct about the discussion I do have a few VPS I've had around for a while (<5 years with only password based SSH too because keys are annoying asf to manage when you're like, on your phone trying to do something etc) and I barely ever upgrade those and everything seems fine. They have DNS pointed at them too so it's not like they're secret in any way. I suspect it's because I don't use many common software packages so the attack surface is small-ish.
- ndriscoll 2y ago
- Tepix 2y agoAttacks get automated and targets are no longer hand-picked. Having many unpatched systems makes the environment ripe for self-replicating worms.