7 ms·

Correct me if I'm wrong, but to be affected, don't you need to have UDP port 631 exposed to the outside world? Apologies for being a bit blunt, but if you're ex

Correct me if I'm wrong, but to be affected, don't you need to have UDP port 631 exposed to the outside world? Apologies for being a bit blunt, but if you're exposing services like printing to the internet that shouldn't be exposed, well, then... you kind of deserve to get owned, right?

neilalexander 2y ago
> you kind of deserve to get owned, right? The people who have no idea what services are listening on their machine due to some default that someone else decided upon absolutely deserve to get owned, yes, because that's a totally reasonable mentality to have. Sarcasm in case it wasn't obvious. At what point did it just become normal to be so user-hostile?
- PlayingPossum 2y ago
  To be fair, most regular users are not impacted by this vulnerability. That is exactly what is written in the article.
PedroBatista 2y ago
OK, I'll correct you :) This is the quintessential wrong way of thinking about computers and security. It's the equivalent of the "OK, but.. [insert BS argument trying to deflect]". There is no "but", "Your" system has a bug/vulnerability/non-compliance - FIX it and help the users/customers instead of waterboarding us with pseudo-moralistic quips about "deserving" and whatnot. The Universe is quite a big place with realities, situations and contexts you wouldn't even fathom. Be humble. ( Hope I wasn't too blunt :) )
- PlayingPossum 2y ago
  I mean, if you install your server and open it to the internet without securing it with a FW, what would you expect to happen?
  - PedroBatista 2y ago
    Seriously, and I mean this in the most non-aggressive way: Grow up.
    - PlayingPossum 2y ago
      Seriously, anyone who disagrees with that ends up with even bigger problems, like getting hit by ransomware. You, not some developer or Linus Torvalds or anyone else, are responsible for your client and your data. If you put your server on the internet without securing it properly, you deserve to get owned. Your negligence ends up hurting other people. Is that so hard to understand? You have to take security seriously. My point is that a firewall is the bare minimum you should be thinking about when setting up your server.
      - xena 2y ago
        The issue is when people don't realize that CUPS is installed either because it happened by default or was accidentally brought in through some other transitive dependency. Ubuntu is especially vulnerable to dependency smuggling like that because recommended packages are installed by default. Don't blame or anger at people for not knowing their stacks entirely. There's so much to keep track of that it's totally understandable that something like this can fall through the cracks.
        PlayingPossum 2y ago
        That's the point - you don't need to know your stack. You don't need to worry if CUPS is installed, enabled, or listening on your interface. You don't need any of that, as long as you do the bare minimum and configure your firewall. That's the whole point!!!
  - IshKebab 2y ago
    Depends what you mean by "expect": 1. To predict or believe that something will happen I expect it to get hacked because it's written in C. 2. To consider obligatory or required. I expect servers to be secure!

neilalexander 2y ago

> you kind of deserve to get owned, right? The people who have no idea what services are listening on their machine due to some default that someone else decided upon absolutely deserve to get owned, yes, because that's a totally reasonable mentality to have. Sarcasm in case it wasn't obvious. At what point did it just become normal to be so user-hostile?

PlayingPossum 2y ago
To be fair, most regular users are not impacted by this vulnerability. That is exactly what is written in the article.

PedroBatista 2y ago

OK, I'll correct you :) This is the quintessential wrong way of thinking about computers and security. It's the equivalent of the "OK, but.. [insert BS argument trying to deflect]". There is no "but", "Your" system has a bug/vulnerability/non-compliance - FIX it and help the users/customers instead of waterboarding us with pseudo-moralistic quips about "deserving" and whatnot. The Universe is quite a big place with realities, situations and contexts you wouldn't even fathom. Be humble. ( Hope I wasn't too blunt :) )

PlayingPossum 2y ago
I mean, if you install your server and open it to the internet without securing it with a FW, what would you expect to happen?
- PedroBatista 2y ago
  Seriously, and I mean this in the most non-aggressive way: Grow up.
  - PlayingPossum 2y ago
    Seriously, anyone who disagrees with that ends up with even bigger problems, like getting hit by ransomware. You, not some developer or Linus Torvalds or anyone else, are responsible for your client and your data. If you put your server on the internet without securing it properly, you deserve to get owned. Your negligence ends up hurting other people. Is that so hard to understand? You have to take security seriously. My point is that a firewall is the bare minimum you should be thinking about when setting up your server.
    - xena 2y ago
      The issue is when people don't realize that CUPS is installed either because it happened by default or was accidentally brought in through some other transitive dependency. Ubuntu is especially vulnerable to dependency smuggling like that because recommended packages are installed by default. Don't blame or anger at people for not knowing their stacks entirely. There's so much to keep track of that it's totally understandable that something like this can fall through the cracks.
      - PlayingPossum 2y ago
        That's the point - you don't need to know your stack. You don't need to worry if CUPS is installed, enabled, or listening on your interface. You don't need any of that, as long as you do the bare minimum and configure your firewall. That's the whole point!!!
- IshKebab 2y ago
  Depends what you mean by "expect": 1. To predict or believe that something will happen I expect it to get hacked because it's written in C. 2. To consider obligatory or required. I expect servers to be secure!