9 ms·
This submission is currently the main HN submission. As of now the submission title is simply “Copy Fail”. Given the severity of the exploit, can we edit the
by jeffwass 5mo ago
This submission is currently the main HN submission.
As of now the submission title is simply “Copy Fail”.
Given the severity of the exploit, can we edit the Title to add some context that it’s a major Linux vulnerability?
Eg the other submissions say this :
“Copy Fail: 732 Bytes to Root on Every Major Linux Distribution.”
- ramon156 5mo agoI dont really get why you'd - buy a domain - vibe code a page/artifact/whatever (which, given the quality of LLM wordings, only makes an argument less strong) - post it on HN with no further explanation in the title Why not write a detailed report? Even a tweet makes much more sense in my head than this. Even a logo?? Sorry if this comes over as salty, I guess I'm just not getting the thought process.
- throwaway5465 5mo agoThe domain is canonical. Then it's syndicate everywhere. But all roads lead back to the domain.
- eddythompson80 5mo agoMaybe it’s tradition https://news.ycombinator.com/item?id=7548991 https://news.ycombinator.com/item?id=7548991
- stingraycharles 5mo agoI think they’re using it to promote their product, Xint Code, which was used to discover it. That’s the way I read it anyway.
- otherme123 5mo agoI hope they sell a lot of Xint Code licenses, so they don't have to sell their findings.
- Orygin 5mo agoConsidering they kinda botched the disclosure to Linux distros, I guess they wanted something most sensational to sell more licenses.
- eddythompson80 5mo agoHow did they botch the disclosure to distros?
- Orygin 5mo agoThey did not make a disclosure to the distros
- pixel_popping 5mo agostrategically botched ;)
- psifertex 5mo agoThey did not, in fact, botch anything. They notified the responsible party and followed a practice that is pretty much the accepted norm (and for good reason). How recursive should their notifications be? Just the tip three distros? The top dozen? Every embedded Linux router company? How about every hosting provider? They did what they're supposed to without being paid for it. The only other good source of funding for security research besides marketing budgets for security companies will NOT result in a disclosure timeline you'd be happier with. ;-)
- Orygin 5mo agoBut they most probably did get paid for it, they have ads for their shit all over the website.
- vntok 5mo agoDefinitely comes over as salty. Naming major flaws has been a tradition for decades. Remember Heartbleed? It had a site and a logo :) Shellshock, Meltdown, Spectre as well. A few more: https://github.com/hannob/vulns https://github.com/hannob/vulns This site though is pretty useful; first it serves as a central location to point people to with short links in chats/emails/whatever, then it has a quick visual explainer and a link to the detailed technical report for those who want more info. Pretty neat. Last but not least, buying the domain must have taken 5 minutes, prompting the page must have taken 30 minutes and posting it on HN must have taken 1 minute. So it certainly wasn't a lot of work in the grand scheme of things and probably did not deter the team from doing other important things.
- Orygin 5mo agoIt used to be done for fame and visibility. Give a marketable name and a website, your exploit will be talked about and your name will shine in the industry. Now it's done by an LLM to sell more LLMs services. Disclosure is botched to have the most sensational title so more click more upsell.
- mobeigi 5mo agoI'm being very cynical here but who says that their tool or LLM discovered this. How do we know they didn't hire some expert security researchers to find it or bought it off the black market as a promotion stunt. With that being said, I wouldn't mind if they made more sales on whatever they're advertising IF they followed the disclosure process well. A bad disclose immediately tells me I can't trust them because their moment in the light was more important that the safety of millions of boxes.
- staticassertion 5mo agoWhere would you have them write a detailed report if not a website?
- huflungdung 5mo ago[dead]
- petcat 5mo ago> I dont really get why you'd buy a domain [...] Even a tweet makes much more sense in my head than this I think we should be celebrating people hosting their own content on their own website instead of just posting on some social media site.
- sdevonoes 5mo agoYou are wrong. We should ditch walled gardens like twitter/facebook/ig
- jcul 5mo agoYes, strongly agree. This is HUGE news, I would have skimmed over "Copy Fail". The blog post might be a better place to link to also, it has more details on the exploit. https://xint.io/blog/copy-fail-linux-distributions https://xint.io/blog/copy-fail-linux-distributions There are also some good threads on which distros are vulnerable and mitigations on the github page. https://github.com/theori-io/copy-fail-CVE-2026-31431/issues https://github.com/theori-io/copy-fail-CVE-2026-31431/issues