Verifying your browser | Nitter
nitter.poast.org
  • Karna@lemmy.ml
    3·
    3 months ago

    More important question is - how this nitter instance is still working!!

    • steeznson@lemmy.world
      1·
      3 months ago

      I believe if the instance is still up then it will still work up until a daily limit is reached. Most of them appear to be broken because the limit is fairly low.

  • narc0tic_bird@lemm.ee
    2·
    3 months ago

    Let’s see if this really affects all Linux systems or if the stars need to align for this to actually be exploitable.

  • nyan@sh.itjust.works
    2·
    3 months ago

    I can’t think of anything except the kernel that is genuinely obligatory on all Linux systems, including embedded. Not glibc (musl). Not udev (mdev). Not systemd (OpenRC/runit/etc). My guess is that this is another exploit of something the reporter hasn’t realized isn’t mandatory because they’re not familiar with non-mainstream distros. I suppose it could be a kernel issue that Android has specifically patched, but if that’s it it’ll be fixed in short order.

    In other words, not exactly holding my breath.

  • Laser@feddit.org
    1·
    3 months ago

    Since this affects Linux and others, I’m guessing this is about OpenSSH. But I’m not very certain. Just can’t think of another candidate.

    But holy sh, if your software has been running on everything for the last 20 years

    This doesn’t sound like glibc as someone in the thread guessed.

    • Strit@lemmy.linuxuserspace.show
      1·
      3 months ago

      Could be quite a few different things.

      Could be the kernel itself, gnupg, openSSH or even bash.

      But we won’t know for sure, until it’s publically disclosed.

    • Treasure@feddit.orgOP
      0·
      3 months ago

      This link should be working.

      Quoting from the OP tweet:

      * Unauthenticated RCE vs all GNU/Linux systems (plus others) disclosed 3 weeks ago.
      * Full disclosure happening in less than 2 weeks (as agreed with devs).
      * Still no CVE assigned (there should be at least 3, possibly 4, ideally 6).
      * Still no working fix.
      * Canonical, RedHat and others have confirmed the severity, a 9.9, check screenshot.
      * Devs are still arguing about whether or not some of the issues have a security impact.

      I’ve spent the last 3 weeks of my sabbatical working full time on this research, reporting, coordination and so on with the sole purpose of helping and pretty much only got patronized because the devs just can’t accept that their code is crap - responsible disclosure: no more.