• 1 Post
  • 374 Comments
Joined 1 year ago
cake
Cake day: June 9th, 2023

help-circle

  • same amount of effort

    Physical effort, yes. Cognitive effort, no.

    • Intros on a serial show are expected, and in some cases change subtly from one episode to another to provide additional entertainment value (eg the Simpsons intro). In other cases a change of intro sets the setting for the episode (eg Star Trek: Enterprise’s Storm Front episodes).
    • YouTube ads are not related to the show, provide no contextual value, and in the case of interstitial ads are not even at a predictable time. They also tend to be inanely repetitive, showing the same ad over and over in consecutive videos. Contrast those to eg halftime ads at the Superbowl broadcasts, which have predictable timing, variety, and have a history of being (or trying to be) entertaining.





  • CUPS is installed on the majority of desktop systems. One of the listed CVEs indicates that port 631 is by default open to the local network, so if you connect to any shared network (public WiFi, work/school network, even your home network if another compromised device gets connected to it) you’re exposed. Or a browser flaw or other vulnerability could be exploited to forward a packet to that port.

    In other words: While access to port 631 is required first, the severity of the vulnerability lies in how damn easy it is to take over a system after that. And the system can be re-compromised any time you print something, making this a persistent vector.













  • That seems like a myopic view. Service misconfiguration is not always a vendor’s fault, and demanding software vendors to patch their products is not going to fix OSS vulnerabilities. In fact, we’ve seen examples this year of increased pressure to fix “issues” leading to developers unwittingly accepting malicious commits.

    Mind you, I’m not contesting that some vendors produce dogshit products (looking at you, CrowdStrike), but calling all vendors villains is a bit of a stretch.