Hacker News Reader

Comment by hartator | Hacker News Reader

If you need the last version of Wireshark, it’s getting complicated. And when you have a setup with Wireshark that works why update it? I am dubious that Wireshark can be an attack vector so security updates won’t be useful. Installing last versions is very straight forward when you are on Osx or Windows. You just go to the website and download it. Plus you get the original binaries not a doctored version to fit whatever launcher and log organization is currenty trending at Ubuntu HQ. Don’t get me wrong I still love my Ubuntus. But this we need to rewrite all software to fit our distributions is not a strenght. I think this line of thinking is kind of shared by Linus himself.

View on HN

Going to dozens or even hundreds of different websites to download the latest versions of software and then manually installing them all isn’t fast at all.

c.f. apt-get upgrade or similar, which takes a few seconds.

>c.f. apt-get upgrade or similar, which takes a few seconds.

Except when the package isn't included, or it isn't the version you needed, because then you have to spend 40 minutes trying to install all the dependencies and building the package from source, instead of the 3 minutes it would have taken to install an .exe on Windows.

> because then you have to spend 40 minutes trying to install all the dependencies and building the package from source, instead of the 3 minutes it would have taken to install an .exe on Windows.

No, you take 2 minutes to install it using flatpak, or download a .appimage file.

And if neither of those are available, you spend that 40 minutes packaging the software, and submitting it to the distro you use for inclusion.

(If it was already packaged, but not new enough, that's a ~5 min job to do the update for your distro)

> And when you have a setup with Wireshark that works why update it? I am dubious that Wireshark can be an attack vector so security updates won’t be useful.

Ignoring feature enhancements and bug fixes for a moment, do you really think it improbable that there are security issues in a piece of software whose entire job is to sit on the network and record everything that it sees and then translate and interpret it?

If an evil app is already communicating on the web and is already on your computer, what can it gain more?

Wireshark (usually) runs in promiscuous mode; it'd be "an evil app is already able to send something visible from your network interface" - which to be fair, might help for internal uses. It does usually mean that anything on your local network can attack you.

Because the "evil app" is just a specially crafted JPG that your browser opened up that triggers some edge case in the old unpatched version of Wireshark that is inspecting traffic.

You have a very limited imagination. Wireshark is regularly attacked -- it parses random data it gets off the network, therefore it can be attacked using deliberately malformed packets. See https://www.wireshark.org/security/ for more info.

Every single of these vulnerabilities are crashes and infinite loops. The worst thing you can do - if I am running a 5-year old Wireshark - is to make it crash if I am visiting one of your web services. And you probably can already do that in newer versions if you dig enough.

Reply on news.ycombinator.com