Hacker News Reader

Comment by fellerts | Hacker News Reader

Seems like the flag defaults to true since December 7 (Fedora 38) with bluez v5.70-4:

    $ rpm -q --changelog bluez | grep CVE-2023-45866 -C1
    * Thu Dec 07 2023 Peter Robinson <pbrobinson@fedoraproject.org> - 5.70-4
    - Add mitigation for CVE-2023-45866

View on HN

This seems correct, however 'ClassicBondedOnly=true' is commented out in '/etc/bluetooth/input.conf' in Fedora 39 with bluez v5.70-4 anyways.

Presumably so you can't turn it off simply by uncommenting the line. The default is defined in some source file.

Mine says

  # Defaults to true for security.
  #ClassicBondedOnly=true

(which is the patch indicated)

I don't follow your point.

I was answering yours (perhaps reading it not the way you intended) and the grand parent's "HOWEVER 'ClassicBondedOnly=true' is commented out". No big deal. This style of option and comment and commenting out the option (default or not) is autopilot common - no special intent here.

Generally commented out lines are defaults, right?

Often yes, but not always. Here both the default is mentioned and a commented line is offered (I like commented lines as they show a proper format).

  # Set idle timeout (in minutes) before the connection will
  # be disconnect (defaults to 0 for no timeout)
  #IdleTimeout=30

Reply on news.ycombinator.com