Hacker News Reader

Comment by binkHN | Hacker News Reader

That's quite the sensationalist title for something that was recently patched.

Agreed. Also, "just got a lot weaker" is misleading, as the vulnerability already existed, it was just discovered. "was weaker than we thought" is a bit less exciting, but more accurate.

The headline is the opposite of the truth: it is now stronger than ever.

By the logic of a headline, a person cured of a disease is weaker afterward.

going through a long sickness usually leaves one weaker afterward, even if one is cured, no? and in some cases there might be a slight upside in acquiring a certain degree of protection from future illnesses from that disease through various immunity mechanisms (which are of course far from perfect).

It's more like you always had a disease and just didn't know it. Celiac comes to mind as a common example. I know people who improved a lot once they got diagnosed, and just never realized the symptoms meant anything before that.

yep, but that's not curable (yet!)

Okay, yes, that's one way the analogy breaks down.

Also while the attack is novel it is hard to launch in practice (requires MITM) and even if you manage to pull that off, there isn't much to be gained (even with the downgrade for authenticated data to use SHA1 as it isn't practical to attack an interactive session).

Patched by how many of the 80% mentioned?

I wouldn't get too excited; it requires a MITM so abusing it at scale would be difficult.

Big targets should be wary, people's Hetzner servers and VMs are probably safe. They're not worth the effort to get a MITM on.

Interesting choice of example, two months ago an organization found their Hetzner server was MITMed https://news.ycombinator.com/item?id=37955264

The patch was just released two days ago.

There are hundreds of thousands of devices out there running older versions of SSH that can't or won't ever be patched. Sure, for folks running a modern full OS that can just patch at will, they're great.

I think the title is far less sensational than you give credit.

these devices should not be directly reachable ovee internet to begin with

But they are, which is why this is an issue. Posting on HN "don't do that" isn't going to change the reality we live in.

Reply on news.ycombinator.com