Hacker News Reader

Comment by renewiltord | Hacker News Reader

My old blog was on Linux and had 10 y of uptime until Hetzner wanted to retire it. I think high uptime is easy.

I was surprised by the fact no one actually exploited it (though maybe they copied everything and didn’t tell me) because network traffic, running binaries were all normal.

View on HN

That’s the difficult thing about high uptime with internet-connected devices. I remember watching uptimes go to astronomical numbers on netcraft, today all I can think about is how unpatched those systems must have been.

Well, uptime is usually about the kernel; it being high doesn't necessarily mean that the network-facing daemons (httpd, sshd, and so on) haven't been updated and restarted. Running an ancient kernel does mean you're more vulnerable to local privilege escalation, but an attacker would have to obtain local code execution first. It being an "old blog", there probably wasn't much more running than the SSH daemon and a web server, serving either static pages or some simple PHP pages; the attack surface wouldn't have been that large.

Not even local privilege escalation, though! I remember a couple notorious remote exploits being centered around ICMP ping. You're right that they are far less common.

I had the following:

- BIND

- an MTA/MSA (probably the riskiest thing)

- MySQL (local only)

- PHP + Apache2

- SSH

So the attack surface was larger than you’d think. I only had hundreds of blog visitors to be honest.

But the world has changed over the years. Even the existence of things like residential proxies makes fail2ban pointless nowadays. You have to be better. I was young and foolish and lucky.

Reply on news.ycombinator.com