Hacker News Reader

matrix2003

That’s the difficult thing about high uptime with internet-connected devices. I remember watching uptimes go to astronomical numbers on netcraft, today all I can think about is how unpatched those systems must have been.

View on HN

Well, uptime is usually about the kernel; it being high doesn't necessarily mean that the network-facing daemons (httpd, sshd, and so on) haven't been updated and restarted. Running an ancient kernel does mean you're more vulnerable to local privilege escalation, but an attacker would have to obtain local code execution first. It being an "old blog", there probably wasn't much more running than the SSH daemon and a web server, serving either static pages or some simple PHP pages; the attack surface wouldn't have been that large.

Not even local privilege escalation, though! I remember a couple notorious remote exploits being centered around ICMP ping. You're right that they are far less common.

I had the following:

- BIND

- an MTA/MSA (probably the riskiest thing)

- MySQL (local only)

- PHP + Apache2

- SSH

So the attack surface was larger than you’d think. I only had hundreds of blog visitors to be honest.

But the world has changed over the years. Even the existence of things like residential proxies makes fail2ban pointless nowadays. You have to be better. I was young and foolish and lucky.

Reply on news.ycombinator.com