Hacker News Reader

Comment by thom | Hacker News Reader

After all these years, we finally have enough eyeballs that all bugs are shallow, and it kinda sucks. How many times a week am I going to be updating my kernel from now on?

View on HN

I haven't updated mine. I have a firewall and it's not exposed to the Internet. Need a key to SSH in. Same with my public facing server. Almost none of these exploits are "drop everything now and patch" unless you are somehow exposing yourself stupidly.

It's a "drop everything and patch" if you have a large multi-user server where you don't completely trust all of the users. Like say in a university with a server that students can log in to, like I have just had the joy of updating (and had RHEL break ZFS on me yet again).

But yes, in most other cases no it isn't a "drop everything" exploit - but it does mean one less layer in the multi-layer security, as unprivileged remote exploits now become root-access remote exploits.

> unless you are somehow exposing yourself stupidly

Or, y'know, offer some forms of compute as a service.

I understand where you're coming from, it's no reason to panic.

But this kind of thinking can be dangerous because it implies that your systems don't talk to the outside world at all, which they obviously do. I mean a very glaring example is container images, so it definitely takes more than a firewall and ssh keys to stay safe in general.

If you’re running any sort of CI you’re probably going to have a bad couple of days if everything goes well

To be honest, CI has always been a massive risk, I'm a bit miffed at how blasé some people are about providing runners.

unless you run pinned CI runners on hardware you control

I sort of always expect there to be an LPE to root on Linux tbh, if anything this is great news and Linux might be a useful multiuser system after all.

Updating your kernel isn't good enough, it never was.

Native unsandboxed execution == root. Only thing that's new is some people started making websites for their LPEs.

https://github.com/google/security-research/tree/master/pocs...

So you think someone is going to break into your house, find your default credentials somehow and get root access?

With physical access, root access is as simple as setting init=/bin/bash in the kernel parameters from a bootloader. No need for credentials or anything.

Secure boot and disk enryption are not that unusual nowdays

Secure boot doesn't provide security, just control for device manufacturers.

Physical access always means the device is pwned. You can install a keylogger or something similar.

Secure boot ensures the image you boot was not tampered with. You can't install keylogger without tampering with the image. If you wanted to install physical keylogger, you would need to open the device up, and at least my laptop provides detection of bottom cover removal, meaning the system will ask you for a bios password if the laptop was opened up.

I think when there’s a step change in our ability to find one type of vulnerability, other types of vulnerability are probably going to become more common as well. Let’s see where we stand at the end of the year.

With how things are going the question should be ‘is twice a day often enough?’

At the moment it doesn't seem to be.

Within an hour of be advised of, and running the mitigation for DirtyFrag, my upstream provider has blocked all WHM/cPanel/SSH/FTP/SFTP access with a heads-up on:

CVE-2026-29201 CVE-2026-29202 CVE-2026-29203

which look like a repeat of CVE-2026-41940 a week ago.

Reply on news.ycombinator.com