Hacker News Reader

Comment by IgorPartola | Hacker News Reader

To be fair, http://en.wikipedia.org/wiki/TUX_web_server. Having said that, this is huge. This is way worse than Heartbleed for the IIS crowd.

View on HN

From the linked page: "TUX has never been an integrated part of the official Linux kernel, although it has been shipped in some distributions, notably Red Hat, SuSE and Fedora."

Sure. My point is that Microsoft isn't the entity to put a web server (or at least components of one) in the kernel. Some may look at it and laugh about how silly that idea is, but in reality many have tried it.

Yep. Another reason folks are against systemd, as it also includes a baked-in http server. Systemd is also poised to become a veritable "second kernel" on linux systems and nobody seems to care enough to stop it.

Isn't systemd an user space process ?

Yes.

It's still on track to becoming a second kernel.

I agree that systemd is a bad idea in the sense that they are doing too much all at once. It is a fine level of arrogance to assume that there wont be problems along the way :P That being said this thread is about the poor souls who are running IIS servers.

And how much internet-facing web content is served with this toy webserver exactly?

That's what I thought, none (except maybe the author's blog? wild guess).

except maybe the author's blog? wild guess

Nope, Ingo Mólnar uses Google+ for his occasional blogging (though the last post seems to be from 2013).

Haha, I knew somebody would actually look it up :)

Thank you!

Deleted comment

From that very link, they use IIS (what this CVE is about), not a linux kernel-space http server.

It really isn't.

OpenSSL's heartbleed was incredibly hard to patch because of the sheer number of products that link to the OpenSSL libraries. It required painstaking effort to ensure everything was running the latest releases. And the severity of Heartbleed was such that all encrypted information could be deciphered.

Whereas this problem... is a simple server crash that can be fixed by running a Windows Update. Not even on the same scale of vulnerability.

I personally worried about the simplicity of the attack. Granted at this stage, its just a DoS, but then take corporate patch cycles into account.. In reality, most aren't going to get patched, at best, for another week or so. Security is still second-fiddle at many companies.

Reply on news.ycombinator.com