Re:Why Is C Faster Than Java (2009)
by kaba0 on Monday December 27, 2021 @04:12AM
(#29700850)
How is it the biggest and costliest security exploit ever? With even the most basic of firewalls a server should absolutely have it is not really exploitable. I’m not trying to downplay it, but I really don’t see how is it even remotely close to some ssh bugs.
[ Parent
| on HN ]
Basic firewall allows outgoing connections, so it wouldn't help.
Re:Why Is C Faster Than Java (2009)
by Traubenfuchs on Monday December 27, 2021 @05:08AM
(#29701154)
I‘d argue that not allowing your servers to make outgoing calls to non whitelisted targets is very basic security.
No, it's not. I can easily configure open ports using firewall-cmd. That is basic security. And there's no dedicated options to configure outgoing calls, there's no sane defaults to start with (I have no idea which targets should be whitelisted: ntp? update servers? anything else?), there's no system-wide integration, like my dnf can choose different mirror every time it runs.
Of course it makes sense to configure outbound white list, but there's no infrastructure in RHEL or Ubuntu and nobody's going to bother with custom scripts for that.
Are we still talking about the bug that relies on poorly chosen defaults?
Re:Why Is C Faster Than Java (2009)
by formerly_proven on Monday December 27, 2021 @09:30AM
(#29702736)
Do you disable DNS on your servers as well or use a restricted internal-only resolver?