News for hackers. Stuff that matters.

A comment on Bluetooth keystroke-injection in Android, Linux, macOS and iOS. Parent comment

Re:Bluetooth keystroke-injection in Android, Linux, macOS an... by fellerts on Saturday December 16, 2023 @07:05AM (#38663649)
Seems like the flag defaults to true since December 7 (Fedora 38) with bluez v5.70-4:

    $ rpm -q --changelog bluez | grep CVE-2023-45866 -C1
    * Thu Dec 07 2023 Peter Robinson <[email protected]> - 5.70-4
    - Add mitigation for CVE-2023-45866
[ Parent | on HN ]
Re:Bluetooth keystroke-injection in Android, Linux, macOS an... by jdfedgon on Saturday December 16, 2023 @08:52AM (#38664189)
This seems correct, however 'ClassicBondedOnly=true' is commented out in '/etc/bluetooth/input.conf' in Fedora 39 with bluez v5.70-4 anyways.
[ Parent | on HN ]
Re:Bluetooth keystroke-injection in Android, Linux, macOS an... by maxerickson on Saturday December 16, 2023 @09:57AM (#38664661)
Presumably so you can't turn it off simply by uncommenting the line. The default is defined in some source file.
[ Parent | on HN ]
Re:Bluetooth keystroke-injection in Android, Linux, macOS an... by creer on Saturday December 16, 2023 @10:44PM (#38670155)
Mine says

  # Defaults to true for security.
  #ClassicBondedOnly=true
(which is the patch indicated)
[ Parent | on HN ]
Re:Bluetooth keystroke-injection in Android, Linux, macOS an... by maxerickson on Sunday December 17, 2023 @10:04AM (#38673294)
I don't follow your point.
[ Parent | on HN ]
Re:Bluetooth keystroke-injection in Android, Linux, macOS an... by creer on Sunday December 17, 2023 @02:17PM (#38675500)
I was answering yours (perhaps reading it not the way you intended) and the grand parent's "HOWEVER 'ClassicBondedOnly=true' is commented out". No big deal. This style of option and comment and commenting out the option (default or not) is autopilot common - no special intent here.
[ Parent | on HN ]
Re:Bluetooth keystroke-injection in Android, Linux, macOS an... by cozzyd on Saturday December 16, 2023 @05:18PM (#38668279)
Generally commented out lines are defaults, right?
[ Parent | on HN ]
Re:Bluetooth keystroke-injection in Android, Linux, macOS an... by creer on Saturday December 16, 2023 @10:47PM (#38670171)
Often yes, but not always. Here both the default is mentioned and a commented line is offered (I like commented lines as they show a proper format).

  # Set idle timeout (in minutes) before the connection will
  # be disconnect (defaults to 0 for no timeout)
  #IdleTimeout=30
[ Parent | on HN ]