News for hackers. Stuff that matters.
Re:Attacking Unix Systems via Cups, Part I by johnklos on Thursday September 26, 2024 @06:43PM (#41664321)
Anyone going to a coffee shoppe and using a public wifi is exposing CUPS and can be exploited. Simple minded dismissal doesn't help anyone.
Re:Attacking Unix Systems via Cups, Part I by gordonfish on Thursday September 26, 2024 @09:33PM (#41665413)
Honestly, this is why firewalls exist. This really isn't problem for anyone with basic computer hygiene.
Re:Attacking Unix Systems via Cups, Part I by zanecodes on Friday September 27, 2024 @12:22AM (#41666224)
The prevalence of attitudes like this in the Linux community is why the year of the Linux desktop will never come.

Imagine if your brand new refrigerator, by default, would leak toxic refrigerant into your kitchen unless you adjusted a valve just so. This fact is not called out prominently in the manual, but if you read the fine print in the manufacturer's assembly instructions and have a working knowledge of how a refrigerator operates, you can maybe infer that this valve must be adjusted after purchase to prevent leakage. You go on their support forum to try to figure out why your brand new refrigerator is emitting toxic refrigerant, and you're essentially called an idiot and told you don't have "basic refrigerator hygiene."

People don't want to become refrigerator mechanics. They want cold food.

Re:Attacking Unix Systems via Cups, Part I by abhinavk on Friday September 27, 2024 @12:35AM (#41666285)
Why isn't the firewall on by default on desktop systems?
Re:Attacking Unix Systems via Cups, Part I by snickerer on Friday September 27, 2024 @05:20AM (#41668001)
Because you don't need a firewall on a sensibly configured desktop computer.

If you have daemons that listen to incoming connections, you only want to run them if they are sane and secure.

A firewall makes sense when you don't trust the daemons in your lair, eh, network, and you don't have the possibility to replace insecure stuff with secure stuff. But a firewall must be maintained by experts.

For a single computer it is much easier: just make sure it is secure and don't add an extra layer of complexity to it.

Re:Attacking Unix Systems via Cups, Part I by acdha on Friday September 27, 2024 @07:30AM (#41669088)
That attitude was popular in the 90s but any definition of “sensibly configured” in this century involves a firewall.

The reason is that even experts make mistakes, get busy, or rely on assumptions which turn out to be incorrect. For example, you thought your service which uses strong authentication and SSH was safe to expose – and then Heartbleed or RegreSSHion happened. If you restricted ingress, you slept calmly. If you had it open, you had an emergency rush to patch and look for signs of compromise.

Re:Attacking Unix Systems via Cups, Part I by m4rtink on Friday September 27, 2024 @06:51AM (#41668733)
It is ? At least on Fedora Workstation for example, Firewall (controlled by firewalld) is installed and enabled by default.
Re:Attacking Unix Systems via Cups, Part I by yrro on Friday September 27, 2024 @11:55AM (#41672104)
Bear in mind that the default FedoraWorkstation firewalld policy does not protect TCP/UDP ports >= 1025.

Fortunately, in this case, cups-browsed uses port 631/udp :)

Re:Attacking Unix Systems via Cups, Part I by consteval on Monday September 30, 2024 @04:49PM (#41701930)
It is on Ubuntu last I checked.