Make Ubuntu packages 90% faster by rebuilding them

Re:Make Ubuntu packages 90% faster by rebuilding them by fc417fc802 on Wednesday March 19, 2025 @07:32PM (#43418371)

I'd argue that AnC is a side channel attack. If I can obtain key material via a side channel that doesn't (at least in the general case) suddenly change the category of the corresponding algorithm.

Also IIUC to perform AnC you need to already have arbitrary code execution. That's a pretty big caveat for an attacker.

[ Parent | on HN ]

Re:Make Ubuntu packages 90% faster by rebuilding them by ryao on Thursday March 20, 2025 @05:01AM (#43421038)

You are not wrong, but how big of a caveat it is varies. On a client system, it is an incredibly low bar given client side scripting in web browsers (and end users’ tendency to execute random binaries they find on the internet). On a server system, it is incredibly unlikely.

I think the middle ground is to call the effectiveness of ASLR questionable. It is no longer the gold standard of mitigations that it was 10 years ago.

[ Parent | on HN ]