Oops It's a kernel stack use-after-free: Exploiting Nvidia's GPU Linux drivers

Re:Oops It's a kernel stack use-after-free: Exploiting Nvidi... by Pannoniae on Wednesday October 15, 2025 @08:52PM (#45600279)

Counterargument: security by obscurity does work. The common strawman is that it doesn't, but that's when it's the only defence.

See Spectre and Meltdown - if it was easy to exploit then we would all be pwned unpatched just by running the Windows installer - just like how Windows XP machines used to do that back in the day....

If your exploit requires lots of disassembling, decrypting random ad-hoc custom crypto, and even finding what you're looking for in some random 100MB .dll, that just isn't very likely to be found except by the nationstate guys. The signal-to-noise ratio is a wonderful thing. It's much easier to hide something amongst very mundane things (most secrets are boring) than to heavily guard something and advertise "SECRETS ARE HERE". There's quite a few examples of this in various programs and web services, you obviously don't know because you didn't find it!

[ Parent | on HN ]

Re:Oops It's a kernel stack use-after-free: Exploiting Nvidi... by exe34 on Thursday October 16, 2025 @02:17AM (#45602016)

I buried gold in your backyard!

[ Parent | on HN ]

Re:Oops It's a kernel stack use-after-free: Exploiting Nvidi... by Pannoniae on Thursday October 16, 2025 @10:54AM (#45606139)

Heh, good point, but it isn't really true when you invert it :) If you randomly search for stuff, you're very unlikely to find anything, only if you know what you are searching for, only then you find something...

[ Parent | on HN ]

Re:Oops It's a kernel stack use-after-free: Exploiting Nvidi... by vacuity on Saturday October 18, 2025 @05:00PM (#45630311)

I don't think what you're describing is not "security by obscurity" so much as it is "security by not being the target". And "security by obscurity", if not used standalone, is basically just "security by good practices".

[ Parent | on HN ]