On Wed, Jan 26, 2022, 12:39 PM Andrei POPESCU <andreimpope...@gmail.com> wrote:
> On Ma, 25 ian 22, 16:13:23, Nate Bargmann wrote: > > I am subscribed to that list and get them too. > > > > I just see that three more messages popped in since this morning from > > the security list. > > > > The complaints seem to be only about browsers. The inference seems to > > be that the latest release always fixes security bugs. While this is > > true to an extent, what is seldom acknowledged is that new releases also > > bring new and as yet undisclosed bugs that will be fixed next time or > > the time after or the time after that or... I figure it's a gamble > > either way and stick with the Debian packages. > > I'll use the opportunity to draw attention to DSA-5059-1, see e.g. this > article for details: > > > https://arstechnica.com/information-technology/2022/01/a-bug-lurking-for-12-years-gives-attackers-root-on-every-major-linux-distro/ > > And please don't bother to reply with "there are no other users on this > system I should worry about", the bad guys could still find ways to get > in, e.g. via a compromised browser, regardless if you are behind a > firewall or not[1]. > Servers don't have browsers installed on them, for exactly this reason. I think your argument above that is a red herring. Because file attribute modification detection should be running regularly. On home machines as well as servers. Without that, "keeping the system up-to-date" will not prevent intrusion. IOW you closed the barn door before the cow escaped. Good. But she went out the other door that was still open. Any system connecting to the internet should be kept up-to-date. > > Even if you don't care about your data, privacy, etc., your system will > probably become part of some botnet and be used to spread malware and > spam to others. > > > [1] Of course, the risk level is significantly lower for the typical > home user, but still not negligible in my opinion - we just can't know > what unknown browser vulnerabilities there might be lurking, which the > bad guys could actively exploit via malicious websites (vs. targeted > attacks for high value targets). > > In today's world once your browser is compromised https://xkcd.com/1200/ > applies. > > > Kind regards, > Andrei > -- > http://wiki.debian.org/FAQsFromDebianUser >
