Mastodon Feed
Boosted by pixxl:
dalias@hachyderm.io ("Cassandrich") wrote:
@jschauma That isn't an option either. By accepting automatic/frequent updates, you are just adding more new vulns, and more of them are real vulns not fake ones like the stuff they're reporting.
The "1313 CVEs" are a lie. The hard problem is finding the 10-20 that are actually vulns and the 1-5 that are actually relevant to you amid the slopbros' DDoS attack on our attention. 🤬
The only solution is to close off all of the attack surface. Disable module loading entirely or switch to allow list model to block all of the "IPsec shit nobody asked for". Disable io_uring and other optional niche syscalls. Don't give out user accounts, and don't assume running network-facing junk daemons is safe just because they're running as nobody or chrooted. Etc.