[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 24 Jan 2024 09:19:00 +0100
From: Johannes Segitz <jsegitz@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: darkhttpd: timing attack and local leak of HTTP
basic auth credentials
On Wed, Jan 24, 2024 at 08:42:35AM +0100, Hanno Böck wrote:
> I think it would be desirable that Linux distributions start using
> hidepid and mitigate the whole class of bugs like the one mentioned
> above.
I agree with you. Unfortunately this is next to impossible based on my
experience. We can get something like this into "hardened" configurations,
but enabling this in the default configuration will not work as there are
always (important) customers that will not accept it.
I believe we'll have to live with these issues for a long time :(
Johannes
--
GPG Key EE16 6BCE AD56 E034 BFB3 3ADD 7BF7 29D5 E7C8 1FA0
Subkey fingerprint: 250F 43F5 F7CE 6F1E 9C59 4F95 BC27 DD9D 2CC4 FD66
SUSE Software Solutions Germany GmbH, Frankenstraße 146, 90461 Nürnberg, Germany
Geschäftsführer: Ivo Totev, Andrew McDonald, Werner Knoblich (HRB 36809, AG Nürnberg)
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
