Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 24 Jan 2024 09:19:00 +0100
From: Johannes Segitz <>
Subject: Re: darkhttpd: timing attack and local leak of HTTP
 basic auth credentials

On Wed, Jan 24, 2024 at 08:42:35AM +0100, Hanno Böck wrote:
> I think it would be desirable that Linux distributions start using
> hidepid and mitigate the whole class of bugs like the one mentioned
> above.

I agree with you. Unfortunately this is next to impossible based on my
experience. We can get something like this into "hardened" configurations,
but enabling this in the default configuration will not work as there are
always (important) customers that will not accept it.

I believe we'll have to live with these issues for a long time :(

GPG Key                EE16 6BCE AD56 E034 BFB3  3ADD 7BF7 29D5 E7C8 1FA0
Subkey fingerprint:    250F 43F5 F7CE 6F1E 9C59  4F95 BC27 DD9D 2CC4 FD66
SUSE Software Solutions Germany GmbH, Frankenstraße 146, 90461 Nürnberg, Germany
Geschäftsführer: Ivo Totev, Andrew McDonald, Werner Knoblich (HRB 36809, AG Nürnberg)

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.