[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAN_LGv12B3xWuFeCacV91-wvd30UVabfLfHPwcPQ4BoH--1BdQ@mail.gmail.com>
Date: Thu, 13 Nov 2025 17:31:04 +0800
From: Alexander Patrakov <patrakov@...il.com>
To: oss-security@...ts.openwall.com
Cc: Russ Allbery <eagle@...ie.org>
Subject: Re: Questionable CVE's reported against dnsmasq
On Thu, Nov 13, 2025 at 10:34 AM Peter Gutmann
<pgut001@...auckland.ac.nz> wrote:
> [0] For example modify the code/operating environment to introduce a security
> vulnerability, I'll let you decide whether this qualifies as impractical,
> unrealistic, stupid, or several of the above.
In a different context, it's practical, realistic, and sometimes a
smart choice. Many custom Android ROMs now have a switch in the
settings that ignores the window secure flag, and yet another one
which prevents them from knowing that a screencast is in progress.
>From the app developers' viewpoint (I mean, apps that display
something sensitive), it is an intentionally introduced vulnerability
in the OS. From the user's viewpoint, it's a useful feature.
--
Alexander Patrakov
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
