• drkt@scribe.disroot.org
    link
    fedilink
    English
    arrow-up
    9
    arrow-down
    4
    ·
    14 hours ago

    /c/selfhosted moment

    Sure don’t patch a quiet and easy root shell escalation because it is, by itself, not a remote exploit. I sure do hope you trust every single piece of software running on your computer.

    • thesmokingman@programming.dev
      link
      fedilink
      English
      arrow-up
      10
      arrow-down
      2
      ·
      11 hours ago

      I think you’re displaying a very big gap between understanding risk assessment and understanding task completion. So far I have not seen anyone say they would not complete the task. I have seen people complete risk assessment. Risk assessment does not mean I will not do something, it just reflects the urgency with which I will do it. Most self-hosted users can safely apply basic risk assessment to see, while the impact may be high, the likelihood is low. Obviously the likelihood increases the more hands off you are with, say, unattended container updates for things that can escape containers or access the underlying system. Should most self-hosted users literally drop everything, rush home, and apply the patch? No, basic risk assessment does not merit that. Should everyone apply the patch? Yes.