Chinese Security Team Exploits Safari Security Flaw at PWN2OWN

[macproredux]

That's going to hurt and take a lonk time to clean up

 

[VoR]

That's going to hurt and take a lonk time to clean up

No GnuTLS on any of my systems. It's a lot harder to generalise with linux, as there's countless implementations unlike an OS like osx - You get what you're given.
The few applications that do rely on it in major distros can most likely be switched to openssl with a trivial change.
Patches were upstream on many distros within hours.... although that doesn't change the fact it's been a vulnerable package for years.

 

[macproredux]

No GnuTLS on any of my systems. It's a lot harder to generalise with linux, as there's countless implementations unlike an OS like osx - You get what you're given.
The few applications that do rely on it in major distros can most likely be switched to openssl with a trivial change.
Patches were upstream on many distros within hours.... although that doesn't change the fact it's been a vulnerable package for years.

I'm pretty sure I don't have it either unless it came through as a dependency in an AUR build but I do need to check. That doesn't mean that it's not going to be a mess to clean up

 

[munkery]

What do you base this on? There have been three exploits of Firefox presented at this PWN2OWN - why do you think Firefox would be more secure under Linux than under Windows?

Because Linux has many runtime security mitigations, such as position independent executables, that Windows doesn't include which causes many vulnerabilities that are exploitable in windows to not be exploitable in Linux.

Windows also includes structured exception handling which provides a second method to exploit memory corruption vulnerabilities. Unix based operating systems, such as Linux, don't include structured exception handling.

 

[krugieboy13]

I'm sure the NSA has ways.

Ya Tim Cook hands them the key....

 

[Shrink]

Ya Tim Cook hands them the key....

Please definitively source the assertion that Cook is in collusion with the NSA...and "hands them the key".