Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror

Submission + - New Linux Vulnerability (arstechnica.com)

Cognitive Dissident writes: Ars Technical is reporting a major new vulnerability in Linux. Named "Dirty Pipeline" it involves abuse of 'pipes' at the shell level as you might guess.

The name Dirty Pipe is meant to both signal similarities to Dirty Cow and provide clues about the new vulnerability's origins. "Pipe" refers to a pipeline, a Linux mechanism for one OS process to send data to another process. In essence, a pipeline is two or more processes that are chained together so that the output text of one process (stdout) is passed directly as input (stdin) to the next one. Tracked as CVE-2022-0847, the vulnerability came to light when a researcher for website builder CM4all was troubleshooting a series of corrupted files that kept appearing on a customer's Linux machine. After months of analysis, the researcher finally found that the customer's corrupted files were the result of a bug in the Linux kernel.


Comment Not as great as the public thinks! (Score 1) 33

While it's not the fault of the guys who discovered this that it was adopted at breakneck speed, there are problems with CRISPR. These problems have even been covered on this site.

"A suite of experiments that use the gene-editing tool CRISPR-Cas9 to modify human embryos have revealed how the process can make large, unwanted changes to the genome at or near the target site. "

Comment Entering the walled garden? (Score 1) 146

Won't Spotify want him to close his own website? They seem to prefer exclusive content. How does cutting off people who don't want to pay for the podcast increase his audience? Expect a noticeable drop in his audience once the show is Spotify exclusive. I certainly won't be listening anymore.

Comment Re:Does it matter? (Score 1) 100

You will have to tell me how:

^10000.grep( *.is-prime).say; # Retrieve prime numbers from 0-10,000

Is incomprehsible bullshit and:

given $value {
    when Str { ... Do string handling ... }
    when Int { ... Do integer handling ... }
    when Bool { ...Do boolean handing ... }
    default { ... Fallback handling... }
}

Is mind wanking....

If you've really tried the language, why not give it a comprehensive review?

Comment Local HOSTS also bypassed! (Score 1) 147

It is very important that people realize this also skips the local HOSTS file. That means that people who have been using "null" entries in their HOSTS files to block unpleasant things like ads and snooping will no longer have that particular layer of protection. As protective as encrypted DNS might be of some aspects of privacy, it might not be worth the price in other areas.

Ideally, any network-aware OS should be smart enough to do the encrypted DNS query, but include the local HOSTS check in the process. But I believe the only way to do that right now would require third-party utilities which most people will not be tech-savvy enough to setup for themselves.

Comment Re:Bandwidth? (Score 1) 75

Since Opera was once I good browser I had installed it on a device I own. It seemed OK for a while, but then I got flooded with tourism ads for China. The "notices" would respawn as quickly as I could delete them. Uninstall was the only remedy. Now I will not have anything to do with Opera in any OS.

Comment Re:Easy to get administrator access? (Score 3, Interesting) 80

No, it's not a non-issue, but it's a different kind of issue than most people realize. Remember the Alexis de Tocqueville Institution and the propaganda they pumped out last decade about how Linux and Open Source in general was a parasite on the tech industry, was enabling all sorts of illegal activities (such as terrorism - of course!), and attempted to publish a book claiming Linus Torvald's didn't really invent the Linux kernel? Microsoft was (and still is!) a major funder of this propaganda mill.

Think about the possible implications of a story like this: Could it generate calls to change the way the Linux kernel and programs that run under it are written? And now MS have their hooks sunk deeply into the kernel dev team. The SCO gambit (also funded by MS) failed, spectacularly. And the Astroturf de Tocqueville gambit failed, though not quite as spectacularly. And now we have MS "cooperating" in the development of Linux. And up pops a story that may justify an overhaul of Linux to make it controllable by MS Windows. Well, surprise, surprise! This "change of attitude" by MS is looking more and more like a subtler strategy to seize control of Linux rather than outright destroy it.

Slashdot Top Deals

Neutrinos have bad breadth.

Working...