logoalt Hacker News

justicz • today at 4:19 PM • 4 replies • view on HN

I found this! I posted a semi-click-bait-ey tweet about it here [0], I think it’s important for people know how easy these bugs are to find now. It’s becoming borderline irresponsible not to audit your internet-facing code with modern AI tools.

[0] https://x.com/just1cz/status/2118009777922228361

Replies

vesinisa • today at 6:19 PM

Looks like you also found a similarly critical apt bug in 2019: https://lists.debian.org/debian-security-announce/2019/msg00...

Do you think there might be even more still lurking out there?

And what is your take on HTTPS for apt? I assume the MitM scenario for this and the previous bug could have been avoided by the use of HTTPS by default?

➕ show 2 replies
sczi • today at 4:39 PM

Nice work! A similar vulnerability in 2019 also found by you included the recommendation to update with:

  apt -o Acquire::http::AllowRedirect=false update
  apt -o Acquire::http::AllowRedirect=false upgrade
Since this also involves redirects, would that protect users while updating apt for this one also?
➕ show 1 reply
justicz • today at 4:21 PM

Speaking of which… if any of y’all work on security at OpenAI I have some questions for you about Daybreak! Please email me