| ▲ | Lammy 5 hours ago |
| Vindicated once again for turning off any update checks the moment I install any new piece of software. Even if this sort of (obviously rare) attack is not a concern, it baffles me how few otherwise-intelligent people fail to see the way these updaters provide the network (which itself is always listening, see Room 641A and friends) with a fingerprint of your specific computer and a way to track its physical location based on the set of software you have installed, all of which want to check for updates every goddamn day. |
|
| ▲ | derf_ 5 hours ago | parent | next [-] |
| It is baffling to me, as well. You know how you get a remote-code-execution vulnerability? You give a bunch of software permission to fetch code remotely and execute it. |
| |
| ▲ | 3 hours ago | parent | next [-] | | [deleted] | |
| ▲ | mmis1000 5 hours ago | parent | prev [-] | | Like… browser? Or anything with script loading capabilities like script engine in games. Executing remote script is almost unavoidable nowadays. And there isn't really a way to confirm if it is configured in a secure way. You either trust the developer or not. | | |
| ▲ | einr 4 hours ago | parent | next [-] | | At least JS code in a browser is sandboxed. A Notepad++ update is just rawdogging an executable on your bare metal, perhaps with admin privs even, and hoping for the best. | |
| ▲ | g-b-r 3 hours ago | parent | prev [-] | | First, it wasn't even the developer who compromised people, here; second, scripts in most cases are orders of magnitude less dangerous than a windows executable. And, in many cases you can get some protection from a developer going rogue (or not writing perfect code), it's not an all or nothing. |
|
|
|
| ▲ | arcfour 5 hours ago | parent | prev | next [-] |
| If the people with access to Room 641A want you, you're toast unless you're ready to make some REALLY big digital lifestyle changes that most people would not be amenable to, because you would have to be extremely paranoid on multiple fronts all the time. That kind of heightened vigilance is exhausting and really not worth it. Threat modeling: it keeps things realistic. |
| |
| ▲ | Lammy 5 hours ago | parent [-] | | Sorry for assuming you'd be able to extrapolate from one example. It could be at any level of the funnel from your local machine to the wider Internet. Closer to home: this sort of fingerprinting could defeat things like MAC randomization in a PSK-authed business/university setting if those IT departments had some reason to want to track you. I once worked at a company where the Security team were very proud of this and all the other tricks they used to catch leakers by figuring out who was on campus, where, at what time, usually via fingerprinting personal devices carried alongside corporate devices. | | |
| ▲ | arcfour 5 hours ago | parent [-] | | Ah, so, in addition to turning off automatic updates (everyone knows patches are for wimps! The real threat is supply chain compromise, not 1-days!), you also have taken all of the other necessary steps to protect yourself from the NSA? What if they just compel Microsoft to backdoor Windows/WinGet against you? And these updaters almost universally use HTTPS, which network-based adversaries can't see except for SNI, and even that's going away...? | | |
| ▲ | Lammy 4 hours ago | parent [-] | | > What if they just compel Microsoft to backdoor Windows/WinGet against you? You are confusing cause with effect. Leaking this type of fingerprint data over time is what allows users of Palantir-like systems to decide you're somebody worth individually targeting. |
|
|
|
|
| ▲ | sodality2 5 hours ago | parent | prev [-] |
| How do you deal with the opposite, software that you forget to update but contains vulnerabilities discovered/exploited later? |
| |
