Hacker News new | ask | show | jobs
by jsnell 1008 days ago
Did it really fly under the radar? It was widely reported in the mainstream media. There were at least two "top of HN frontpage" submissions on it.

https://news.ycombinator.com/item?id=37425007

https://news.ycombinator.com/item?id=37478403

2 comments

I would argue that it has flown under the radar because it has only been contextualized with respect to Chrome and iOS. The issue has and continues to affect many other critical places, including server-side image processing services.
Compared to the likes of log4shell, shellshock or heartbleed, yes. It feels like the immediately exploit possibility of it is arguably more than heartbleed, but I don't see every security person chasing after it in the same way.

I've been following the progress of some of the fixes in apps I use and it's meandering through intermediates at an urgency that is more akin to the ssh 9.1p1 vulnerability which required peopel to ssh into an affected server.

It's nothing close to heartbleed which was 'extract key material from every TLS-serving endpoint in the universe'. There are almost certainly exploitable buffer overflows in whatever device you're using right now.