[unethical_ban]

>Later, when I realized that inbound traffic was bypassing the firewall, I notified UC Berkeley’s Information Security Office of the potential security vulnerability, but their response was somewhat lacking in urgency. So we’ll see.

If I were on their infosec team I wouldn't ignore it, but also, infosec and network often different silos. If network was already notified, infosec can't do much but complain.

And, it seems the network was somewhat secure anyway. Any inbound scan or malicious traffic would get dropped going outbound, since there was no session on the outbound firewall.

[ikiris]

> Any inbound scan or malicious traffic would get dropped going outbound

There are lots of types of maliciousness that would not be affected by this.

[unethical_ban]

True. I was thinking exfil and communication. Of course fuzzing/DoS is doable.

[ikiris]

i mean, you can have a full session via dns chat this way pretty easily

[jiehong]

Except maybe for UDP traffic a la Tailscale