[buster]

Can we please stop posts like that without a proper introduction? I'm counting myself as proficient in Linux for many years and all i get is that it's some C code and apparently some 0day. What? I'm certainly not starting to decipher that or compile and run it.

p.s.: same should go for all the "x anounces y" where the posted link neither explains what x is nor what y is.

[rdl]

I wish HN would allow both text and links in the same article. Otherwise you basically have to write a blog entry.

[mooism2]

HN encourages you to write a blog post and submit that, yes.

[dalore]

I believe rdl wants HN to be their blog.

[rdl]

HN hates "blogspam", so I'd be reluctant to write a 1-3 para intro and then cite a post like this, then submit it to HN. Although I guess if it added context, it wouldn't be horrible.

[mooism2]

If you haven't got enough to say that would raise a blog post above being blogspam, then submit your thoughts as a comment after submitting the link.

[ars]

You can simply post a comment to your own submitted story.

[astrodust]

I'm sure that's nearly impossible to manage in this day and age. If only someone could create a service that made such a thing easy.

[lawl]

Well, to be fair it's rather easy to spot what this is doing. Looking at the last two lines of code:

    assert(!setuid(0));
    return execl("/bin/bash", "-sh", NULL);

It spawns a root shell, so it's (probably) a (local) privilege escalation.

[jstanley]

That doesn't explain anything about how it works though.

Anybody could submit some unreadable C code that finishes up with setuid(0) and exec("/bin/sh") - it isn't interesting without an explanation of what it's doing.

[lawl]

Well, that's a different question. A fully fledged analysis of this exploit would certainly be interesting. But it's an 0day, I think it's more important to patch vulnerable servers first. And I don't see what's stopping anyone from submitting an analysis of this a few days later.

[zwp]

Minimal explanation (allegedly by author "sd") at: http://packetstormsecurity.com/files/121616/semtex.c

[buster]

I would have loved to have THIS as the link target, the three short sentences make a big difference, imo.

[mathnode]

Maybe they drew a picture to explain it, http://fucksheep.org/~sd/mspaint/

umm NSFW, if you work at a school.

[godgod]

Who the F keeps a directory of images like this? I've seen enough internet for the day.

[est]

> I'm counting myself as proficient in Linux for many years

That's the difference between a power user and a hacker.

A power user RTFM, a hacker RTFS.

[tomp]

The problem is you might be a Windows/Java/ASM/Lisp hacker, and you would be able to understand the general principles, but not the specific (and unfamiliar) source code.

[pi18n]

I think the problem is that the comment appears to use a "no true Scotsman" fallacy.

[pi18n]

When you imply that a hacker should read and understand the source, are you referring to the posted code or Linux itself (or both)?

[buster]

The difference is that i don't know if this is worthy to invest time and effort or not. Does this have an impact on a wide install base of servers? Apparently some HNers can't reproduce this. So it's not worth my time? I would assume it's just common sense (or courtesy) to put a little bit of text around it. How often do you read a news article about quantum mechanics that is just some lines of advanced math without any explanation at all?