Re: darkhttpd: timing attack and local leak of HTTP basic auth credentials

[Johannes Segitz <jsegitz () suse de>]

On Wed, Jan 24, 2024 at 08:42:35AM +0100, Hanno Böck wrote:
> I think it would be desirable that Linux distributions start using
> hidepid and mitigate the whole class of bugs like the one mentioned
> above.

I agree with you. Unfortunately this is next to impossible based on my
experience. We can get something like this into "hardened" configurations,
but enabling this in the default configuration will not work as there are
always (important) customers that will not accept it.

I believe we'll have to live with these issues for a long time :(

Johannes
-- 
GPG Key                EE16 6BCE AD56 E034 BFB3  3ADD 7BF7 29D5 E7C8 1FA0
Subkey fingerprint:    250F 43F5 F7CE 6F1E 9C59  4F95 BC27 DD9D 2CC4 FD66
SUSE Software Solutions Germany GmbH, Frankenstraße 146, 90461 Nürnberg, Germany
Geschäftsführer: Ivo Totev, Andrew McDonald, Werner Knoblich (HRB 36809, AG Nürnberg)

Attachment: signature.asc
Description: Digital signature