Top all-time · #2997
Red Hat
Company blog · securityblog.redhat.comsecuritysystems
Red Hat is the company blog at securityblog.redhat.com, writing about security and systems. Since 2012, 26 different Hacker News readers have linked it 29 times, most often “Bash specially-crafted environment variables code injection attack”. The last post was in 2023, but the archive is still widely read.
Too few sampled comments (10) to say how often HN recommends it.?
Why HN links it
HN readers link Red Hat's security blog to explain and cite vulnerabilities, including the Shellshock bash bug and Docker image security, and to quote its statements on how affected systems are impacted.
Summarised by Claude from a sample of 10 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Discover how we reduce risk in any environment and across the open source ecosystem
Most-linked posts?
- Bash specially-crafted environment variables code injection attack6 people · 6 mentions · first linked 2014-09-24
- Before you initiate a “docker pull”3 people · 3 mentions · first linked 2014-12-23
What Hacker News says?
I agree that security should have been in place before they went 1.0. However, if you look at the work on the version of the registry (docker/distribution on github), they are taking things more seriously and trying to get the basics right. I find your last point a bit strange. We all know the Docker development experience is a lot better than raw lxc. I'm saying you can (and probably should) be more careful about p…
Comment linking /2014/12/18/before-you-initiate-a-docker-pull/
on “The sad state of sysadmin in the age of containers”Submitted Samba remote execution vulnerability (CVE-2015-0240) as a story · 79 points
HN discussionRedHat security says: > PHP scripts executed with mod_php are not affected even if they spawn subshells. https://securityblog.redhat.com/2014/09/24/bash-specially-cr...
Comment linking /2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/
on “CVE-2014-6271: Remote code execution through bash”Submitted Factoring RSA Keys with TLS Perfect Forward Secrecy as a story · 43 points
HN discussionAs I understand this, any CGI script could be affected. Even if written in a different language if it turn does an os.system (or equivalent). More info here: https://securityblog.redhat.com/2014/09/24/bash-specially-cr... The permissions would only be as the web server user, but that allows all sorts of things to be run that are quite dangerous (resource exhaustion, attacking remote machines, downloading code and ru…
Comment linking /2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/
on “CVE-2014-6271: Remote code execution through bash”Submitted Emergency Security Band-Aids with Systemtap as a story · 10 points
HN discussionNo update out for Ubuntu Server 14.04 yet. /edit: the Red Hat blog has a good overview https://securityblog.redhat.com/2014/09/24/bash-specially-cr...
Comment linking /2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/
on “CVE-2014-6271: Remote code execution through bash”Submitted Before you initiate a “docker pull” as a story · 7 points
HN discussionenv x='() { :;}; echo vulnerable' bash -c "echo this is a test" From https://securityblog.redhat.com/2014/09/24/bash-specially-cr...
Comment linking /2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/
on “CVE-2014-6271: Remote code execution through bash”Submitted Array allocation in C++ as a story · 7 points
HN discussionDoes anyone think it might be related to the recent bash bug? It even affects dhcp clients which is a case with aws. https://securityblog.redhat.com/2014/09/24/bash-specially-cr...
Comment linking /2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/
on “AWS issues unavoidable reboot schedules with short notice on many EC2 instances”Submitted Bash specially-crafted environment variables code injection attack as a story · 6 points
HN discussionhttps://securityblog.redhat.com/2014/12/18/before-you-initia... I think RH has also posted this just for the attention.
Comment linking /2014/12/18/before-you-initiate-a-docker-pull/
on “Docker Image Insecurity”Submitted The hidden costs of embargoes as a story · 4 points
HN discussionAccording to Red Hat, the current best way to secure your Docker usage is to `127.0.0.1 index.docker.io` and use an alternate transport. The core "translate flags into running container options" works fine IMO, it's the centralized transport causing the issue. Which isn't the end of the world, as distributing tarballs is not exactly a demanding task. As an example / plug, I helped write a (prototype) tool that lets…
Comment linking /2014/12/18/before-you-initiate-a-docker-pull
on “Docker Image Insecurity”Submitted TLS Landscape as a story · 4 points
HN discussionFunny, a recent qemu exploit, Venom, was mitigated by sVirt, which is 100% SELinux based: https://securityblog.redhat.com/2015/05/13/venom-dont-get-bi... I could easily find a dozen plus 0day attacks which SELinux mitigated in Fedora/CentOS/RHEL, but there is no point in responding to a troll with much more than the minimum necessary.
Comment linking /2015/05/13/venom-dont-get-bitten/
on “Hunting for Hackers, N.S.A. Secretly Expands Internet Spying at U.S. Border”Submitted JOSE – JSON Object Signing and Encryption as a story · 3 points
HN discussionThe most important information is missing - did the attackers get the package signing key? The comment "the window for package compromise was very very small" is a bit ambiguous. That the security of package integrity is so fragile should greatly concern all of us. Almost all big Linux distributions rely on downloading compiled packages signed by a single key. If the build system is compromised your Linux distributi…
Comment linking /2013/09/18/reproducible-builds-for-fedora/
on “Deb.haskell.org Security Breach”Submitted Frequently Asked Questions about the Shellshock Bash Flaws as a story · 3 points
HN discussionIf I'm looking at this correctly, it appears that the Red Hat patches aren't vulnerable to this particular vulnerability. (I believe they patched bash differently than upstream, as per https://securityblog.redhat.com/2014/09/26/frequently-asked-... ) EDIT: I tested on CentOS 6.5 and Fedora 18 (for which we'd manually backported the Fedora 19 patches).
Comment linking /2014/09/26/frequently-asked-questions-about-the-shellshock-bash-flaws/
on “3rd Shellshock Vulnerability Found”Submitted A Brief History of Cryptography as a story · 3 points
HN discussionSubmitted Not using IPv6? Are you sure? as a story · 2 points
HN discussionSubmitted Container Security: Just the Good Parts as a story · 2 points
HN discussionSubmitted Can SSL 3.0 be fixed? An analysis of the POODLE attack as a story · 2 points
HN discussionSubmitted Position Independent Executable (PIE) Performance as a story · 2 points
HN discussionSubmitted It’s all a question of time – AES timing attacks on OpenSSL as a story · 1 points
HN discussionSubmitted A minimal security response process as a story · 1 points
HN discussionSubmitted Position Independent Executables (PIE) as a story · 1 points
HN discussion
