https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/ 🍿 nostr:note18amd3aesnrwfl7cltfje3y9q0q2vf6r7cpz6rznf5ynv70al775slegset
Removing cupsd on desktops has long been a part of many orgs security policy, and servers shouldn't have it installed in the first place. Having packages installed that aren't being actively used is a big attack surface, as this exploit shows.
Ppl use Linux instead of RTOS for all kinds of things they shouldn't. Man will use a full stack Linux distribution with a raspberry pi to turn on and off a light instead of going to therapy.
Man will use software that talks to a cloud server or a system in China, over the internet, instead of pressing a button to turn on and off a light instead of going to therapy. Every time us-east-1 goes tits up half the US households go dark.
That's why Bitcoin-Safe https://github.com/andreasgriffin/bitcoin-safe will require (!) hardware signers. I'm currently polishing the beta version with support for Coldcard, Coldcard Q, Jade, bitbox02, and specter DIY.
cupsd + some random closed firmware for printer compatibility all exposed on misconfigured avahi is the real man full stack to do bitcoin signs 🙏
I tested my nostr:nprofile1qqs9df4h2deu3aae83fmet5xmrlm4w5l9gdnsy3q2n7dklem7ezmwfcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduq5xamn8ghj7dnvv45xs7tywde8g6rpvakkjuekw46nvar4vdhxgan6wumkxatzwpckk6rk0puhjdm2da5k7ce5x4kkkumjx3jkzepwdahxjmmwqyt8wumn8ghj7un9d3shjtnwdaehgu3wd9hxvmckqw0xz node and it is not vulnerable. You may get different results with different services installed https://image.nostr.build/113cb03979d697434a35872646457c666a4f2eec9dc0466865f87ba989bf4503.jpg nostr:nevent1qqs0v27ejvkl5s7anap48wulk7mn2q2gt8l4a29pmhguacpxq5fcmuspz3mhxw309ucnydewxqhrqt338g6rsd3e9upzp6y2dy0f3kvc0jty2gwl7cqztas8qqmc5jrerqxuhw622qnc2pq3qvzqqqqqqy0ww6xs