<![CDATA[Today I have spent way too much time handling the https://copy.fail situation #copyfail]]>Today I have spent way too much time handling the https://copy.fail situation

The persons who discovered it didn't notify the distribution security list, so no patched kernels was available for people to install when they released it.

But they did have time to write an exploit, and thought it was a good idea to distribute that on day one, before vendors had time to provide patches.

I'm not very impressed with xint.io, I guess it's the marketing department that runs the show.

]]>https://board.circlewithadot.net/topic/1c00fa65-dd1e-4d2b-b0bb-49624acf7e0a/today-i-have-spent-way-too-much-time-handling-the-https-copy.fail-situation-copyfailRSS for NodeFri, 15 May 2026 01:49:21 GMTThu, 30 Apr 2026 14:35:25 GMT60<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Sat, 02 May 2026 11:40:47 GMT]]>@eloy @alexanderkjall @noisytoot but oh boy the coding style is much worse than literal amlogic kernel BSP]]>https://board.circlewithadot.net/post/https://berkeley.edu.pl/objects/1d1bca91-a10c-491b-a0f2-992dae6cb9cfhttps://board.circlewithadot.net/post/https://berkeley.edu.pl/objects/1d1bca91-a10c-491b-a0f2-992dae6cb9cfSat, 02 May 2026 11:40:47 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Sat, 02 May 2026 11:40:09 GMT]]>@eloy @noisytoot @alexanderkjall The only reason I can think of to use this for marketing is .. yeah, what you said, and maybe also "hey our AI is so good!!!"]]>https://board.circlewithadot.net/post/https://berkeley.edu.pl/objects/23711783-9a4c-4bfa-8f27-b95cefa5326chttps://board.circlewithadot.net/post/https://berkeley.edu.pl/objects/23711783-9a4c-4bfa-8f27-b95cefa5326cSat, 02 May 2026 11:40:09 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Sat, 02 May 2026 06:50:56 GMT]]>@alexanderkjall you can't expect that guy to notify everybody. He notified the kernel security list, but they didn't communicate downstream.

]]>https://board.circlewithadot.net/post/https://fosstodon.org/users/BasieP/statuses/116503652342230953https://board.circlewithadot.net/post/https://fosstodon.org/users/BasieP/statuses/116503652342230953Sat, 02 May 2026 06:50:56 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Sat, 02 May 2026 04:09:34 GMT]]>@raven667 @alexanderkjall Isn't the stance rather that all bugs are security bugs?

I mean it doesn't change much in practice, but it's a better argument IMO.

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/Arcaik/statuses/116503017838125893https://board.circlewithadot.net/post/https://hachyderm.io/users/Arcaik/statuses/116503017838125893Sat, 02 May 2026 04:09:34 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Sat, 02 May 2026 03:22:07 GMT]]>@fun @noisytoot @alexanderkjall It is not serious, but OTOH the exploit is simple enough that it's still relatively easy to decipher.

]]>https://board.circlewithadot.net/post/https://social.librem.one/users/dos/statuses/116502831263332154https://board.circlewithadot.net/post/https://social.librem.one/users/dos/statuses/116502831263332154Sat, 02 May 2026 03:22:07 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Sat, 02 May 2026 02:52:05 GMT]]>@Orca @alexanderkjall Not anymore.

]]>https://board.circlewithadot.net/post/https://masto.hackers.town/users/drwho/statuses/116502713181805770https://board.circlewithadot.net/post/https://masto.hackers.town/users/drwho/statuses/116502713181805770Sat, 02 May 2026 02:52:05 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Sat, 02 May 2026 02:51:22 GMT]]>@fun @noisytoot @alexanderkjall It totally is.

]]>https://board.circlewithadot.net/post/https://masto.hackers.town/users/drwho/statuses/116502710360436240https://board.circlewithadot.net/post/https://masto.hackers.town/users/drwho/statuses/116502710360436240Sat, 02 May 2026 02:51:22 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Sat, 02 May 2026 02:51:07 GMT]]>@noisytoot @fun @alexanderkjall I was wondering about that (haven't had to deal with actual Redhat since 2013)...

]]>https://board.circlewithadot.net/post/https://masto.hackers.town/users/drwho/statuses/116502709391373056https://board.circlewithadot.net/post/https://masto.hackers.town/users/drwho/statuses/116502709391373056Sat, 02 May 2026 02:51:07 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Sat, 02 May 2026 02:49:14 GMT]]>@OmegaPolice @alexanderkjall It is /not/ just you.

]]>https://board.circlewithadot.net/post/https://masto.hackers.town/users/drwho/statuses/116502701974357896https://board.circlewithadot.net/post/https://masto.hackers.town/users/drwho/statuses/116502701974357896Sat, 02 May 2026 02:49:14 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Sat, 02 May 2026 02:47:49 GMT]]>@penguin42 @fedops @alexanderkjall That's also on NIST, and the aren't doing too well right now.

]]>https://board.circlewithadot.net/post/https://masto.hackers.town/users/drwho/statuses/116502696409157132https://board.circlewithadot.net/post/https://masto.hackers.town/users/drwho/statuses/116502696409157132Sat, 02 May 2026 02:47:49 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Sat, 02 May 2026 02:46:55 GMT]]>@penguin42 @alexanderkjall No. That situation is really complicated and easy to fuck up.

]]>https://board.circlewithadot.net/post/https://masto.hackers.town/users/drwho/statuses/116502692844528746https://board.circlewithadot.net/post/https://masto.hackers.town/users/drwho/statuses/116502692844528746Sat, 02 May 2026 02:46:55 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Sat, 02 May 2026 02:46:20 GMT]]>@LabanSkoller @alexanderkjall @jmm You don't get the props for that that you used to. Giving it a cute name and marketing campaign is the thing these days.

]]>https://board.circlewithadot.net/post/https://masto.hackers.town/users/drwho/statuses/116502690552461328https://board.circlewithadot.net/post/https://masto.hackers.town/users/drwho/statuses/116502690552461328Sat, 02 May 2026 02:46:20 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Sat, 02 May 2026 01:53:59 GMT]]>@alexanderkjall I mean... it is normal that, as a security researcher, when you find a security bug, you contact the upstream vendor, and can expect that to result in the issue being handled appropriately (for example, because the project notifies their downstreams about the issue, or because downstreams generally pick up all patches fast, or because propagation of fixes is ensured through a mechanism like CVEs).

To my knowledge, there is no such mechanism between Linux and most distros, unless the distro just always ships the latest stable kernel; I think that is a process issue, not the security researcher's fault.

When I report Linux kernel security bugs, I, too, just send the bug report to security@kernel.org and the maintainers, not to the third-party linux-distros list.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/jann/statuses/116502484744138301https://board.circlewithadot.net/post/https://infosec.exchange/users/jann/statuses/116502484744138301Sat, 02 May 2026 01:53:59 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Fri, 01 May 2026 22:44:56 GMT]]>@alexanderkjall@mastodon.social They even have time to obfuscate and minimize that exploit code, which makes it very hard to understand.

As if "732 bytes" means anything.

Surely the best way to create a proof-of-concept exploit to share their understanding with the world? /s]]>https://board.circlewithadot.net/post/https://nya.one/notes/alr2elez2bqw1rv1https://board.circlewithadot.net/post/https://nya.one/notes/alr2elez2bqw1rv1Fri, 01 May 2026 22:44:56 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Fri, 01 May 2026 22:03:19 GMT]]>@fun @noisytoot @alexanderkjall the reason is marketing, not technical

"we are so good because we need very few bytes to achieve this massive thing"

]]>https://board.circlewithadot.net/post/https://hsnl.social/users/eloy/statuses/116501577681046945https://board.circlewithadot.net/post/https://hsnl.social/users/eloy/statuses/116501577681046945Fri, 01 May 2026 22:03:19 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Fri, 01 May 2026 21:54:07 GMT]]>@noisytoot @alexanderkjall it's not like you'll be running the exploit on some microcontroller with 16K of SRAM]]>https://board.circlewithadot.net/post/https://berkeley.edu.pl/objects/86de1c3c-a53b-46b0-b736-e0a6bcccaedchttps://board.circlewithadot.net/post/https://berkeley.edu.pl/objects/86de1c3c-a53b-46b0-b736-e0a6bcccaedcFri, 01 May 2026 21:54:07 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Fri, 01 May 2026 21:53:27 GMT]]>@noisytoot @alexanderkjall it's just not serious]]>https://board.circlewithadot.net/post/https://berkeley.edu.pl/objects/19ebbbde-6693-4f29-bb3b-4949e1729038https://board.circlewithadot.net/post/https://berkeley.edu.pl/objects/19ebbbde-6693-4f29-bb3b-4949e1729038Fri, 01 May 2026 21:53:27 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Fri, 01 May 2026 21:41:41 GMT]]>@fun @alexanderkjall both of those are for minification: if it used descriptive variable names and didn't compress the payload it would have been longer than 732 bytes]]>https://board.circlewithadot.net/post/https://berkeley.edu.pl/objects/54cf2633-a177-4044-8eb1-e0c0668c19b8https://board.circlewithadot.net/post/https://berkeley.edu.pl/objects/54cf2633-a177-4044-8eb1-e0c0668c19b8Fri, 01 May 2026 21:41:41 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Fri, 01 May 2026 21:40:31 GMT]]>@LabanSkoller @alexanderkjall they waited a month after reporting to the Linux kernel security team, they did not report to distros

Debian at least was quite clearly unprepared given that it took a day to get fixed in trixie and only just got fixed in bookworm (between when I last checked earlier today and now)]]>https://board.circlewithadot.net/post/https://berkeley.edu.pl/objects/664bf15c-65cc-4087-9320-b91a3259ecc4https://board.circlewithadot.net/post/https://berkeley.edu.pl/objects/664bf15c-65cc-4087-9320-b91a3259ecc4Fri, 01 May 2026 21:40:31 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Fri, 01 May 2026 21:39:20 GMT]]>@noisytoot @alexanderkjall it's also obfuscated IMO. Why need to zlib.decompress ? Can't you give us the data itself without compression?
A bunch of variables also have quite meaningless names. It really does scream a lot like obfuscation.]]>https://board.circlewithadot.net/post/https://berkeley.edu.pl/objects/836dada7-5e9f-4505-bd71-18543b3e30c4https://board.circlewithadot.net/post/https://berkeley.edu.pl/objects/836dada7-5e9f-4505-bd71-18543b3e30c4Fri, 01 May 2026 21:39:20 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Fri, 01 May 2026 21:37:36 GMT]]>@simonzerafa @alexanderkjall the Linux kernel security team did not tell distros]]>https://board.circlewithadot.net/post/https://berkeley.edu.pl/objects/2a03d65a-c5c1-47c9-9fdf-90c8f8234f32https://board.circlewithadot.net/post/https://berkeley.edu.pl/objects/2a03d65a-c5c1-47c9-9fdf-90c8f8234f32Fri, 01 May 2026 21:37:36 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Fri, 01 May 2026 21:36:51 GMT]]>@fun @alexanderkjall It's minified rather than obfuscated, I think they did that just so they could say it was only 732 bytes.

It's also likely that they just asked an LLM to minify it, given that the whole article was so obviously AI-generated and not even proofread (it originally claimed to have been tested on RHEL 14.3, which does not exist)]]>https://board.circlewithadot.net/post/https://berkeley.edu.pl/objects/ccc7eb93-fdab-473b-ae3a-972e9f60928chttps://board.circlewithadot.net/post/https://berkeley.edu.pl/objects/ccc7eb93-fdab-473b-ae3a-972e9f60928cFri, 01 May 2026 21:36:51 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Fri, 01 May 2026 21:32:12 GMT]]>@alexanderkjall let's say how it is Greg didn't put it into backports and no one could be arsed to look at it by themselfes as it is, in deed, work.

Maybe get mad at Herbert (who commited the kernel fix patch) for not telling the distribution security list?

Anyways, the result is a massive PR event for Xinit/theori and a bad day for Distro security teams and IT Security people all over the world (oh well at least most of you should be geting payed a nice premium for working at May 1st).

I guess learning from it would be better then finger pointing but who am I to tell you all how to do your jobs?

I'm retired. My local machines with public services sit fully proxied behind a BSD machine. The only person with shell access (from my LAN only) is me.

If the Hyperscaler guys don't pay people to monitor CVEs and do their own classification well 🤦🏿‍♀️🤷🏿‍♀️

]]>https://board.circlewithadot.net/post/https://tech.lgbt/users/TheOneDoc/statuses/116501455371942511https://board.circlewithadot.net/post/https://tech.lgbt/users/TheOneDoc/statuses/116501455371942511Fri, 01 May 2026 21:32:12 GMT<![CDATA[Reply to Today I have spent way too much time handling the https://copy.fail situation #copyfail on Fri, 01 May 2026 21:12:10 GMT]]>@alexanderkjall they also had time to obfuscate their exploit.]]>https://board.circlewithadot.net/post/https://berkeley.edu.pl/objects/46dc93da-b00f-47c5-9929-0e70089d69a1https://board.circlewithadot.net/post/https://berkeley.edu.pl/objects/46dc93da-b00f-47c5-9929-0e70089d69a1Fri, 01 May 2026 21:12:10 GMT