The article is *more* confusing than the original vuln report, which clearly stated the vulnerable config. By dressing it up in all that superfluous info, you dilute the message of the limited impact. More info is appreciated *only* when you take care to keep the message clear.
-
This Tweet is unavailable.
-
This Tweet is unavailable.
-
This Tweet is unavailable.
-
This Tweet is unavailable.
-
Some of them even ran their own confused tests and thought it was really that bad, because sudoers is confusing and they didn't understand exactly what config they needed to have. They often accidentally gave themselves ALL outright.
(a negative control would've caught that mistake, but people rarely do negative controls when trying to quickly confirm a confusing security vuln report from the internet)