The article is *more* confusing than the original vuln report, which clearly stated the vulnerable config. By dressing it up in all that superfluous info, you dilute the message of the limited impact. More info is appreciated *only* when you take care to keep the message clear.
-
This Tweet is unavailable.
-
This Tweet is unavailable.
-
This Tweet is unavailable.
-
This Tweet is unavailable.
Honestly, you didn't do a great job of conveying the details. The most confusing bit is where you go straight from ALL to "in a specific scenario where you have been allowed to run a specific, or any, command as any other user except the root"
-
-
That reads as "any other specific user", because the actual idea of "literally any user in the system, except for root" is so baroque that nobody thinks of it. You really need to dig into that point because it's very hard to grasp.
-
What everyone took from that line is "a sudoers config which lets you run something as www-data lets you run it as root" which is not the case.
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.