Hacker News Reader

Comment by pierrec | Hacker News Reader

Also RTFAing, the authors express their surprise at how easy some of the vulns/crashes were to find using very basic fuzzing. So while @x0x0 might be jumping to conclusions a bit harshly, saying that MS did little to no fuzzing on their font libraries is actually a reasonable guess.

View on HN

That, however, contradicts their other assertion that past researchers have fuzzed the fonts and found many vulnerabilities. They can't both be easily true, so there must be something further going on.

Meh.

"it was trivial to discover with a dumb fuzzer, and it's surprising that such a bug could even survive until 2015, with so much work being supposedly put into the security of font processing."

(Emphasis mine.) I suppose they might be underplaying the complexity of the steps required to reproduce their finds, but it really doesn't look like it. Honestly I'm not that surprised. At times like this I'm reminded of the sheer amount of security holes out there in the wild and I just want to chuck my computer in the lake.

Turns out lakes are security thru obscurity. They do not provide as much security as previously thought. Consider an active volcano next time.

DBAN all the disks, smash all the chips, degauss the scrap and ship straight to your nearest neutron star. Proceed to direct said neutron star into the nearest black hole. Accelerate said black hole to at least five 9s of c, along whichever vector is least convenient.

The backup tapes? I'm sure the trash is fine.

Reply on news.ycombinator.com