I'm more worried about my consumer-grade router.
replyI switched to OPNsense last week. Consumer grade WiFi AP is behind it. I’m not depending on firmware updates from a company that has no incentive to make them.
replyI blocked packets arriving externally on my firewall with ip-options a couple of days ago. Firewall rule has zero hits, and I've got a very open ISP (andrews+arnold), if I want I can host SMTP, DNS, whatever
replyThe timeline says the CVE was reported over 2 weeks ago, so why are the alarms sounding now?
replyAnthropic published a blog post claiming RCE with it [0].
reply[0]: https://www.anthropic.com/research/discovering-vulnerabiliti...
Which was 4 days ago.
replyNote: AWS NLB doesn't terminate TCP for TCP listeners.
replyIt would be great if they introduced mitigations for this vulnerability though.
Another reason hyperscaler cloud providers will continue to grow (IMO)!
replyMy FreeBSD loadbalancers block packets with IP Options with default config. It’s not rocket science, no matter how Cloud providers are trying to tell us.
replyIf I'm not mistaken, looks like pfSense (based on FreeBSD) firewall rules also block IP Options by default too.
replyUnless they themselves (underlying services) get hacked...
replyMy VPS was auto-updated and restarted more than 14 days ago. The logs have rolled already. Probably October 12 early morning.
replyAnother reason NixOS will continue to grow :)