Conversation

Notices

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Saturday, 10-Feb-2024 03:38:59 JST Kevin Beaumont

   Enjoying this fully patched Ivanti Pulse Connect box (yes, the kernel has dirty in it)

   Linux version 2.6.32-00366-gsd3b182-dirty - December 2009

   curl 7.19.7 2009-11-04 (14 years)
   openssl 1.0.2n-fips 2017-12-07 (6 years)
   perl 5.6.1 2001-04-09 (23 years)
   psql 9.6.14 2019-06-20 (5 years)
   cabextract 0.5 2001-08-20 (22 years)
   ssh 5.3p1 2009-10-01 (14 years)
   unzip 6.00 2009-04-29 (15 years)

   • Doughnut Lollipop 【記録係】:blobfoxgooglymlem: likes this.
   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Saturday, 10-Feb-2024 03:45:47 JST Kevin Beaumont

     in reply to

     US Federal agencies plugging their Ivanti boxes back into the internet after factory resetting them

   • Embed this notice
     Jer (jer@chirp.enworld.org)'s status on Saturday, 10-Feb-2024 06:31:37 JST Jer

     in reply to

     @GossiTheDog Is this a legacy box or a recent purchase?

     Some of that stuff was already out of date when Juniper sold off Funk and it became Pulse Secure. That was ten years ago. If that's a recent box and not some legacy hardware I'd be considering it security malpractice to sell something like that as "new". (and I mean it's still not great if it's a ten year old box that they're not really patching either)

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Friday, 16-Feb-2024 14:13:56 JST Kevin Beaumont

     in reply to

     • Will Dormann

     TIL it doesn’t matter what me and @wdormann think, it’s only real when people read about it on Hacker News.