Do we need to worry about vulnerabilities?

Reply to Do we need to worry about vulnerabilities? on Thu, 18 Jan 2024 17:05:38 GMT

sdetweil — Thu, 18 Jan 2024 17:05:38 GMT

@mumblebaj again this is possible IF the one of these systems is ON the internet… but typically this is pc on same house network as pi…

and 192.168 , 172 and 10. networks are not routable over the internet, so your device would have to have a ip address on the other side of the ISP router… or and open port (port forwarding)

if you need remote ssh use the stuff I started posting about here
https://forum.magicmirror.builders/post/114693
I will never have another port forwarded port

Reply to Do we need to worry about vulnerabilities? on Thu, 18 Jan 2024 16:37:47 GMT

mumblebaj — Thu, 18 Jan 2024 16:37:47 GMT

@sdetweil There is a new SSH security vulnerability identified in December. CVE-2023-48795. Any chances this would be a problem to this project in anyway? I do know that it requires an active MITM (Man in the middle). Short description below.

SSH vulnerability exploitable in Terrapin attacks (CVE-2023-48795) Security researchers have discovered a vulnerability (CVE-2023-48795) in the SSH cryptographic network protocol that could allow an attacker to downgrade the connection’s security by truncating the extension negotiation message.

Reply to Do we need to worry about vulnerabilities? on Thu, 18 Jan 2024 13:24:34 GMT

sdetweil — Thu, 18 Jan 2024 13:24:34 GMT

@funkoid generally no. if this was a public website with lots of users concurrently maybe.