“If you manage a Linux server and the only place you got notified of this vulnerability is through the Golang mailing list, you got to up your vulnerability management and observability game. Like something should look at your Linux server and let you know, hey, you have a CVE on that server.”
sputnikintelligence.com
The hosts had just covered a Linux kernel vulnerability that Go programs can expose because Go enables multipath TCP by default. Shay says server operators shouldn't be relying on a programming language's mailing list to learn about kernel bugs.
…I mean, if they did do that, if they did change something in Go, that would open the door to, okay, now there's a bug in Postgres. Maybe you can change this default in Go just because a lot of people use Postgres. Like, of course, you don't want to start changing Go because of third parties.
I do think it's valuable that they made this announcement. Like, if you're in some situation where you simply cannot upgrade your Linux kernel, then maybe you should do some of these mitigations for that service. But I will say if
you manage a Linux server and the only place you got notified of this vulnerability is through the Go Lang mailing list, you got to up your vulnerability management and observability game. Like something should look at your Linux server and let you know, hey, you have a UC V on that server.
It's also good that they're just taking this seriously and exploring whether or not there's something they can do reasonably to help solve this. The real answer is maybe it's
also good that Anthropic is uncovering all the world's problems.
Maybe so. All right.