Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

An unmaintained network service written in an unsafe language is generally speaking unsafe to use, and a great way to get exposed to RCEs. You do you, but running such code is a Very Bad Idea™ and absolutely not okay on a normal desktop install.

The aforementioned waynergy is a synergy client with explicit support for wlroots-based compositors like swaym.



Vague insinuations without support, most of which are effectively mitigated by running synergy or barrier over an ssh tunnel. What you mean by "unsafe language"?

> waynergy is a synergy client

Yes, a client, but you can't actually be a synergy server with waynergy. And input-leap support to work with a subset of the waylands depends on libei.


"Vague insinuations"? There's nothing vague about it. An unmaintained network server is not safe to run, period. That's not a controversial statement, just common sense from observing how fast we go through CVE's.

Can you take steps to reduce risk? Sure, but managing to safely detonate a bomb does not make bomb explosions safe. Suggesting that such unsafe practices can or should be part of a normal desktop setup as you did is definitely not sound.


>An unmaintained network server is not safe to run, period.

Period, huh?

Could you please advise, in excruciating detail, exactly why is it not safe to run an unmaintained network server in an environment with no access to any untrusted network? How is is a security risk to run an old version of synergy between two machines which can only talk to each other and don't even have any physical link to any other machine? Which aspect of being old or unmaintained or "written in an unsafe language" allows remote code execution over an airgap? Please be sure to provide links and references, I've not heard of this trick before, I'll be pretty impressed.

Yeah, they're "vague insinuations".

There are many possible mitigations to the old "it's unmaintained, therefore insecure" security-theatre chestnut - another comment in this thread specifically mentions that most security issues are mitigated by running over an SSH tunnel. There are more secure options like routing all networking via a VPN, or as mentioned above simply not being accessible from an untrusted network.

You don't know the details of everybody's requirements or environment, so you're not in a position to dictate what security precautions or risks are reasonable for them to take or ignore in their particular circumstances.

Some people, for example, need to be able to use or access machines running old operating systems. These are situations that do actually exist in the real world, often due to reasons related to them being in the real world, and very often outside the control of the people trying to get stuff done.

There are lots of valid reasons why people want to run old software, too.

A normal desktop setup runs the software you expect it to run, and can connect to the machine you were able to connect to yesterday, to continue to get stuff done.

A "normal" desktop doesn't suddenly shit the bed refusing to run software which is perfectly fine to run in your particular set of circumstances, and it certainly doesn't insist on overriding the judgement of the experienced user who has evaluated the security implications, if any, and decided to proceed anyway, to get stuff done.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: