Am 23.10.26 um 20:17 schrieb Simo Sorce via devel:
There is a whole science around threat assessment and risk management, ask any insurance company ...
no, not them, i read so many cyberthread insurance scan tests, that is only money making bullshit most of the time. They don't analyse the tool output, they sent i uncommented to the client.
They scan your version number, tell the client, that your i.e. ssh is old , but never test, if it's true.
There was a ssh-agent CVE in the 9er sshd series, that could only be exploited if you have valid access the server already, and they counted it as a threat for a server, that did not even had agents in use/installed and was long patched with backports ;)
They just do version number matching, nothing serious. Use them as bad examples ;)
Best regards, Marius Schwarz -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
