alt Hacker News> For the near and medium term, having access to a low-privileged account on an operating system, that isn’t up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor.
*buries head in sand*
*cries*
Replies
rubinlinux • today at 12:21 AM
This has been true for DECADES.
basilikum • today at 12:30 AM
Regular LPEs are not novel. The frequency has just increased a lot.
➕ show 1 reply
LPEs are frequent enough that people no longer use low-privilege user accounts to sandbox potentially malicious software. They are only used to control access for well-behaved users without any intent to subvert the system, not attackers.
The difference here reminds me of the distinction between the regular Paxos algorithm and the Byzantine Paxos algorithm.