I get that there won’t be any security updates. So any problem found can be exploited. But how high is the chance for problems for an average user if you say, only browse some safe websites? If you have a pc you don’t really care much about, without any personal information? It feels like the danger is more theoretical than what will actually happen.

Or… are there any examples of people (not corpos) getting wrecked in the past by an eol OS?

  • HucklebeeOP
    9•23 days ago

    Thanks for the thorough explanation! Interesting stuff, the examples really helped me see the many different ways an attack could work.

    • @[email protected]
      3•23 days ago

      Anyone who has services open to the internet sees constant attacks in their log files. I bet I could pull some attacks right now that are less than twenty minutes old.

      fail2ban is a common software on Linux that helps defend against these attacks. When someone fails to log into your service three times, it bans their IP permanently. It’s generally issuing many bans a day.

      They absolutely do scan every IP.

      • @[email protected]
        3•23 days ago

        It’s debated whether software like fail2ban actually helps or if it just makes attacks visible that would anyways fail if you have up to date software. Oftentimes, defensive software adds attack-surface because it adds more software that can be targeted by attackers.

        Fail2ban might help with protecting against exploiting of bad passwords though.

        • @[email protected]English
          2•23 days ago

          Tar pitting, rate limiting, banning failed attempts, are all critical security measures. If you let somebody try passwords, login attempts, with infinite speed, allow people to brute force your systems, you will get exploited

          Even if you don’t get exploited, you can get asymmetrically DOSed. It takes a lot of compute power to deal with an authentication attempt, and not much compute power to put in a failed request

          • @[email protected]
            2•22 days ago

            I totally agree about rate limiting, mostly against bad passwords that you are not in control of. But banning failed attempts is mostly not interesting if you ask me. It feels like the right thing to do, but IP addresses can change and other measures are better.

            • @[email protected]English
              1•22 days ago

              I agree. No ban should be permanent, just increasingly larger timeouts. If it’s a legitimate user they’ll have some other channel to reach out to to unban the IP