Unless you have allowed the AI features to install

That's why there's no sudo on my system, only doas.

According to the report, zsh is even worse

2009 zsh adoption grows. Now the shell is also pretty, which researchers believe lures more victims.

Not even that, it's not a problem at all. They're just saying that when you open a terminal program you get access to the shell. That is exactly the point of a terminal program. It's a bit like "exclusive, shocking report: water is wet!"

I mean, I guess part of the joke is if an attacker can get into your computer they can do nefarious things, but that's not as funny.

And nationalise a fraction of Tesla and SpaceX?

Thank goodness for frontier models.

This flag is fortunately not needed as /* ensures root recipes are preserved. It's just that anything below isn't.

Uh oh I tossed mine in sbin. What do?

Microsoft Paint: Not affected. Thank God.

Don’t forget the —no-preserve-root flag or you’ll get an index out of bounds when deleting the recipe for five-root-puree

Yeah, I have to hit super then type 'te' before I can one-click this exploit

Though I guess I could make it one-click if I added a desktop shortcut to the terminal emulator

I'm here cautiously making sure it's a joke that I don't understand. Problem exists between keyboard and seat.

sudo is so broken, automatic privilege cloning of any user

high assets and live off borrowed money

Right. Count assets as wealth and tax them as such.

That's why I confessed. I'm glad to help.

I was fooled until I saw the CVSS score of 11 on a scale of 0 to 10.

Up to 11

I work at google just shut off every server to protect us. 👍

Switch off computer is the best mitigation

Removing keyboard and locking operator out of building is the next best thing.

https://www.gnu.org/philosophy/free-sw.en.html#four-freedoms

Freedom 0 says I can be nuts and that clankers better obey

I just tested this exploit, I was easily able to remove the french language pack by typing "rm -fr /*"

I only figured it out because I read your comment.

Only tangentially related, but this reminds me of an interaction I had here on Lemmy. I was talking about my pure bash, brain-made CLI app that pushes files between Google Compute head nodes and Google Storage buckets, but does some additional fuckery with bash strings to serve as a crude git. Basically, the app manipulates a string that represents a bucket, and then uses the appropriate gcloud command with that string.

Someone was extremely concerned about the security of my app, how I should do an AI code review, and that only good programmers use all the tools available to them. I told them that I only want my code to be reviewed by humans. They said it was wild that someone would decline a security review. I told them that if there's a security issue with my app, they'll have to take it up with Google.

Finally I'm justified in doing everything via a GUI.

The article says it's a one click exploit, but I'm finding I need to make two quick clicks to enter into the program. Can someone help me?? Am I doing something wrong?

I've spent all day trying to update my software to get this to work!!!

I'm taking some admin/security courses and powershell was touted as "it's so easy to make your own scripts to save time!". I was just like, "the fuck Koolaid are you drinking?"