Light

Episode #960 Quiz

UNFORESEEN CONSEQUENCES
Date: 2024-02-06 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

CISA urged SOHO router manufacturers to automate updates, remove WAN web management, and require physical confirmation before lowering security. Qualys disclosed glibc heap overflow and qsort memory-corruption flaws affecting most Linux distributions, with local root escalation risk. Fastly is replacing OpenSSL with smaller, fuzzed BoringSSL to reduce CVEs and patching burden.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what specific action did CISA and the FBI urge SOHO router manufacturers to require before security settings can be reduced?

Question 1

According to the episode, what specific action did CISA and the FBI urge SOHO router manufacturers to require before security settings can be reduced?

A physical manual override at the router itself A signed remote approval from the vendor portal A second-factor code sent to the owner by SMS A time-limited administrative token from the LAN side

Question 2: What was the key exploit impact of the glibc syslog flaw CVE-2023-6246 discussed in the episode?

Question 2

What was the key exploit impact of the glibc syslog flaw CVE-2023-6246 discussed in the episode?

It allowed unauthenticated remote code execution over the network It corrupted user session cookies in browsers using glibc It caused a denial of service in the kernel's memory allocator It enabled local attackers to escalate to root privilege

Question 3: Why did Fastly say it was replacing OpenSSL with BoringSSL on its edge systems?

Question 3

Why did Fastly say it was replacing OpenSSL with BoringSSL on its edge systems?

To reduce the frequency and impact of CVEs To add support for legacy SSLv2-only clients To eliminate the need for TLS termination on the edge To preserve OpenSSL's full Swiss Army Knife feature set

Question 4: What standardized mechanism did the episode describe for letting password managers discover and promote Passkey enrollment?

Question 4

What standardized mechanism did the episode describe for letting password managers discover and promote Passkey enrollment?

A /.well-known/ JSON file containing Passkey endpoints An OAuth discovery document served from the login page A DNS TXT record containing enrollment URLs A browser extension API exposed only to Google Password Manager

Question 5: According to Steve's concern about Google's anti-tracking changes, what likely consequence could websites adopt to preserve ad revenue?

Question 5

According to Steve's concern about Google's anti-tracking changes, what likely consequence could websites adopt to preserve ad revenue?

Replace all ad targeting with static banner rotation Move all ads to encrypted DNS responses Rely only on third-party cookies in Safari Require visitors to register before viewing content

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.