Editing 1957: 2018 CVE List

:This refers to a [https://techcrunch.com/2018/02/15/iphone-text-bomb-ios-mac-crash-apple/ real vulnerability] in iOS and MacOS publicized a few days before the comic was released, as well as [https://thenextweb.com/apps/2017/01/18/iphone-ipad-apple-text-ios-bug/ past] [http://www.telegraph.co.uk/technology/2018/01/18/apple-text-bomb-can-crash-iphones-single-message/ similar] iOS vulnerabilities.

:This is not a security problem, since Wikipedia articles are public. However, since Shannon formulated how the amount of unique or actual information some entity contains is proportional to the number of bits required to encode it, retrieving only a few bits casts a dark perspective upon the significance of the Shannon article's content.

:Cafés often offer free access to WiFi as a service to patrons, as a business strategy to encourage said patrons to remain in the building and buy more coffee. Some use a password, so that only patrons can use the WiFi, and may display the password on signage inside. Since anybody could go into the cafe to read the post-it, and then use the network from nearby, the ability to read it from outside is, at most, a trivial problem. For systems that are supposed to be secure, writing passwords in a visible place is a major security flaw. For instance, following the [[wikipedia:2018 Hawaii false missile alert|2018 Hawaii false missile alert]] (see [[Hawaii]]), the agency concerned received criticism for a press photo showing [https://www.businessinsider.com/hawaii-emergency-agency-password-discovered-in-photo-sparks-security-criticism-2018-1?r=US&IR=T a password written on a sticky note] attached to a monitor.

:Some people pronounce "{{w|SQL}}" like "sequel", after SQL's predecessor "SEQUEL (Structured English Query Language)". The standard for SQL suggests that it should be pronounced as separate letters; however, the author of SQL pronounces it "sequel", so the debate persists (with even <s>more</s> <s>less</s> <s>more</s> <s>less</s> <s>MORE</s> justification than arguments about how to pronounce "GIF"{{citation needed}}). MySQL is an free relational database management system. The latest generally available version (at the time of writing) is MySQL 5.7.

:{{w|Privilege escalation}} refers to any illegitimate means by which a system user gains greater access privileges than they are supposed to have. The most highly-sought privilege is that of the root user, which allows complete access to an entire system&mdash; a ''superuser''. Any flaw that would allow an ordinary user to escalate to superuser status is a critical security threat, as they then have full control of the machine. This is what most crackers seek to achieve when attacking a device.

:This CVE presents the less-threatening reverse situation: allowing a root user to ''de-escalate'' to normal account privileges. In fact, root users can already do this at any time; superuser privileges allow them to take control of any user account, so they can simply switch to an account which has fewer privileges than the root user.

:This is a reference to a common problem of modern gadgets catching fire (usually related to flaws in lithium-ion batteries), as well as to Apple products crashing when attempting to display certain character sequences. Diacritics are the accents found on letters in some languages, for example the German {{w|Umlaut_(diacritic)|umlaut}} (ü) or the French {{w|cedilla}} (ç). They usually indicate a change to how the letter is pronounced. Diacritics are not normally found on emojis{{citation needed}}, but since emojis are part of the widely-used {{w|Unicode}} standard which also allows for combining diacritics, it is in fact possible to combine the two to create a diacritical emoji. 🔥̃ is such an example.

:This probably refers to the movie ''{{w|Air Bud}}'', about a dog playing basketball. This has been a common theme in xkcd comics: see [[115: Meerkat]], [[1439: Rack Unit]], [[1819: Sweet 16]], [[1552: Rulebook]].

:{{w|Haskell (programming language)|Haskell}} is a functional programming language. Functional programming is characterized by using functions that don't have side effects because they can not change things accessible in other parts of the program, as in [[1312: Haskell]]. The joke here is discovering that it does indeed have side-effects, manifested via external alteration, not violating the internal alteration paradigm. It may also be a reference to "{{w|The Ones Who Walk Away From Omelas}}," a short story by Ursula Le Guin in which a utopian city concentrates all its misery into one child who is locked away in a basement.

;Critical&#x3A; Under Linux 3.14.8 on System/390 in a UTC+14 time zone, a local user could potentially use a buffer overflow to change another user's default system clock from 12-hour to 24-hour.

:This joke is about arcane systems that are running Linux in exceedingly rare situations, meaning that reproducing errors would be incredibly difficult or inconvenient, and would only affect a very tiny user base (if any at all). {{w|IBM System/390 ES/9000 Enterprise Systems Architecture ESA family|System/390}} is an IBM mainframe introduced almost 30 years before this comic, which has a version of Linux. UTC+14 is a time zone used only on some islands in the Pacific Ocean (Primarily [[Wikipedia:Line_Islands|the Line Islands]]) and is also the earliest time zone on Earth. Even if all of these absurd conditions were met, the resulting vulnerability would still be relatively benign: simply changing a user's preferred clock display format. Other xkcd comics make references to such obscure computer-time issues relating to time zones and time conversions, and how many programmers find these issues frustrating or even traumatizing.  

:A more complicated instruction set is more complex to implement.{{Citation needed}} The x86 architecture is considered "CISC" (a "{{w|Complex instruction set computer}}"), having many instructions originally provided to make programming by a human simpler; other examples include the 68000 series used in the first {{w|Apple Macintosh}}. In the 1980s, this design philosophy was countered by the "RISC" ("{{w|Reduced instruction set computer}}") design movement - based on the observation that computer programs were increasingly generated by compilers (which only used a few instructions) rather than directly by people, and that the chip area dedicated to extra instructions could be better dedicated to, for example, cache. Examples of RISC style designs include {{w|SPARC}}, {{w|MIPS}}, {{w|PowerPC}} (used by Apple in later Macintoshes) and the {{w|ARM architecture|ARM}} chips common in mobile phones. Historically, there was considerable discussion about the merits of each approach. At one time the Mac and Windows PC were on different sides; owners of other competing systems such as the Archimedes and Amiga had similar arguments on usenet in the early 1990s. This "issue" may be posted by someone who still recalls these debates. Technically, the extra instructions do slightly complicate the task of validating correct chip behavior and complicate the tool chains that manage software, which could be seen as a minor security risk. However, the 64-bit architecture introduced by {{w|AMD}}, and since adopted by {{w|Intel}}, does rationalize things somewhat, and all recent x86 chips break down instructions into RISC-like micro-operations, so the complication from a hardware perspective is localized. Recent security issues, such as the speculative cache load issue in Meltdown and Spectre, depend more on details of implementation, rather than instruction set, and have been exhibited both by x86 (CISC) and ARM (RISC) processors.

:{{w|Linus Torvalds}} is the {{w|benevolent dictator for life}} of the Linux kernel codebase. Normally it is hard to make changes because he has the last word, and because the kernel is replicated in all Linux installations. Linus made the news in January 2018 when, having looked at one of Intel's proposed fixes for the Spectre and Meltdown vulnerabilities, he declared "[https://techcrunch.com/2018/01/22/linus-torvalds-declares-intel-fix-for-meltdown-spectre-complete-and-utter-garbage/ the patches are COMPLETE AND UTTER GARBAGE]". Presumably, it may be found that he may be successfully bribed to be less blunt and/or less critical of vulnerability fixes that are complete and/or utter garbage. If this were the case, this would be a severe critical vulnerability to all Linux servers and machines.

:Adobe Flash has been an integral browser plugin for decades, but has fallen out of favor in the 2010s, and eventually discontinued because of its notoriously abysmal security record. All security experts advise against installing it. Preventing installation of Flash would make systems more secure, but most versions of Windows do not prevent Flash installation (provided, as of 2021, the user still has a copy of the files with which to do so). The joke here relates to the difficulty of keeping Flash up to date, or even installed properly to begin with. A common user experience, which is the subject of numerous jokes and memes, is the constant nagging notification to install or update Flash in order for web pages to display properly. Many IT professionals will bemoan the trouble they have experienced in the workplace due to these notifications and problems related to them.

:In late 2020, Microsoft [https://support.microsoft.com/en-us/help/4577586/update-for-removal-of-adobe-flash-player released an optional Windows update] that removes Flash and prevents users from installing it again.

:Cloud computing is a system of networked computers wherein the client user's computer can offload some of its work load and storage to the other computers &mdash; known as "the cloud." Many businesses offer their networks for consumer use, and can be marketed as "{{w|Platform as a Service}}" ("PaaS") or simply "cloud service." As with any product companies are always tempted to overhype what they offer, promising cloud computing to be more powerful and wondrous than it actually is. Thus, protestors try to remind people what cloud services really are by referring to "the cloud" as "other people's computers." This is, at its core, entirely accurate, taking away the business jargon and simplifying the situation in such a way that it might cast doubt on the security, reliability, and general effectiveness of using "cloud" solutions.  In [[908: The Cloud]], it turns out that [[Black Hat]] is the "other people" whose computer ''is'' the Cloud.

:Mitre's CVE database is where all {{w|Common Vulnerabilities and Exposures|CVEs}} are stored. This log message forms the punchline of the comic, as it implies that all of the exaggerated error messages above might have been inserted by crackers exploiting the vulnerability. To pour salt in the wound, they then included in a typical spam link purporting to offer inexpensive {{w|Viagra|brand-name Sildenafil}}.

* Randall has previously referenced diacritics in [[1647: Diacritics]].

* Bruce Schneier was previously mentioned in the title texts of [[748: Worst-Case Scenario]] and [[1039: RuBisCO]].