undefined | Better HN

0 pointscardigan6y ago0 comments

I think you're referring to the SupportAssist Client being an HTTP server - while it is weird that they exposed all those other routes, the driver install route allows for drivers to be installed from a website (which a named pipe would not).

I wouldn't characterize it as "pure laziness" - more a questionable feature

0 comments

gmueckl6y ago

The whole process starts with the installation of aoftware to identify the computer. The vulnerable service is part of that. Thw list of drivers could just as well be shown by a local GUI ghat is started by thenbrowser through an URL handler registered in the system. There would be no need for any of this frankly stupid Rube Goldberg website/webservers interaction. It would be one less TCP server socket in the system.

j / k navigate · click thread line to collapse

0 pointscardigan6y ago0 comments

I wouldn't characterize it as "pure laziness" - more a questionable feature

0 comments

gmueckl6y ago

j / k navigate · click thread line to collapse