Psi9

watch the YouTube video. its really very very good. and it pints out that attempting to scrub the audio of the types of indicator he uses would be very difficult. as airplane noise is both in the same frequency range as our voices, so it can’t be taken out without affecting voice quality, and penetrates walls so will always be present.

which once again begs the question. why the fuck is your freezer connected to the internet

you do know you can just put a firewall rule in to prevent any IP options from hitting the server

The rule (matches header length > 20 bytes, i.e. IHL 6–15):

iptables -I INPUT 1 -m u32 --u32 "0>>24&0x0F=6:15" -m comment --comment ipopts-stopgap -j DROP

• ufw: add -A ufw-before-input -m u32 --u32 "0>>24&0x0F=6:15" -j DROP to /etc/ufw/before.rules, above the RELATED,ESTABLISHED accept line. Then run ufw reload.
• csf: put the iptables line in /usr/local/csf/bin/csfpre.sh so it survives csf restarts.
• Docker hosts: use -t raw -I PREROUTING instead, so container traffic is covered too.

Test: run ping -R at the box and watch the counter go up in iptables -L INPUT -v -n. Note that many networks drop option packets in transit, so test from the same LAN or a local netns.

its a stopgap. not a fix. but you don’t have to take all your servers offline … just put the block in and wait for the patch