Hacker News Reader

Comment by jwitthuhn | Hacker News Reader

Hopefully the industry will learn something about how withholding fixes to known vulnerabilities is, in fact, bad policy.

View on HN

How? Biggest organisations and shared hosting providers had a chance to patch and protect their users. Everyone else will learn about the vulnerability the second patch comes out (this is also fixable with a configuration chance, so nobody needs to wait for their distro). This was the right approach and it worked.

The problem is that, since proofs-of-concept have leaked but the patch isn't available, bad guys can attack any site whose operators aren't part of the club, and the only thing the operators can really do to prevent that is to take the site offline. (PHP core team has denied that the configuration change fixes the problem.) I would call this a significantly worse outcome than everyone finding out about the vulnerability at the same time, since in that case operators can take timely action if they get the news quickly enough.

People here tend to be part of the silicon Valley insider club that gets access to all the cool offensive models, the expensive licensed software and services and insider information under NDA

They didn't release the patch out of fear that someone would quickly use the patch to develop an exploit, meaning an exploit is available shortly after the patch.

What they have achieved by delaying the patch is that exploits are now available publicly before a patch.

Surely this is the worse outcome.

Also they could’ve sent patches to at least some trusted members/maintainers/distros/hyperscalers/big Hosters/plesk/cpanel. It would’ve been easier to make some kind of coordinated release.

Also not announce it beforehand…

It sounds like they may have done that, and that is part of how it leaked.

> the industry will learn something

This is something of a fallacy. "The Industry" cannot learn.

But laws and regulations can require better security.

As in the history of seatbelts in vehicles, tech tool stacks are insecure by design and no one is ever really held accountable... until the cost is deemed too high.

It's evident that we have not reached that limit yet.

Reply on news.ycombinator.com