Hacker News Reader

Comment by NackerHughes | Hacker News Reader

It didn't 'take down a sizable chunk of the Internet'. Site owners took down their sites because of FUD and mass hysteria.

View on HN

It's not getting tripped by "mass hysteria" to be careful and go offline for a couple hours.

Your average site is fine at 99.9% uptime.

We do need to eventually see the proof that this was so urgent. Because if it wasn't then this was effectively a massive DOS attack on society.

"9.2" is a big claim and a powerful justification for action, but with OpenAI involved my faith is very low that this isn't largely a publicity stunt. Especially given the age of the vulnerability.

This should be somewhat testable.

I'd set up a model with cyber capabilities, maybe GLM 5.3, not sure if it needs to be abliterated?

Disable web access and let it work on exploiting the pre-patch PHP version in a VM, given the info we had yesterday.

Can it do it? How long does it take, and writing the findings into a skill, how quickly can it be used on new targets?

I'd be interested in giving it a try, but unfortunately I'm very busy this week.

... meanwhile:

crickets

I think its absolutely getting tripped up by mass hysteria to go offline for a couple of hours without confirming the severity.

How are you supposed to confirm the severity of an unreleased CVE 9?

I think that you might have missed the joke.

It's risk assessment, nothing more. Some weighed the risk high and paused their site. Nothing wrong with that and not hysteria or FUD.

I think the article is suggesting that a sober risk assessment was not done by most folks period, not that they merely perceived the risk differently.

You've got under 5 minutes to decide whether or not a widely reported critical security vulnerability actively being exploited in the while is severe enough to warrant taking down your site or not. The downside for taking down your site is approximately 0, and the upside is that you don't get shrekd

No security expert can or should work that fast. Its a completely reasonable thing to do given the hyperbolic reporting just in case it turns out to be true. Some websites being down for a few hours doesn't end the world

Presumably the lack of sober risk assessment was on the part of the hyperbolic reporters.

Agreed. This is all lazy chair hindsight talk, maybe by those not affected by it. In the moment you act on the imperfect information you have available and you use the safe than sorry rule. And to demand perfect information is also a fallacy, it doesn’t exist until after the fact.

I hear you, but also I'm not so sure. I remember Log4j, heartbleed, etc. and they were just as serious, but I don't recall people just going dark immediately. Scripts to validate whether or not you had exposure were built, people ran them, and if you did have exposure you started checking to see whether or not it was exploited. This timeline for this seems wildly different to me.

Because it’s not the same type. There was no actual info until the patch dropped, with some people in the know , which made it dangerous to leave your site up. The stopgaps were wild guesses. The multi-upload mitigation wouldn’t have worked.

There was no check that could be trusted to be the check to mitigate it. So that left the scenario that we went through.

> The downside for taking down your site is approximately 0

> Some websites being down for a few hours doesn't end the world

Many governmental websites are still down and they say might stay down for days or weeks. Some are not directly related to PHP, but auth doesn't work due to firewall hardening or similar. There definitely is a non-zero downside.

Of of course, an excuse to email a user base to say "sorry we're offline for xyz", from a company I haven’t dealt with in 7 years...

There wasn't any info on the exploits beyond hearsay and the claim that they're very serious, so the risk assessment, sober or not, boils down to "do I trust the PHP people when they claim this is very serious"

Reply on news.ycombinator.com