Hacker News Reader

Comment by philsquared_ | Hacker News Reader

It's risk assessment, nothing more. Some weighed the risk high and paused their site. Nothing wrong with that and not hysteria or FUD.

View on HN

I think the article is suggesting that a sober risk assessment was not done by most folks period, not that they merely perceived the risk differently.

You've got under 5 minutes to decide whether or not a widely reported critical security vulnerability actively being exploited in the while is severe enough to warrant taking down your site or not. The downside for taking down your site is approximately 0, and the upside is that you don't get shrekd

No security expert can or should work that fast. Its a completely reasonable thing to do given the hyperbolic reporting just in case it turns out to be true. Some websites being down for a few hours doesn't end the world

> The downside for taking down your site is approximately 0

> Some websites being down for a few hours doesn't end the world

Many governmental websites are still down and they say might stay down for days or weeks. Some are not directly related to PHP, but auth doesn't work due to firewall hardening or similar. There definitely is a non-zero downside.

Agreed. This is all lazy chair hindsight talk, maybe by those not affected by it. In the moment you act on the imperfect information you have available and you use the safe than sorry rule. And to demand perfect information is also a fallacy, it doesn’t exist until after the fact.

I hear you, but also I'm not so sure. I remember Log4j, heartbleed, etc. and they were just as serious, but I don't recall people just going dark immediately. Scripts to validate whether or not you had exposure were built, people ran them, and if you did have exposure you started checking to see whether or not it was exploited. This timeline for this seems wildly different to me.

Because it’s not the same type. There was no actual info until the patch dropped, with some people in the know , which made it dangerous to leave your site up. The stopgaps were wild guesses. The multi-upload mitigation wouldn’t have worked.

There was no check that could be trusted to be the check to mitigate it. So that left the scenario that we went through.

Presumably the lack of sober risk assessment was on the part of the hyperbolic reporters.

There wasn't any info on the exploits beyond hearsay and the claim that they're very serious, so the risk assessment, sober or not, boils down to "do I trust the PHP people when they claim this is very serious"

Of of course, an excuse to email a user base to say "sorry we're offline for xyz", from a company I haven’t dealt with in 7 years...

Reply on news.ycombinator.com