Hacker News Reader

Comment by nallerooth | Hacker News Reader

This is such a strange claim from someone trying to sound knowledgable in the field of cyber security (maybe they are, I have no idea who this person is). Even if the exploit would be difficult to use properly, it's not like there's a lack of groups out there trying. Anyone serious about this would consider the fact that a working PoC was reported to the PHP security team. They confirmed the vulnerability and started making a lot of noise about the severity of it, by reporting 2 CVEs and pushing the patch to Linux distros ahead of the official patch release.

Trying to understand what the message of the post is all about, I flipped the whole thing around in my head - and the message is basically "you don't need to upgrade your servers". Which is something someone with a working exploit would say. Or it's just noise on the Internet.

View on HN

That's clearly not the message, the author writes at the top:

> You should patch your servers anyway. There is a real vulnerability here, but exploiting it is significantly harder than people are making it out to be.

The take-home message is about human herding behavior being reinforced by LLM use:

> There's something important to be said here about how many people have Claude/GPT make design decisions for them, and how AI is the primary decision maker in the world right now. You've got this bizarre case of "Decision Schelling Points" where a method of solving a problem is extremely overrepresented, because it's what Claude does out of the box.

And when the prevailing wisdom loaded into Claude is making people do dumb shit, then you write a blog post complaining about it.

---

Having Claude re-inforce to people the severity - who do not have the security background to make a call - is a feature of herd behavior.

The risk is all that mattered.

The risk, unless the original reports have been lies, is very real.

Posting this AI complaint-blog because with hours of hindsight nobody released a seflreplicating variant, is the wrong lesson at the wrong time for the wrong reasons.

I guarantee you there well be a better time to post this complaint about AI-driven herd behavior. But it was not today about this.

> The risk, unless the original reports have been lies, is very real.

Is it? That's the question.

12h before your comment the difficult part a random AI prompt was unlikely to find already dropped on github https://github.com/9bie/php2shell-bypass-aslr-exp

I would like to disagree, I read it like - people calm down, no need to panic. As vanilla php with default config is not easily rce exploitable.

Why attacking him personally?

Because it goes against the grain maybe?

Try telling people they are wrong often enough it happens a lot. ad hominem.

Virtue signalling is really coming more of a problem these days, specially in the security sphere.

> it's not like there's a lack of groups out there trying.

Indeed. And those who knows how to implement this, might also be the ones with capabilities to deploy it on a large scale (via bot nets or whatever).

What about state actors, suddenly getting a possibility to plant backdoors in millions of websites, etc.

You don't have to be too imaginative to see the "economics" of this.

Reply on news.ycombinator.com