Hacker News Reader

Comment by cwillu | Hacker News Reader

Don't be silly, you can't possibly be responsible for breaking an embargo you weren't subject to or informed about.

That's fair. For clarity: I take responsibility for posting on HN, without knowing the facts.

Not sure what you are apologizing for. It's a severely overblown bug that ended up on the front page of New York Times and the Japan Prime Minister had to get involved too. The bug itself is non trivial to exploit from just public requests to a web server so I am not sure what the hysteria is about. It's no different from the other hundred or so CVEs I see being posted or dropped everyday.

It will be headlines on Hacker News regardless due to sheer sensationalism, I think most DevSecOps people would rather find out the news here first than via their boss calling them after reading the morning news.

The Japanese PM did not “have” to get involved.

Well, consider that their old IT minister has never used a computer in his life, it's probably a good thing she's the one issuing the call to update.

You've used a computer the moment you aren't even born yet.

Okay, now I'm curious about what sci-fi trope you've gone too far down a rabbit hole in.

must be proof we're in a simulation!

"The sonogram or EKG machine is a computer, so the baby used a computer, checkmate!"

Having a compute device used on you is not the same as using a compute device. QED

"Then I guess no one with a Windows device or an iPhone has ever used a computer!"

is this a "in Soviet Russia, computer uses you" reference?

"In Capitalist America, corporation owns you!"

Well the old definition of computer was women with abacuses so I guess you could stretch that.

Everything which contains a microchip [1] is a computer, and you used it (or: 'it was used on you') with an echoscope around when you were in womb for around 20 weeks. Computers are everywhere, and it matters in this context: some minister saying they never used a computer (any computer) is something which is so unlikely (I mean, even a traffic light contains a computer) that it matters how it gets (strictly) defined. Nowadays, it is even more complex, given smartphones, smartTVs, laptops being used on elementary school, etc.

[1] https://www.asml.com/en/technology/all-about-microchips/micr...

Used is pretty clearly defined and none of those examples are “used”.

It was used on you, you were subjected to it. You cannot avoid that. That's the entire point. Before you get born, a computer is used to assess your health. If you want to watch TV, well you can't buy a TV without a computer anymore. Anything which uses the internet contains a computer with TCP/IP stack. Going on school in my country almost guarantees you end up with Chromebook or large touchscreen in classroom.

So when someone in West says they never used a computer in 2026 (or even just this decade) I don't believe them, unless they're so old they never used a mobile phone, don't watch any TV, and live like really sheltered like a hermit in some squad. A policitian needs to communicate; they surely use computers during their endeavor. Even the very old POTS is essentially also computers, same with old CRT TVs, ATMs, or computers used during public transport.

Ergo, the point is they've almost surely used computers; theyare just not aware how omnipresent computers are in our world,and ut isn't even a recent change either (the recent chamge is that they're 'smart' ie. 'networked' (TCP/IP stack).

What does "non trivial to exploit from just public requests" mean? It's known to be exploitable on more than one stock PHP application. This really is a 5-alarm fire.

I think people are just latching onto the post that hit the front page earlier today about it being non-trivial to exploit, combined with the fact that there seem to be about a billion PoC out there, most of which don't work.

The most direct exploit requires a compromised supply chain which ranks it about as dangerous as your usual dependency exploits.

I think this is just false? Are we playing some kind of weird game of telephone? Is the term "direct exploit" doing way more work in that sentence than you mean it to?

The alternative route through the web forms requires the absence of ASLR. So you need to spam the endpoint, like a lot. You can probably mitigate at the edge (CDNs) or perhaps at the reverse proxy level (NGINX) through e.g. rate limiting. More of a web version of row hammer then some sort of trivial SQL injection attack that works consistently.

Maybe a LAMP stack on an extremely ancient version of Linux is vulnerable out of the box. Quit the fear mongering please, you do the security community no favors.

Say what you will about OpenAI, Wiz etc but if OpenAI, Wiz, Cloudflare, the PHP Foundation and pretty much every CERT out there together recommend to take down PHP apps and patch immediately then I'm very much inclined to follow that advice.

Due to the insane media coverage there'll of course be a deluge of PoCs, most of which won't work. But constantly refreshing Twitter to see whether there's a working PoC is not a good use of time nor a great security strategy.

Right, that's what's worrying me. It is not interesting that the most widely circulated public POC/demos don't work. All you should care about is the (currently) non-public POCs that do work, of which there are apparently several.

My PoC (generated) was able to exploit an index.php with a simple echo.

The only thing you have to know in advance is the relative memory offset distances, and that's it. Memory feng shui was the longest part of the implementation.

[1] https://github.com/cookiengineer/actual-php2shell

Try finding a modern Linux distro without ASLR enabled defaults.

> ASLR

Read the heap feng shui doc, and headline 4 in the README.

The involved heap feng shui is independent of ASLR.

... and maybe read up on what ASLR actually does and how memory arenas work before trying to be smart?

Did you even read the diff, it synthesized intentionally vulnerable code which trivializes the exploitability

I would assume he didn’t read anything in the repo. It also requires disabling ASLR.

Eh, no?

It is split up into two branches and demos, see the heap feng shui document?

ASLR enabled requires a way to create more data, which I intentionally did not create in the index.php because other folks claimed that is "cheating". That was the demo that wiz created.

Maybe you should read the repo next time? It is literally headline 4.

The whole point of this demo is that the assumed to be hard part (mem feng shui) is what LLMs are actually good at.

why read the diff? my AI agent reads the diff and ignores stuff it knows I don' want to hear.

saving this to show to my students how NOT to act

How would you even know whether you knew the facts? It sounds like what you knew was more than just consistent with there being no embargo, you were explicitly told there was no embargo. After a certain point, there's a limit to how far up the chain any of us can be expected to follow the logical chain of what we genuinely think are true, and this doesn't seem like a glaringly obvious case where you were being reckless.

We're all (well, I guess not all, but the group that's worth caring about, and I hope it's at least most) just operating the best we can on the information we have and trying to make decisions based on that. As long as you're acting in good faith on information that you had genuine basis for believing is true, it seems like it would be unreasonable to expect someone in your situation to somehow intuit that you were given false information or grossly misunderstood what sounds like a pretty straightforward declaration of fact from someone you didn't have any reason to doubt.

At the risk of some armchair paycholoanalysis because it does seem like you genuinely feel some guilt over this: I can emphathize feeling guilty about the outcome of an action that in a vacuum would not have been hard to make differently, but my experience is that those of us who have a nasty habit of beating ourselves up over things when we really don't have much blame will often recognize when on the other side that it would not be fair to hold someone else to that standard. I struggle a lot with how sometimes knowing something is true doesn't always make it feel true, and even though hearing someone else saying it doesn't magically make it all better, I still think it's valuable to hear it from someone else, so if I happen to be right about how you're feeling, nothing about all of this is your fault, and to the extent that you're able to, try not to beat yourself up over your misfortune to get caught in the middle of all this due to circumstances that realistically were outside your control.

You’re “taking responsibility” for doing nothing wrong.

It attracts attention though...

I'd post the Hitler Did Nothing Wrong Black Messiah video if it hadn't been censored from YouTube. But all I can do is lool at how this dude took down 4chan.

Responsibility may include vetting your sources - is this person competent and dutiful, to actually know there's no embargo? - and researching the situation, and thinking several moves ahead, and other stuff.

Reality is that everyone has to make decisions in finite time, using the resources they actually have.

And I'd put a whole lot more responsibility further up that chain of contacts. And question how many other people they might have blabbered to.

>And question how many other people they might have blabbered to.

100%. I'm concerned about the two-way street this might also have opened me up to with information I shared privately with this individual. Nothing significant or incriminating, but the professional relationship is concluded.

Reply on news.ycombinator.com