Hacker News Reader

Comment by andyvanosdale | Hacker News Reader

It's not about changing anything, and that was not what was posted in my comment. Amazon saying they saw some signs of people probing for this back on October 17 shows that the shade that the PHP publicly threw on Chainguard was misdirected and a deflection on their own efforts to coordinate the release. It should change the PHP team's deflection, if anything.

Nothing is standard in the security researcher world. I have no interest in PHP nor Chainguard, but I have a greater interest. PHP folks can deflect the blame to Chainguard, but really, it's the PHP team who mishandled this from years ago. There were likely other disclosures or discoveries of this, if Amazon were starting to see this probed on October 17. Heck, OpenAI found this at nearly the same time as the original POC disclosure.

View on HN

Was PHP not correct that as of the embargo there were no confirmed valid uses of the exploit, even with the embargo being broken and people rushing to try to exploit it early?

Maybe we are arguing that they should have release early because of the possibility of it being exploited, but I do believe PHP (and others who backed it up) when they said they reviewed the exploits flying around on Twitter and verified those would not be able to successfully perform this exploit.

And again, Amazon is not saying they saw this being probed on Oct 17th. They are saying that today, in hindsight, they see this in logs from the 17th (unknown if it would have been successful either). If Amazon clarifies that they saw this in the wild at the time, then I agree with you. They just didn't say that.

I don't even know why we're spending time blaming anyone here. The only reason any of these vulnerabilities matter is because bad people do bad things with them. The night of the disclosure, I saw reports like this one and many others, and it was more than enough for what I thought any reasonable person would deem to meet the bar for early release. It turns out reasonable people can disagree on almost anything.

I'd rather we all collectively spend this time talking about how we go fix all the rest of the vulnerabilities we (and everyone else) are finding as quickly as possible and get the patches and mitigations deployed to everyone that needs them as quickly as possible over the coming months.

(I'm the guy that decided to release these early)

If the bug isn't being actively exploited in the wild, then you want a coordinated disclosure/patch.

If it is, then you just want to get it out as fast as possible.

The PHP team thought they were in the first case and acted accordingly. Turns out they were in the second case. But I see no indication they could or should have known that. They made the right decision with the info they had.

Reply on news.ycombinator.com