JaggedJax

Was PHP not correct that as of the embargo there were no confirmed valid uses of the exploit, even with the embargo being broken and people rushing to try to exploit it early?

Maybe we are arguing that they should have release early because of the possibility of it being exploited, but I do believe PHP (and others who backed it up) when they said they reviewed the exploits flying around on Twitter and verified those would not be able to successfully perform this exploit.

And again, Amazon is not saying they saw this being probed on Oct 17th. They are saying that today, in hindsight, they see this in logs from the 17th (unknown if it would have been successful either). If Amazon clarifies that they saw this in the wild at the time, then I agree with you. They just didn't say that.

This doesn't really change anything, other than check your logs back through the 17th. Amazon is not claiming they knew about this being exploited before the 21st. No one appears to be claiming that. Their wording could easily mean they went back through logs and found it later. I haven't seen clear evidence yet that any of the thousands of early attempts were successful. They appear to just be people sniffing/guessing around to try and figure it out, at most sometimes getting something to work in one specific environment.

Yes, we live in a new world now and need to handle disclosures differently by learning from this experience. The first major RCE disclosure that came with 3rd party leaks of this era was bound to cause these issues no matter who it affected. Let's hope the next one is better.

The major mistake I see in this incident on the disclosure side that kicked this all off was Calif posting their video early because they took vibe coders on X at their word. Maybe the early notice by PHP of an upcoming release was a mistake in hindsight given how people reacted.

[] Is this standard in the security researcher world? Let's beat embargo by a few hours and cause extra panic by putting more people at risk?

All I can say is it's the only editor I've ever used with this type of issue and unfortunately it's a deal breaker for me. I can get by with any other editor even if they aren't my favorite, but only Zed made me realize that the most important thing an editor can do for me is accurately show me files.

I don't understand why this would change any opinion on Bitwarden. Bitwarden offers an API and OneCLI calls the Bitwarden API. How does a 3rd party calling Bitwarden's API say anything about Bitwarden?

Edit: I can see on Bitwarden's site they also call out their support for OneCLI, so I suppose that looks like Bitwarden saying they approve of and recommend OneCLI. But I see recommending an open source solution as a lot less problematic than recommending any other random private startup solution.

How? Reading this it seems like only verified developers can skip this process. Most Fdroid developers won't be verified. I don't see where it says Fdroid would be exempt from this requirement. Would Fdroid be a verified developer?

The turfing with this topic is strong and needs to be called out. Reliable sources are crucial now more than ever. We cannot tolerate and promote botnets once they are uncovered.

Found that this is a Firefox setting, maybe it's not (no longer) defaulted to on.

"Search for text when you start typing"

I have to say, I do like this setting enabled, but can see how it conflicts with the page. And let's be fair, how much time and I saving over having to press Ctrl+F when I want to search a page?

Love it, what a great throwback, especially with the OST.

In Firefox is there a way to play this without FF popping up the search box on every key press? Maybe there's a way for the JS to override the default FF search functionality?

Analytical systems. I see a lot of add-on services that will add intelligence/analytics/etc and companies try them out to solve some issue they have and bounce off them frequently due to growing costs. I can only assume as mentioned that over time these are also easier for companies to in-house vibe-code as well, I just haven't seen a ton of that yet, but people are definitely trying which still shrinks the available pie.

Maybe it's mostly from AI, maybe it's mostly general economic cutbacks. I also feel like these "wrapper" style SaaS products are the first ones companies are dropping when they are looking to cut costs, and I think a lot of companies are looking to cut costs. I do agree with the overall conclusion either way, that System of Record products/companies are the most likely to survive. There are a lot of SaaS companies with questionable long-term businesses who are getting hit, but that was bound to happen.

I'm not sure when this policy was introduced, but fairly recently Jellyfin released a pretty major update that introduced a lot of bugs and performance issues. I've been watching their issue tracker as they work through them and have noticed it's flooded with LLM generated PRs and obviously LLM generated PR comments/descriptions/replies. A lot of the LLM generated PRs are a mishmash of 2-8 different issues all jumbled into a single PR.

I can see how frustrating it is to wade through those and they are distracting and taking time away from them actually getting things fixed up.

They want access to the index. They will perform their own sorting to determine the best results to show from that index.

There are plans available where that is the case. So the solution would be to switch plans or carriers to one that doesn't bundle the phone price in.