aksss

So.. what has the effect of this all been? I understand that the early release of POC exploits increased the pressure for mitigations in advance of the patch release and caused a lot of work and stress. I have read the tweets from Cloudflare with statistics for malformed requests related to suspected exploit attempts.

I know breaches are often kept under wraps, and there's a long tail. But is there any evidence of impact at this point? Were any sites compromised that we know about? There was a lot of hullabaloo, with foreign and domestic LE agencies recommending sites be taken offline (holy shit!).

Was this like Y2K where, based on the coordinated action of many, a real issue was addressed in time? Or is it like Hale Bopp where everybody watched, and a few casualties in the preparation, but ultimately a nothingburger?

Flame on!

So where are all the compromised sites? I was sorta expecting some kill lists today, but not seeing anything. Does this mean APTs rather than defacement/ransom? Or has this been a nothingburger?

I think the ubiquiti edgerouter admin interfaces use PHP. I don’t know about mikrotik, but wouldn’t surprise me if there are a lot of those devices hanging off the internet on some nonstandard port.

Haha you’re right, but the skill you need to be good with is probably eye strain tolerance. But must needs and all. :) If you don’t use a WAF of some type, the risk is probably sufficient to warrant firing up the laptop tonight or worst case use the phone.

The exploits seem to rely on multipart form submissions. In a normal setup, I don’t believe PHP’s multipart parser processes GET requests.

Therefore, a temp mitigation that runs short of shutting your site down is to temporarily block POST requests until you can get the patches in place. This will screw up any form functionality, including your WP login form, but keeps your site presence up. A failed form submission is probably a better look than no site presence. You can affect this with Apache config or by using a WAF. For instance if you have cloudflare caching your domain, use a free security rule to block all POST requests until your patches are in. Something like `http.request.method in {"POST" "PUT" "PATCH" "DELETE"}`

Rather than taking your site down tonight, if you have cloudflare handling your DNS, orangeclouding your domain, you can use its free security rules to just block all post requests until tomorrow rather than taking your whole site offline. Drop this into a rule: `http.request.method in {"POST" "PUT" "PATCH" "DELETE"}`

Of course you can do this with web server (eg Apache) config as well, but the CF rule is something you can do now on your phone.

I’m not saying I know this works as a mitigation, but it seems like it could at least contribute to a temporary guard until you get patch in place. Everything I’ve seen about the exploits seem to revolve around multipart form submissions.

“PHP is the cockroach of the internet”

K, global oil demand is expected to keep rising towards 120m bpd between now and 2050. We are not plateaued, much less reducing reliance on fossil fuels. We are actively leaning into our use of it every day of every month of every year. The production and retailing of the computer you used to type that message above and the energy demand to power it makes you complicit in that. In all of it. So you can talk all you want about dreams and fantasies, but every aspect of your life is impacted by society's capacity to meet energy demand. We almost drove whale species to extinction and nearly deforested many states for biomass fuels before we discovered how to refine fossil fuels at scale and employ them. Hardly a world I want to return to. Fossil fuels are here, they're queer, and not going anywhere without massive tradeoffs that the global population is not willing to accept. The choices to back off energy demand are so bleak they're unrealistic. Sorry I don't have solutions that haven't already been thought of (resilient solar, nuclear), but really all you and I can do that's effective is vote for new energy generation and storage solutions and the policies that enable them and lead the way. The talking part doesn't do much except use more energy.

Those aren’t mutually exclusive - time and money were spent to dump tons of dispersants in an effort to actually clean it up. This comes after the Exxon Valdez spill where it was learned that hot water and high pressure hoses to clean areas did more damage than good - the untouched beaches recovered faster via natural breakdown than the beaches that were cleaned. In deepwater, they skipped the scrubbing and cleaning and emphasized dispersants (y’know, solution to pollution being dilution) and it probably hurt the ecosystem more than letting natural enzymes and such take care of it. The bottom line is that every major oil spill clean up effort is an experiment. But sometimes the instinct to “do something” causes more harm than good. Would the public tolerate an “all natural” approach or a light touch of beach cleaning? Probably not, even though there’s good reason to think the ecosystem (exclusive of human needs) may be better served by that.

I don't know why - they said there was a significant chance of failure, they have quite mature technology for it to be driverless. What's the point of putting a meat puppet in there?

To add some clarification - the event has caused general anxiety and risk of panic attacks, such that even driving down streets or flying on planes as she's done a thousand times before starts filling her with anxiety and panic. It's the panicking about panicking which has expanded the scope beyond just being in the identical scenario as before. That's the part that she recognizes as illogical - driving down the street shouldn't cause anxiety, as she's done it without incident many times before. There are no new identifiable dangers or risks. But it's a combination of intrusive thoughts, physical reactions, all that, which can spiral. Being on the outside it's very hard for me to comprehend, but there's a sense of no control over the chain reaction. There are techniques she has adopted, like using the DARE app regularly and other therapy techniques which have helped unwind this, but it takes a long time. Time is a damn good healer though.

Yes, the panic attack thing is pretty real. Know someone that had a severe allergic reaction, basically started choking to death, paramedics involved, all that. The experience imprinted itself deeply, such that she's deathly afraid of it happening again, and gets triggered with panic attacks. She's like two years on from the experience and through a lot of work she's much better, but it's pretty crazy how broadly it has impacted her life as an anxiety disorder. She knows it's not logical, but describes it as a fear of death and of a spiraling nature such that if she can't arrest it in the moment it compounds very badly, which reinforces the phenomenon - panicking about panicking. Anxiety over a panic reaction. So to be clear, it's not an allergic reaction she's experiencing but trauma from one in the past.

>"'Show me the man and I’ll show you the crime' is the fact of how western legal systems work, the rule of law is a tale that they tell to impressionable schoolchildren."

>"three felonies a day and the way China does it are fundamentally the same thing"

These are the statements that are incorrect for the reasons above.

Constraining the scope of those statements after the fact to narrowly apply to cases where individuals come to the particular attention of severe national security concerns in the respective countries allows for some "correctness" to the statement. But you have moved the goalpost if we are to read those comments so narrowly now - congrats! With appropriate qualifications your statements have become less wrong!

As mentioned, in contrast to the US, in China, social order and political security are scoped into the definition of national security - meaning that even if the mechanisms are the same, your ordinary Chinese citizen is far more constrained by the boundaries of the "national security" box than the US citizen. That an average citizen can successfully navigate the boundaries of their smaller box isn't the useful measurement when contrasting systems - all that fact does is convey that touching a hot stove gets you burnt and people learn from that. It does not change the fact that the Chinese legal system is fundamentally different than the western legal tradition in how it perceives rights and individual liberty and what recourse the average citizen has to challenge their encounters. This speaks directly to both of your claims at a high level.