hannob

Never attribute to malice what can sufficiently be explained by the love of software developers for overengineering and complexity.

Seriously, I have no trouble explaining this. Overengineering is just how many people think software development works. It's unfortunate, it causes plenty of problems, but it's not a sign of malicious intent.

To put that in perspective: I noticed that private key parsing was 70 times slower in early 3.x versions. I think it's only 8 times slower in current versions. That's still... a lot slower. For no good reason.

I wish people who report "exploitation attempts" would be very clear about what they actually observed.

Something that would lead to an uncontrolled memory corruption, potentially leading to a crash, or something that indicates a real, code-executing exploit? Those two kinds events are of very different significance. I can't read from Amazon's announcement which one they think they saw.

From the little info one can see here, it looks like this is a PHP script causing a memory corruption. So you probably need to be able to run PHP code to exploit it.

That's... not a particularly unusual issue. PHP has a large codebase, releases with plenty of fixed crashes come out regularly. It becomes critical if there's a remote path to exploitation.

I see no indication that this is a "critical" PHP flaw. And the Reply from the person who found it seems to confirm that. ("I keep getting asked about mitigations, here's the mitigation: don't worry about it kitten")

Makes no sense.

If it was deliberate, one would use keys that only the person abusing it has. Not keys everyone can guess if they get a hint.

Every time there is a CA issue, someone comes up with "this would be so much better if we'd make it more complex than it already is, as it would make it a bit more convenient to deal with the most recent issue".

I don't think that's the right way to think about it.

Kinda interesting that this is getting so much attention.

Ultimately, the example.com domain is just there so you can use it in documentation or code examples. Your expectation about the actual example.com domain should basically be none at all, maybe with the exception that it's hopefully not doing actively malicious things like serving malware or running a catchall mailbox feeding spammers.

Whatever HTML they server or if they serve anything at all... shouldn't matter.

I mean, we eliminated smallpox viruses, and the impact was that humans no longer die from smallpox. We have almost eliminated polio, which has the impact that nobody needs an iron lung any more. We have massively reduced the incidence of a whole range of other pathogens. Are you concerned about that, too?

I'd be much more concerned about the changes humans do to our ecosystems that we know cause harm, but aren't stopping (like filling the atmosphere with CO2 and other greenhouse gases) than about changes that would, almost certainly, reduce harm and have only extremely unlikely and hypothetical risks.

Welcome to the club!

There's an impersonation profile of me on Github (username happyhannob). I've reported it a while ago, received the same automated message, and no reaction otherwise. It's still online.

I guess you can't expect basic fraud prevention from a company currently building the future with AI...

oss-security gets relatively little use? You must know another oss-security. The one I'm subscribed to is very much alive and an important source of information for me.