joshuat

This also happened on iOS when they began to prompt users before apps could access the clipboard. I built an app that would handle the inbound redirect automatically if you had a relevant URL in your clipboard - did this for years with many users happy with the feature.

Then it started prompting users before allowing them to paste, and then the claims of privacy violations began to come in.

If instead I were able to specify what was happening in the prompt rather than iOS giving users an ambiguous statement, or even provide a detection pattern, it wouldn't have been nearly as bad.

I feel like this really harms security and privacy awareness by flooding the field with unimportant prompts/warnings to the degree that a real issue is similarly ignored because it is assumed to just be noise.

I wish I could buy this without touch just for the rush of nostalgia, having the illuminated Apple logo on the back

This is better than the phone ringing, certainly, but now I just get voicemail notifications and feel the need to mark the calls/voicemails as spam.

What makes this so much more frustrating is that I work in the telephony industry, and I know the hoops brands have to jump through to make calls or send SMS/MMS. I work with TCR for brand/campaign registration, I work with NetNumber and STIR/SHAKEN cert issuance for attestation levels. All of these hurdles for us, and it seemingly makes no impact in the real world for spam filtration.

Spam calls, at least in the US, are a much more frustrating thing for me right now

Were that something to worry about, I imagine we'd be seeing it now as well - I don't think a lifetime license option would sway people away from that option were it a viable one.

Mismanagement and disastrous redesigns aside, the "lifetime" funding model was flawed from the beginning and imo played a serious part in leading Plex down this path.

Looks like the comment was deleted, insane to think dropping that in a community forum discussion was a good idea.

It’s really impressive no one caught their three previous private key values

“4”

hey chatgbg what is a “private key”

The biggest question is how is your application accessible?

Expect the entire ipv4 space to be crawled for this with common paths being attempted.

Good for them to be able to sleep the night before this chaos was meant to erupt, earnestly.

I think the exploit itself of Heartbleed was worse, but the impact size of this will be greater.

Measuring “worst” is hard.

I heard back from their technical team:

> WP Engine Security and Engineering have enabled WAF rules for all customers using GES and AN. Mitigations are currently being deployed across the rest of our infrastructure, and official patches will be applied as soon as they become available.

If the rumors for these exploits being shared on Twitter are correct this is going to be a nightmare. I wouldn't be surprised if VPS hosts step in to mitigate it somehow since so many cheap/unmaintained LAMP installs are running on those servers.