pamcake

False dichotomy. There are plenty of other possible approaches outside of "having agent swarms randomly breaking in to environments and then marketing their services in the disclosure" and "do nothing".

Admin interfaces should never have been exposed publicly in the first place (and aren't by default). Remote admin over wireguard or sth if you must.

And again I say unto you, It is easier for a camel to go through the eye of a needle, than for a rich man to enter into the kingdom of God.

Matthew 19:24

It's Supercedes Ictus now

Everyone knows that MediaWiki is exploitable. The story running around is exactly that this is generally exploitable even for simple apps serving static content like this.

Heck, I imagine that 1% would still be a total game-changer.

I think a common mistake when approaching MWI is reading too much into it. These Other Worlds "exist" in similar sense to the number i. MWI does _not_ claim anything about there being infinite alternative equivalent planes of existence where these physically manifest or anything like that.

"Brings in everything from: Arc, Dia, Chrome, Safari, Firefox, Brave"

I'm skeptic.

Where is the source code (with licenses and attributions)?

> what you're saying, if I understand correctly, is that self-hosting this is trivial then

Yes. It comes encouraged.

> so does that mean I could run my own local instance and never get it taken down since traffic would be negligible?

Yes, unless the other end forbids it and really cares about controlling clients. If they do and manage to detect that you are using alternative client they could block based on that. In times where that happens and there are client devs who care, it becomes a cat-and-mouse.

much better!

nit: Page is barely readable with dark color scheme because CSS applies dark-light-aware color to text but not to background, resulting in light-gray on white.

> Our thought process was that we didn't want to recommend that people roll keys when we couldn't possibly confirm that we confidently plugged the breach and rolled the mitigation(s). I am comfortable to publicly say that this was a highly motivated attacker. Meanwhile, our threat team mitigates DDoSes, CVEs, while been patching everything immediately as dealt with exploits.

> As for this breach in particular, we tried to balance a duty to warn, which we take very seriously... However, it took a significant amount of time on the order of hours to verify, reviewing, and keep up with the attacker as they attempted to move laterally around, and briefly, within the system. We didn't want message anything beyond a shadow of a doubt that there were no further exploit paths.

Once you realize there is compromise, you message accordingly, as soon as you are able. If you can't immediately determine exactly what subset of customers were affected, this means you have to tell everyone. Then you provide follow-up updates to fill in gaps as you develop your understanding of scope+impact and work on remediation.

What you should never do is hold off on reaching out to possibly affected stakeholders that they may be affected by a compromise because you still have uncertainties about current status.

A situation like this does not in any way a constitute a dilemma or tough balance regarding when or to whom to do initial disclosure - you do it as soon as you can, to everyone except those you know are not impacted.