thaumaturgy
Joined 18 years ago
Karma
26,854
Submissions
4,493
Member since
Feb 17
Recent submissions
Comment · 5 days ago
Comment · 5 days ago
For me (I host a lot of PHP...):
1. First I hear about it is a heads-up at 5:00 am 21st.
2. Available info then is pretty much, "omg, it's the end of the internet".
3. There are no specifics available on exploitable configurations.
4. Updates are not expected to be available for at least two more hours, so people start deciding to do the Madagascar "shut down everything" meme.
5. Cloudflare says they're seeing exploits in the wild, well, that's not great.
6. I shut down everything, including a national brand, because wtf else am I supposed to do at this point?
7. Updates become available at 0645. Fortunately, I don't run my entire infra on Docker, so I'm immediately deploying the updates to all configurations and bringing sites back online approximately in order of traffic volume.
8. Still no specifics on the exploit.
9. A million vibe-coded PoCs appear on GitHub ... and none of them work.
10. It's late morning local time on the 21st and I'm still bringing things back online, having taken the day off from my regular job.
11. Conversation starts to shift towards, "...oh, did we over-react? How exploitable is this exactly?"
12. Still no specifics available.
13. Somebody on the internet gets as fed up as I am with the whole chaos vortex of idiocy and stands up a site saying, "okay, here's some money if you can exploit it."
14. Hours pass.
15. Still no specifics available.
16. Zeitgeist becomes, "I guess it's not exploitable after all."
17. The test site gets 'sploited.
18. Finally somebody actually posts the damn specifics -- namely, the person that grabbed the $2k.
19. Late morning local time on the 26th, and the conversation becomes, "well, obviously this was exploitable!" <-- we are here
Coincidentally, I just started reading Crisis Engineering, which seems like an excellent and applicable book, but I'm not sure who to beat with it.
Comment · 9 days ago
There are two aspects: first that there is currently a much higher pace of critical vulnerabilities and exploits being discovered, and second that there is a much shorter window between discovery and large-scale exploitation.
People are saying the pace will settle down once LLMs find and fix all the bugs. Okay, sure, if you want to believe that sort of thing, but that still leaves the much shorter time window, and that's not going to go away anytime soon.
If you're on the side of the industry where your job or hobby involves breaking things, this is all very exciting. But if you're on the side of the industry where your job is to prevent things from being broken, then it really sucks.
I lost a full day yesterday because some big players discovered a thing, told other big players about it, "oopsed" enough public information to let everyone else know about it, and then left everyone else to figure out what to do with almost no information to act upon.
This cycle has happened several times this year now. If you're on the short list of big hosting providers, you get advance notice of what's coming and early fixes; if you're not, sucks to be you, hope you didn't have any plans today.
For people like me, this is just yet one more way LLMs are making my life materially worse.
Comment · 26 days ago
> Respond to the arguments leveled
I replied to the words you wrote. If what you wrote doesn't say what you meant to say, fine, but don't come at me for it.
> The starting position is: get rid of them. The 2nd order consideration is "hmm, what problems might that cause?"
Alright, I can go along with that. Then the 3rd order consideration would have to be, "okay, here are the possible problems it could cause, and here is the evidence for and against."
And that is where I've been working this subject from from the beginning of this thread.
> I came in requesting evidence for your assumptions and you've confirmed you do not have any.
...other than the multiple links to discussions, books, papers, and opinion pieces from subject matter experts, you mean? I notice none of your comments happened to come with any supporting evidence for your argument. We're supposed to just believe that eradicating these pests would cause a worse outcome than the current amount of human misery they cause worldwide because... why? Because of your hypothetical aliens and because humans use science to cause ecological harm?
Maybe take a step back and reassess.
Comment · 26 days ago
> Food chain collapse happening elsewhere is a reason not to risk creating more of it.
Granted, but also food chain collapse has been happening for a while now and yet Anopheles is still not anything's preferred food source. It really seems to fit the definition of a strictly non-beneficial parasite.
> ...science meddling with nature also goes back in reality to the widespread food chain collapse that our science is already unintentionally causing all over the globe.
There's a whiff of "science causes bad things" here, which is what I keep hoping isn't the unstated foundation of the pro-mosquito argument.
> > And these are the arguments that condemn a million people a year to death.
> Obviously the people arguing against you believe there's a chance that altering course would be far, far worse than this already-not-good outcome.
I seriously, seriously doubt the people making this argument have thought all that hard about this. The more likely scenario is that the millionish dead per year is happening in other people's countries and therefore it's not thought about at all.
I wonder what the factor-of-10 scale would be for the number of Zika-affected births in the US before Americans suddenly became overwhelmingly in favor of eradicating these mosquito species. 100? 1,000? 10,000? Over-under at 10,000, I guess?
I don't think I got much in the way of any new insight to how other people think about this, but thanks for the discussion, anyway.
Comment · 26 days ago
Again: the effect you're referring to here, food chain collapse, is already occurring, but on much larger and more indiscriminate scales. Meanwhile, there is scant real evidence that Anopheles is a critical component of the food chain. Here's the most fair treatment on the subject that I could find: https://archive.ph/h12qU
I've been following this subject since at least Olivia Judson's article was published back in 2003. Over the last 23 years, to the best of my knowledge, nobody has yet made a strong case that Anopheles was a necessary part of the ecosystem. If your alien species were unable to identify wheat as an important food source, one would question how they managed to figure out interstellar travel.
The most vocal arguments against are all of the kind we're seeing here: "we don't know what might happen" (a statement of the unintended consequences of science meddling with nature that goes back in fiction to at least Mary Shelley), "we should assume they're necessary" (and yet all other necessary critters seem to be optional), "something needs them, we just don't know what" (in 23 years, biologists have so far identified a single spider that maybe or maybe not depends on them).
And these are the arguments that condemn a million people a year to death.
I would be easily swayed by evidence of large-scale ecosystem destabilization if Anopheles were eradicated. To date, not only is there no such evidence, but there is some evidence to the contrary (species of mosquito have been introduced to island habitats where they went on to have significant effects on local animal populations).
Comment · 26 days ago
Okay, but we aren't talking about the eradication of all mosquitos. Approximately 10% of known mosquito species are potential carriers of human disease (https://entomologytoday.org/2022/07/26/less-than-10-percent-...), and discussions about eradication efforts generally revolve around just the Anopheles genus.
There's an excellent book on the impact of the mosquito on humanity, and a brief overview of some of that subject here: https://www.newyorker.com/magazine/2019/08/05/how-mosquitoes.... These species of mosquito are and have been one of the most significant threats to human health for all of our existence.
I don't think argument-from-ignorance should be more convincing here than it would be on any other subject. There is some debate among researchers, sure, but published biologists have been making arguments in favor of eradication for over 20 years (https://www.nytimes.com/2003/09/25/opinion/a-bug-s-death.htm...). If someone is being intellectually honest in objecting to this on the grounds of the fragility of ecosystems, then they must also be an equally loud voice against the use and manufacture of glyphosate. That one chemical alone is already having a far greater impact on insect populations, yet you can buy it at your local hardware stores.
So yeah, I genuinely don't understand the reasoning here. It feels like a dumber version of the trolley problem, where a perceived inaction that has far larger negative consequences is preferable to an action with more limited ones -- except in this case, it's not even right to describe our current impacts on ecosystems as "inaction".
I suspect that if an article were published tomorrow that found that, through some previously-unknown mechanism, the expected rise in global temperatures over the next 10 years would have a side-effect of killing all mosquito populations, that article wouldn't even make the front page of HN. Nobody much would care, aside from those few recurring voices mourning our future.
More cynically, I also suspect that since the worst impacts on human health are occurring in tropical populations, westerners find it much easier to argue in favor of protecting this particular pest.
Comment · 26 days ago
Do you have the same level of concern for all other recently-extinct species, widespread habitat loss, and overall large decline in insect biomass?
Or do you reserve most of your concern for just the few species of human disease-carrying mosquito?
Kind of a genuine question, because I've observed over the years people popping in to this topic to exclaim deep concern for the potential ecological impacts of intentionally extincting a couple of species -- that most biologists reportedly agree aren't keystone species. Meanwhile, species loss continues to occur globally for a variety of reasons and yet it's still really difficult to get the average person to care very much about that.
The psychology here is peculiar and I don't understand it.
Comment · 1 month ago
Haha! I did, but not for a few years, until I took up Pascal and MacOS and then wanted to find a way around the 32k text limit that was a stubbornly difficult problem to solve for a while (and was the original reason that BBEdit became so popular).
Trying to correctly render a vertical blinking cursor on top of proportional fonts took me ages to get right...ish.
Comment · 1 month ago
Different strokes, I guess. FWIW, I also started at 8 -- with a Commodore 64 and a Commodore Vic-20, both connected to a television -- and I found the process of trail-and-error learning my way through BASIC to be absolutely awesome.
I would start with a completely blank slate and then, gradually, be able to create something out of nothing. If I was clever enough, it could do whatever I wanted (as long as my wants were modest). It was magical and I have nothing but fond memories of the time I spent doing that.
Comment · 1 month ago
I'm not centrist, but I think I can give a reasonably fair account. I was among the first to organize against Flock (YC S17).
Flock was accepted into YCombinator's Spring 2017 batch. Prior to YC, Flock CEO Garrett Langley had had a couple of fair-to-middling business successes and was looking for his next opportunity, which included better toilets. The story goes that he got the idea for Flock after a local police interaction where he happened to have helpful video footage. [1]
Flock quietly expanded into HOAs and neighborhood associations [2], and by 2020 had begun developing partnerships with police departments across the country and fusion centers [1], which are regional clearinghouses of data from multiple sources assembled together for law enforcement purposes.
By 2025, Flock had managed to grow to 80,000 cameras operational across the country. In June of that year, 404 Media, an independent journalistic outfit comprised in part from former Vice journalists, broke a story about Flock being used in the investigation of a woman who had self-administered an abortion in the state of Texas [3]. Flock quickly released a statement trying to "clarify" the situation, but everyone involved was lying through their teeth [4].
Up to this point, Flock had spread across the country in a pretty clever way: they built direct partnerships with police departments through sites and resources they commonly used, like https://www.police1.com/, and by hiring former police officers for sales positions. Police departments were coached to consider Flock an "ALPR" (which it very arguably isn't), which would make it not "new" technology under most local police technology procurement processes, which meant that police departments could purchase it without city council or other local agency review. To make the purchases, Flock helped to connect police departments with public money in the form of grants. For example, funds might be available for programs meant to reduce "organized retail theft", and Flock would say, "well, we qualify!", and then police departments would not use the systems to investigate organized retail theft. [5]
Throughout the Summer of 2025, people started asking questions about these weird cameras popping up everywhere, and 404 Media managed to produce one widely-shared article after another about Flock [6]. Other media outfits started to pick it up, and stories getting national attention included law enforcement officers using Flock to stalk former romantic partners or love interests or anyone else they wanted to (because Flock was built without any controls in place to prevent that kind of abuse; Langley himself repeatedly said it wasn't their job to do); Flock sharing direct access to data with federal agencies; Flock lying about the direct access that federal agencies had; then federal agencies using Flock's data-sharing capabilities to easily get around the really thin limitations that were put on that after reporting about it; Flock being used to surveil protestors; and on and on and on.
Essentially, Flock became a textbook case study for every single abuse of state surveillance power you can imagine.
Garrett Langley attempted to navigate all of this by absolving Flock of any responsibility, denying any wrongdoing, outright lying in some cases, and referring to people running crowd-sourced maps of Flock installations as "terrorists" -- which, many months later, he would get around to walking back. A little bit.
Some groups were able to legally acquire some devices and found that they had really, really poor security generally, and also that they had capabilities that weren't being advertised to the public. The prime example of this is that Flock would coach police departments to tell the public that Flock was "just an ALPR" and "only captured pictures of license plates", but meanwhile the software on the devices was written to capture images of people and bicycles and cats and dogs. On the one hand, the public would be told that the system could only track vehicles; on the other, Flock's own marketing materials advertised the ability to find pedestrians by a description of their clothing, and police departments were being trained on how to use the system to follow bicyclists. In another case, Flock representatives would say the system didn't have a "heat map" capability (showing a density of hits for a particular license plate in a particular area over time), and then it would turn out that not only did they have that capability, but internal trainings with law enforcement departments were explicitly describing how to use the system to predict where a particular person might be at a particular day and time (called a "pattern of life" search).
In 2026, public opposition to Flock has become a national conversation, and states like Oregon have started developing more restrictive legislation around the use of it and similar technology.
Flock wasn't the first ALPR company. The technology has in fact been around for a while and there are other established players in the space. However, Flock quickly had all of the hallmarks of "surveillance capitalism" -- an effort by investors like YCombinator, Founders Fund, Andreesen Horowitz, and others, to build out a national realtime surveillance network of everyone's movements and then monetize it, most obviously by providing access to an increasingly authoritarian federal administration. Americans, surprisingly, have found the will and energy to organize against this in large numbers that cross the typical political divisions.
[1]: https://www.vice.com/en/article/talon-flock-safety-cameras-p...
[2]: https://www.mercurynews.com/2017/09/03/early-stage-this-surv...
Comment · 2 months ago
Indeed. Around that era I had a fun little "crashmybrowser.com" toy site that had a few different JS tricks you could click that would absolutely wedge your browser (any browser, at the time). This had come after years of my being vocally annoyed that there weren't better guardrails around Javascript. Each of the functions was based on a real-world failure case.
Chrome was the first browser to be immune to all of those functions.
Mozilla really screwed the pooch not long after. Their biggest single misstep was forcing automatic updates in corporate networks. At the time, they still had pretty good adoption in the kinds of environments that had a couple of people somewhere deciding what everyone was allowed to run on the company computers. Chrome had already moved to forced updates, so these environments went to Firefox. When Firefox decided to follow Chrome, they no longer had that differentiation, and corporate IT had to choose between two browsers that both had automatic updates, but one of them had frequent memory and performance problems.
I've happily returned to Firefox a few years ago and don't have Chrome installed on any device I control.
Comment · 2 months ago
PG&E diverted safety money for profit, bonuses: https://www.sfgate.com/bayarea/article/PG-E-diverted-safety-...
After choosing profits over maintenance, California utility giant forces blackouts on customers: https://www.salon.com/2019/10/09/after-choosing-profits-over...
PG&E Spent Billions on Lobbyists and PR Instead of Upgrades: https://theintercept.com/2019/10/11/pge-power-shutdown-calif...
John Oliver on utilities, including PG&E: https://www.youtube.com/watch?v=C-YRSqaPtMg
Can we stop just automatically assuming that the poor, beleaguered companies would definitely be acting in the public's interest all on their own if only it weren't for the big bad regulators? It really seems like, in 2026, there should be ample evidence to the contrary by now.
Comment · 2 months ago
There's not a chance in hell that even half of the world's PHP has been updated, so I would expect that if we start seeing large-scale exploitation, those people will change their opinion pretty fast.
Being totally burned out on AI hype myself, I'm somewhat sympathetic towards the folks that are still thinking of this as just another example of that.