Hacker News new | past | comments | ask | show | jobs | submit
tptacek | on: Tracking Anthropic-discovered vulnerabilities
People say this vulnerability was "not super large easy to exploit" because of one poorly-informed skeptical blog post that hit the top of HN, but the evidence strongly suggests that post was simply wrong, and we're just going to have to live with the misinformation until it decays.

At this point the play is simply to move the goalposts, suggesting that vulnerabilities don't matter so long as you yourself couldn't easily exploit them, regardless of what well-armed attackers can do with them. That's, obviously, not how software security works.

cowlevel | parent | next
It's quite difficult to exploit. But so are most vulnerabilities, but attackers have figured out frameworks for exploiting hard vulnerabilities of this type. The proof is in the pudding - "steal my bitcoin" had its bitcoin stolen.
snowwrestler | parent | next
Are there better sources for understanding the scope of impact enabled by PHP2Shell? My impression from a variety of sources is that very few incidents can be clearly attributed to that vulnerability. As opposed the many other ol’ ways PHP applications get exploited.
tialaramex | parent | next
> the evidence strongly suggests that post was simply wrong

What sort of evidence? What "strongly suggests" this was actually easy to exploit?

loading story #50448437
loading story #50450281
grim_io | parent | next
I think the post scan curl post did a lot of damage to the perception of real dangers.

Instead of highlighting the exceptional quality of curl, under intense, unprecedented scrutiny, the maintainer chose to dismiss Mythos as a nothingburger. I think this was a huge mistake and a disservice to curl itself.

watwut | parent
The goalpost here was an apocalypse, thousands instantly hacked sites and hundreds of exploits flying around within hours. I did not made that goalpost. And reality did not hit that goalpost.

> vulnerabilities don't matter so long as you yourself couldn't easily exploit them, regardless of what well-armed attackers can do with them.

This is moving goalpost. The goalpost was not "yet another vulnerability like the others".