Comment by xd
17 hours ago
I took my services offline last night, wouldn't have been able to sleep otherwise. There has been core PHP members that have outright said the mitigation's currently doing the rounds won't help and even cloudflare can only mitigate against known attack payloads.
The maintainer's comments are singularly unhelpful - "there's nothing you can do, just curl up and die" is pretty useless when you're faced with "take the entire company site offline" vs "maybe get exploited."
The comments aren't unhelpful, they're in fact very helpfully telling you that "take the entire company site offline" is the only safe choice right now.
But that's exactly why it is unhelpful. "Take your site offline" is always safe - but we don't have enough information to make the decision informed.
"X may mitigate some of the active attacks" is helpful - you can evaluate if X impacts you, and make a choice.
"Y is how we're seeing the attacks" is helpful - you can setup logging to see if you're being exploited.
"Z reduces but we can't say it eliminates the risk" is similar.
"SHUT IT ALL DOWN" doesn't do much but make good noise and increase the chance that the next one is considered to be a "boy-crying-wolf" scenario.
(Of course, taking all dev/test/unimportant sites down for a few hours is painless, but Wordpress/PHP runs some of the biggest sites in the world.)
1 reply →
Yes, that's not very well done: when you are handling big IT services, you need more than "a person wrote a scary thing on twitter" to justify such an impacting action
Does CERT-EU telling you to shut your site down count
2 replies →