← Back to context

Comment by bombcar

12 hours ago

The maintainer's comments are singularly unhelpful - "there's nothing you can do, just curl up and die" is pretty useless when you're faced with "take the entire company site offline" vs "maybe get exploited."

8 comments

bombcar

Reply
compass_copium  12 hours ago

The comments aren't unhelpful, they're in fact very helpfully telling you that "take the entire company site offline" is the only safe choice right now.

  • bombcar  11 hours ago

    But that's exactly why it is unhelpful. "Take your site offline" is always safe - but we don't have enough information to make the decision informed.

    "X may mitigate some of the active attacks" is helpful - you can evaluate if X impacts you, and make a choice.

    "Y is how we're seeing the attacks" is helpful - you can setup logging to see if you're being exploited.

    "Z reduces but we can't say it eliminates the risk" is similar.

    "SHUT IT ALL DOWN" doesn't do much but make good noise and increase the chance that the next one is considered to be a "boy-crying-wolf" scenario.

    (Of course, taking all dev/test/unimportant sites down for a few hours is painless, but Wordpress/PHP runs some of the biggest sites in the world.)

    • hobofan  10 hours ago

      So what if there are no known mitigations and it's such an open attack surface that logging doesn't help in containing it?

      Since you wrote your comment the official blog posts describing what exactly is the in the exploit have been released, and "shut it all down" was definitely the right advice to give.

gregoriol  12 hours ago

Yes, that's not very well done: when you are handling big IT services, you need more than "a person wrote a scary thing on twitter" to justify such an impacting action