How would you even know whether you knew the facts? It sounds like what you knew was more than just consistent with there being no embargo, you were explicitly told there was no embargo. After a certain point, there's a limit to how far up the chain any of us can be expected to follow the logical chain of what we genuinely think are true, and this doesn't seem like a glaringly obvious case where you were being reckless.
We're all (well, I guess not all, but the group that's worth caring about, and I hope it's at least most) just operating the best we can on the information we have and trying to make decisions based on that. As long as you're acting in good faith on information that you had genuine basis for believing is true, it seems like it would be unreasonable to expect someone in your situation to somehow intuit that you were given false information or grossly misunderstood what sounds like a pretty straightforward declaration of fact from someone you didn't have any reason to doubt.
At the risk of some armchair paycholoanalysis because it does seem like you genuinely feel some guilt over this: I can emphathize feeling guilty about the outcome of an action that in a vacuum would not have been hard to make differently, but my experience is that those of us who have a nasty habit of beating ourselves up over things when we really don't have much blame will often recognize when on the other side that it would not be fair to hold someone else to that standard. I struggle a lot with how sometimes knowing something is true doesn't always make it feel true, and even though hearing someone else saying it doesn't magically make it all better, I still think it's valuable to hear it from someone else, so if I happen to be right about how you're feeling, nothing about all of this is your fault, and to the extent that you're able to, try not to beat yourself up over your misfortune to get caught in the middle of all this due to circumstances that realistically were outside your control.
Not sure what you are apologizing for. It's a severely overblown bug that ended up on the front page of New York Times and the Japan Prime Minister had to get involved too. The bug itself is non trivial to exploit from just public requests to a web server so I am not sure what the hysteria is about. It's no different from the other hundred or so CVEs I see being posted or dropped everyday.
It will be headlines on Hacker News regardless due to sheer sensationalism, I think most DevSecOps people would rather find out the news here first than via their boss calling them after reading the morning news.
What does "non trivial to exploit from just public requests" mean? It's known to be exploitable on more than one stock PHP application. This really is a 5-alarm fire.
I think people are just latching onto the post that hit the front page earlier today about it being non-trivial to exploit, combined with the fact that there seem to be about a billion PoC out there, most of which don't work.
My PoC (generated) was able to exploit an index.php with a simple echo.
The only thing you have to know in advance is the relative memory offset distances, and that's it. Memory feng shui was the longest part of the implementation.
How would you even know whether you knew the facts? It sounds like what you knew was more than just consistent with there being no embargo, you were explicitly told there was no embargo. After a certain point, there's a limit to how far up the chain any of us can be expected to follow the logical chain of what we genuinely think are true, and this doesn't seem like a glaringly obvious case where you were being reckless.
We're all (well, I guess not all, but the group that's worth caring about, and I hope it's at least most) just operating the best we can on the information we have and trying to make decisions based on that. As long as you're acting in good faith on information that you had genuine basis for believing is true, it seems like it would be unreasonable to expect someone in your situation to somehow intuit that you were given false information or grossly misunderstood what sounds like a pretty straightforward declaration of fact from someone you didn't have any reason to doubt.
At the risk of some armchair paycholoanalysis because it does seem like you genuinely feel some guilt over this: I can emphathize feeling guilty about the outcome of an action that in a vacuum would not have been hard to make differently, but my experience is that those of us who have a nasty habit of beating ourselves up over things when we really don't have much blame will often recognize when on the other side that it would not be fair to hold someone else to that standard. I struggle a lot with how sometimes knowing something is true doesn't always make it feel true, and even though hearing someone else saying it doesn't magically make it all better, I still think it's valuable to hear it from someone else, so if I happen to be right about how you're feeling, nothing about all of this is your fault, and to the extent that you're able to, try not to beat yourself up over your misfortune to get caught in the middle of all this due to circumstances that realistically were outside your control.
You’re “taking responsibility” for doing nothing wrong.
It attracts attention though...
Not sure what you are apologizing for. It's a severely overblown bug that ended up on the front page of New York Times and the Japan Prime Minister had to get involved too. The bug itself is non trivial to exploit from just public requests to a web server so I am not sure what the hysteria is about. It's no different from the other hundred or so CVEs I see being posted or dropped everyday.
It will be headlines on Hacker News regardless due to sheer sensationalism, I think most DevSecOps people would rather find out the news here first than via their boss calling them after reading the morning news.
What does "non trivial to exploit from just public requests" mean? It's known to be exploitable on more than one stock PHP application. This really is a 5-alarm fire.
I think people are just latching onto the post that hit the front page earlier today about it being non-trivial to exploit, combined with the fact that there seem to be about a billion PoC out there, most of which don't work.
8 replies →
My PoC (generated) was able to exploit an index.php with a simple echo.
The only thing you have to know in advance is the relative memory offset distances, and that's it. Memory feng shui was the longest part of the implementation.
[1] https://github.com/cookiengineer/actual-php2shell
6 replies →
The Japanese PM did not “have” to get involved.
Well, consider that their old IT minister has never used a computer in his life, it's probably a good thing she's the one issuing the call to update.
8 replies →