Comment by bcvvvy
5 hours ago
Why haven’t they fixed Amazon Linux then?
Same as none of their AMIs for bottlerocket have emSign revocations.
Absolutely shit company who puts their customers at risk.
5 hours ago
Why haven’t they fixed Amazon Linux then?
Same as none of their AMIs for bottlerocket have emSign revocations.
Absolutely shit company who puts their customers at risk.
High chance they've demotivated their devs who normally pick up this stuff quickly or laid them off.
> Why haven’t they fixed Amazon Linux then? Same as none of their AMIs for bottlerocket have emSign revocations.
Last I checked, Amazon has also not patched their Lightsail blueprints for WordPress, or even communicated about the vulnerability with those customers at all, which is arguably way worse, because
(a) by design, all-in-one blueprints aren't really intended to use system PHP or have system PHP updated in a meaningful way; and
(b) hosting static sites such as WordPress is 90% of the selling point of Lightsail as a product
That's pretty awful. I do wonder if they've bitten off more than they can chew with all the ancillary stuff to their core IaaS platform. That seems to be the only well maintained bit of their estate, well EC2/VPC/S3/R53 etc.
[flagged]
-1: if the fix breaks customers in other ways, they're screwed as well. Damned if you do, damned if you don't...
It's a upstream targeted fix that was made available significantly faster in packages/images maintained by volunteers, it's not some untested downstream patch. Customers at this point would have likely taken their applications offline over this issue so it would have been difficult to make the situation any worse.
Given the sheer number of PHP applications out there, it's impossible to conclude with certainty that this targeted fix will have no regressive impact without significant testing. How much testing needs to be done is debatable, but I'm pretty sure the answer isn't zero.
6 replies →
Nearly every other vendor has pushed fixes for it, including where they pull their upstream stuff from. There's no excuse.
I don't think you're being understanding or empathetic here.
Any vendor that delivers updated packages without thorough regression testing that ends up causing an incident for their customers as a result will get a thrashing from the community. Remember the CrowdStrike BSOD incident in 2024?
Maybe Ubuntu and others are cutting corners to deliver more quickly. It's their risk to take, but it's still a risk.
2 replies →