pull down to refresh
reply
reply
reply
reply
reply
Yes. So there is no great answer on a bug that has accumulated vulnerable coin for 5+ years. I cannot see any way to do it right when that history already built up like that. That is probably the other thing, besides the speed at which this went from question mark to "found it", in which this is unprecedented - I honestly don't remember any fundamental flaw with such exposure time in our space. Do you?
reply
What you were watching was a crisis. Of a novel kind too because normally this would go onto a security list, get patched, then you get the "update and roll over now" after a few hours and then next week we'd know what's what.
This was live. Extreme pressure. Even in the thread here on SN. I am sure some stackers didn't sleep much Thu->Fri, and on Twitter we saw people deprivating themselves of sleep beyond what is wise. Pressure to solve it. Ask the bot. Share preliminary unverified findings... on and on and on. This all went down in record speed.
To give you a comparison: 2 years ago, for a similarly complex, high priority bug, I needed 2 days to confirm, 1.5 days to patch and do a release, and luckily the ecosystem was ready to adopt quick - within a week most was fixed when wave 2 happened because someone figured it all out from reverse engineering the patch. Of course I didn't have a bot, or an army of people on twitter, or so many eyes on it. But the speed of this should give resolve. Wave 2 happened after 12 hours or so because once you are in this public setting, there is no going back and every fool has a bot now.
If you're not actively reviewing, having hardened process and spend at least 20% of your awake time on security then you better doomscroll X for every product you depend upon. Because that's the world we live in now.
We all know that this is the issue. And if we are honest, we know that this is the problem for each of us. We trust and we don't friggen verify. This vuln is the proof. Yes, we have a serious issue. Virtue signal became more important than actual work. We grew fat. We are lazy mfs. I am. You are. Everyone is.
Realize it now. And ffs get yourself on a diet and be lean again.