Hacker News
points by tptacek 3 days ago | 0 comments
I mean, it's clear you have a valid reason to be irritated, but that's not the concern I have here. What's worrying is people applying motivating reasoning to talk themselves (and others) into believing the vulnerability simply isn't a big deal, which is clearly false.
[–] thaumaturgy 3 days ago
Yeah. I'm choosing to believe that those people just over-weighted some previous info and are under-weighting the latest, but I dunno.

There's not a chance in hell that even half of the world's PHP has been updated, so I would expect that if we start seeing large-scale exploitation, those people will change their opinion pretty fast.

Being totally burned out on AI hype myself, I'm somewhat sympathetic towards the folks that are still thinking of this as just another example of that.

[–] gewetensleegte 3 days ago
> Being totally burned out on AI hype myself, I'm somewhat sympathetic towards the folks that are still thinking of this as just another example of that.

I mean, it was also that it was marketed in the media as a security apocalypse and unpatched servers would be falling within 15 minutes after the patch got released. This didn't happen. And that definitely warranted skepticism. There's been MUCH more severe vulnerabilities in the past that just went by without OpenAI's marketing making everyone go crazy about it.

Also, almost all information about it was dressed up in slop. Because OpenAI didn't want us to forget that AI was involved, somehow.

[–] gewetensleegte 3 days ago
> believing the vulnerability simply isn't a big deal, which is clearly false.

you keep repeating this, also when people make very valid other criticisms, such as the hype causing government websites to be pre-emptively shut down -- do you believe this was warranted?

because that is the criticism.

nobody, including that "PHP vuln isn't so bad" blog article, which was VERY clear about this, said you shouldn't patch your servers

what's worrying is that you keep making up straw men, but why?

this isn't about the vulnerability, it's about OpenAI's Patch The Planet hype train

[–] tptacek 3 days ago
OpenAI didn't find this vulnerability.
[–] anonymous908213 2 days ago
No, but they were part of the PR blitz. The lack of real-world exploitation + Calif commissioning a fucking webcomic made me skeptical. That's not fucking normal. Given what a huge marketing stunt it turned into, and 1000 vibe coded PoCs that aren't PoCs, it was at least in the realm of possibility that Calif huffed their own vibes too hard. If you want people to take security risks seriously, making them into a media spectacle promoting OpenAI is not the way to do it.
[–] tptacek 2 days ago
What does Calif commissioning a web comic have to do with anything?
[–] anonymous908213 2 days ago
It, along with the press releases and the cutesy domain names registered, shows that this was clearly being played up as a marketing stunt, with planned coordination of such ahead of time. As soon as you begin to use the security incident to communicate a coordinated narrative about how amazing AI is, it's the most given thing in the world that some people will become skeptical of the severity of it and whether it isn't being played up as the most impactful security vulnerability ever found (per the press release claims) solely as part of an attempt to make the AI company sound more impressive.

AI company tells you their AI was used to find the biggest vulnerability EVER, with much fanfare. Zero cases of exploitation in the wild. Zero publicly demonstrated PoCs. It would almost be weirder to not be skeptical at that point unless you for some reason trusted everything a marketing department says implicitly.

> These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.

See also the parable "Boy Who Cried Wolf" for more insight into the human condition.