Hacker News

points by syshyk 2 days ago | 0 comments

The main kickback was against the hype and it was "so easy for AI" and would take "15 minutes to compromise everything".

Either way, this was not true.

[–] vikramkr 2 days ago

It was true. The author had messed up the server and it was not exploitable. It was hacked within a couple hours of the author fixing it (even with the server being down) but the author had also messed up and not put the actual Bitcoin wallet in it so it took an additional 5 hours for them to fix that. It was a mess but the vulnerability was very real

[–] Tadpole9181 2 days ago

The author didn't even have an accessible PHP server at first. When they actually added one, it got cracked in 2 hours.

[–] jgalt212 2 days ago

yes, but 70% of the world's websites were (and many still are) accessible PHP server(s) that hand not been patched.

[–] milkshakes 2 days ago

also it was under hn load which makes this much harder

[–] NorwegianDude 2 days ago

HN load isn't exactly a high load for a server. The automated traffic was most likely much higher, but not high, as the server used the super slow single threaded php dev http server, so high traffic was not possible, everyone had to wait their turn.

[–] elysianfields 2 days ago

The vulnerabilities kinda rely on having to make quite a number of requests to exploit + can crash the process as I understood, so if many people try to force their way in at once 2h doesnt seems like a long timespan.

[–] r_lee 1 day ago

for the single threaded one it's easier from what I can remember