RE: https://hachyderm.io/@damienmiller/117563026759098135
This is a lovely time to do computer stuff:
“We are making this release as fast as possible (we learned of the problem yesterday) because we have recently observed multiple cases of rapid bug rediscovery by AI agents, sometimes within hours, and so now consider long embargo periods to be a dangerous practice that primarily benefits attackers.”
@palmin they’re saying that the online LLMs are leaking secrets between users, if I’m reading it correctly?
Flip side: it's nice to see a real sense of urgency. Maybe we can use it to light a fire under some behinds.
I've never been super comfortable with "I've found a critical bug, and reported it, and the vendor will get around to fixing it sometime in the next 30-90 days, don't tell anyone And I'm sure none of the bad guys actually looking for these bugs will find it."
In this particular situation, you need to still be using passwords to be vulnerable, among other things. If you are still doing passworded ssh - stop. Please. It's not been best practice for years. This is your sign.
@tbortels I had to take a time-out from my one-week vacation twice to brace myself from the eMudhra or PHP2Shell vulnerabilities.
I feel like there is already enough fire under my behind. 😅