| ▲ | skrrtww a day ago |
| I dunno, the post is awfully critical of Chainguard for leaking a fixed binary 6 hours early, but it was the research firm "partner" that "mistakenly" posted the dancing anime POC video over 24 hours early that created the mass panic (not to mention spawning millions of agents crawling the php codebase and trying to brute force a POC and probably using more energy than a lot of countries in the process). |
|
| ▲ | john_strinlai a day ago | parent | next [-] |
| i keep seeing mentions of the video, but is it still available anywhere? |
| |
| ▲ | bcvvvy a day ago | parent | next [-] | | https://x.com/k_firsov/status/2112641845926989944 Song is Petite Meller - High Forever (Marlon Hoffstadt Remix). Which is annoyingly catchy | | |
| ▲ | john_strinlai a day ago | parent | next [-] | | wow, okay. yes, that really does look like a "my first PoC" video made by an early teenager. hard to believe that this was produced by a company that wants to be taken seriously. thanks. | | |
| ▲ | sippingabonedry a day ago | parent | next [-] | | If anything this is further justification for why these patches need to be kept under wraps. This industry is full of immature children who cannot keep their mouths shut for 24 hours. They have no clue what massive coordination this requires. | | |
| ▲ | yreg a day ago | parent [-] | | These 'immature children' have discovered the exploit, so good luck keeping it under wraps from themselves. | | |
| ▲ | numpad0 a day ago | parent [-] | | There do seem to be the perpetual problem with the field of computer security that only insufferable and immature kids matter, due to discrete math adjacent nature of computer science, and yet they also legitimately can't be trusted, or does it not... unless LLMs do change everything. | | |
| ▲ | kps a day ago | parent [-] | | The management class is certainly itching to ditch the remaining nerds. |
|
|
| |
| ▲ | bcvvvy a day ago | parent | prev | next [-] | | Any idiot can create their own company. For example, I have one :) | | |
| ▲ | unsnap_biceps a day ago | parent [-] | | they claim 60 full time employees | | |
| ▲ | leoqa a day ago | parent | next [-] | | All very well known security researchers with decades of experience. I agree the anime/song is unprofessional but somehow that stuff is normalized in security/hardware labs. | |
| ▲ | quietsegfault a day ago | parent | prev [-] | | Any idiot can work for any idiot that starts a company! |
|
| |
| ▲ | a day ago | parent | prev | next [-] | | [deleted] | |
| ▲ | b112 a day ago | parent | prev [-] | | I wish people would name this idiotic company, I can't see Twitter here and all people are talking about is a childish video they made. I don't ever want to do business with said company, ever. They're apparently not trustworthy, and behave as children. | | |
| ▲ | Hamuko a day ago | parent | next [-] | | It's Calif. They're named in the post. >As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues mistakenly published a video. It showed their proof of concept working against a number of targets and revealed a few additional, though limited, details about the vulnerabilities. You can see the same demo video on their site: https://calif.io/php2shell/#php-5-4-0-rce | |
| ▲ | john_strinlai a day ago | parent | prev [-] | | calif.io |
|
| |
| ▲ | numpad0 a day ago | parent | prev | next [-] | | That gif is a segment from Shukusei!! Loli Kami Requiem by Shigure Ui, the illustrator-VTuber-singer, FWIW... 1: https://youtu.be/Ci_zad39Uhw?t=15 | |
| ▲ | railgunmerlin a day ago | parent | prev [-] | | [dead] |
| |
| ▲ | cpa a day ago | parent | prev | next [-] | | https://media.infosec.exchange/infosec.exchange/cache/media_... | | | |
| ▲ | a day ago | parent | prev | next [-] | | [deleted] | |
| ▲ | a day ago | parent | prev | next [-] | | [deleted] | |
| ▲ | Hamuko a day ago | parent | prev [-] | | https://x.com/k_firsov/status/2112641845926989944 |
|
|
| ▲ | corford a day ago | parent | prev | next [-] |
| Agree. If I'm following along correctly, it seems Calif is really the one to blame not Chaingaurd. |
| |
| ▲ | yardstick a day ago | parent [-] | | Both are to blame. Calif more than Chainguard, but still Chainguard too. Calif was obviously twitching to claim credit for their findings, and what I find troubling is this eagerness was more important to them than giving users a chance to update their systems. Even if they ended up waiting only a day post release I would still say it seems a bit too soon. Maybe a week after. Not everyone’s system have aggressive patching schedules and PHP is soo heavily used. | | |
| ▲ | kjs3 a day ago | parent | next [-] | | This is probably the future, tho. Being first to disclose a vuln is a Big Deal in some quarters. And now, the velocity of AI driven pentest swarms mean every researcher who finds something worthwhile has to think "how close is the next droog's swarm to finding what I found" and the temptation to jump the gun only gets stronger. | | |
| ▲ | yardstick a day ago | parent [-] | | Yeah I completely understand the motivation. I just wish they were more pragmatic to the security risk vs building their reputation. |
| |
| ▲ | OrderlyTiamat 16 hours ago | parent | prev [-] | | I can't blame Chainguard for breaching an embargo which was already nonexistent at the time. If the embargo is broken already, they have a duty to their customers to upload as soon as possible. All parties have that duty, but it's better if they do that at the same time. ... That's why you have an embargo. |
|
|
|
| ▲ | bawolff a day ago | parent | prev | next [-] |
| The video has no usable details in it. It's maybe not professional to release an omg panic video, but not even remotely the same thing as what chainguard did. |
| |
| ▲ | dylan604 a day ago | parent | next [-] | | I don't know, it's showing most sites being pwnd in less than 20s with some taking just under 30s. Of course, that's on homeboy's local Mac. Not sure how long it takes to gain control with PHP2Shell to run the exploit though. Just started looking at that part myself | | |
| ▲ | bawolff a day ago | parent [-] | | So, just because they showed they can doesn't mean they showed how. I dont know why the timing of the bug is surprising to you. |
| |
| ▲ | numpad0 a day ago | parent | prev [-] | | there were security guys publishing inferred details from [INFO] messages, it did contain more than zero usable details | | |
| ▲ | bawolff a day ago | parent [-] | | Everything i saw on twitter prior to the release turned out to be incorrect. At most people figured out it had something to do with session upload handler and UAF, but nobody knew what. |
|
|
|
| ▲ | cubefox a day ago | parent | prev [-] |
| > but it was the research firm "partner" that "mistakenly" posted the dancing anime POC video over 24 hours early that created the mass panic They took it down but someone (Kirill Firsov:
https://x.com/k_firsov/status/2112641845926989944) added the anime stuff and reposted it. Totally irresponsible. Edit: okay he didn't add the anime, but he reposted it. |
| |
| ▲ | debugnik a day ago | parent [-] | | The company, Calif, has it with the music, effects and Ui Shigure animation on their own website and youtube channel: https://calif.io/php2shell/#php-5-4-0-rce | | |
| ▲ | tetha a day ago | parent | next [-] | | I think I'm too old for this industry I want to go back to talks by bored defcon guys or gals calmly stating how they obtained private keys of a globally trusted CA with just a bit of math. Which, mind you, ate the other part of the teams time. Now I know how much I hustled today likely due to that atrocity of a video. I think I will take a vacation day and sit in a forest near a river on friday. | |
| ▲ | fatty_patty89 a day ago | parent | prev | next [-] | | what's up with the obsession of these people with anime children? | | |
| ▲ | numpad0 a day ago | parent [-] | | dopamine junkies crave stimuli, and realistic details of humans are just noise for the data. anime humans are simplified to extremis which alone makes some people think it's about kids | | |
| ▲ | account42 13 hours ago | parent [-] | | There very clearly a fusion of kid-like and feline-like features. It's not just some people thinking that, be honest. | | |
| ▲ | numpad0 9 hours ago | parent [-] | | I'm fed up of "no way this Asian is over 20" culture wars. Every time I lock my devices in public people instantly get shorter by a feet and >20yo younger. I've seen some YouTuber prefacing an introduction (jokingly)with a disclaimer that the person they are collabing is not a teenager and in fact old enough to have kids doing math. The Internet criteria for not-kids might as well be a boilerplate as far as Asians are concerned - I think there might be a chance that industrial revolution in Europe demanded a strong facial features for lawfully hirable adults that Asia never required, or Asians were so generationally pedophilistic that the same feature was long selected out or something - but I'm not in the relevant field and this isn't SFW or suitable to HN so I'd shut up on this for now. |
|
|
| |
| ▲ | quietsegfault a day ago | parent | prev [-] | | good god that video is absolutely horrible. why is stuff blurred then the same blurred stuff is suddenly all visible? nothing changed. | | |
| ▲ | dylan604 a day ago | parent [-] | | it's called creative licensing. you can't account for taste though. |
|
|
|
