> So why was everyone so scared?

I think this section misses the mark.

The biggest problem is that for a good 12 hours nobody knew what was going on. All we knew was there is a critical vulnerability affecting all of us that allows RCE somehow and we have to have vulnerable servers open for potentially even longer.

Everyone who knew was being hush hush, only chiming in to say "nah, those workarounds don't work, you're fucked".

So when people started spreading rumors of PoC or when the Cloud flare CTO posted that they were actively seeing exploit traffic - what are we supposed to do?

We aren't sitting there trying to PoC with Claude - we're subscribing to a bunch of news feeds and twitter accounts while we try to prepare for the patch and close down what we can. We're calling executives saying "hey, how much money do we lose by being offline for 6 hours?"

So even if this isn't as easily exploitable as first believed, no one could have known that, because those with the ability to calm us down were seemingly choosing to stoke the fires.

This is (IMO) a failure of the potentially outdated disclosure system that's supposed to protect us. And at the very least a trial run of how the world may react next time, if it really is that bad.

▲

thomasfromcdnjs 4 hours ago | parent | next [-]

Yeah, I suggested to take down the app someone between seeing the Gina (core) comment (saying php.ini etc changes won't do anything) and after seeing the Cloudflare CTO tweet.

▲

fwlr 2 hours ago | parent | prev | next [-]

IMO it is a little bit silly to describe “a system that works well until it intersects with a trillion dollar company’s PR campaign” as an outdated failure.

▲

malfist an hour ago | parent [-]

Or perhaps, trillion dollar companies should be more responsible. Either because they fear regulation that will force them to be responsible, or because there is regulation that will make the responsible.

	▲	fwlr an hour ago \| parent [-]
		I agree. At present I do not see any set of incentives, meta-incentives, etc., that are extant, or even rigorously imaginable[0], that will lead to such a state of affairs. 0: credit to Xenosystems for this excellent phrase

▲

Celeo 3 hours ago | parent | prev | next [-]

Very well said. Even for non-sensitive stuff that I was told was "super vulnerable", I didn't know if this was a full, actual RCE - some places said yes, others no. Did I need to take down everything running PHP? Just the apps dealing with data I didn't want leaked? Etc.

The rather long delay in getting official Docker images didn't help; we were told "patch now!!1!!" but that apparently meant building from source.

▲

lgl 3 hours ago | parent | prev [-]

Great reply, this hits the nail in the head and is pretty much exactly how I spent my day. Just reading, waiting and stressing while being essentially in the dark about the whole thing.

I'm assuming the next few days will probably confirm if this was mostly FUD or not.