In 2004, someone wrote about a PHP bug on Bugtraq. It sat untouched for 22 years. This August, a researcher fed that old idea to a model. Six weeks later, a patch was out.
What really changed was the cost of finding vulnerabilities. There aren't any more people fixing them.
On October 21, PHP's official team disclosed two vulnerabilities, rated 9.2. No login required to plant code on a server. The default mod_php configuration was the worst: before your code even ran, theirs had already run—and you might not even have had time to glance at the logs.
The official team said there was no complete mitigation. CISA said to take systems offline if they couldn't be patched. Government websites in France, Germany, and the Netherlands really did shut down.
The patch touched 300 files and added 10,759 lines, more than 4,800 of them tests.
The Foundation admitted it: the delay was a structural failure, half process and half money. The team worked by consensus, and nobody dared make the call.
I believe that wasn't just modesty.
The people who write the core get no pay.
The people who find vulnerabilities get bounties, extortion money, and data.
What do you expect? It wasn't that nobody saw it for 22 years. The people who saw it had no incentive to do anything.
The real danger is weaponization. It used to take weeks to go from finding a vulnerability to writing an exploit, and defenders relied on those weeks to patch. Now models read through the night and turn out an exploit in a few hours. Those few weeks?
Gone.
That 70% figure only counts sites where the server-side language can be identified. Among servers that report their version, unsupported branches outnumber supported ones three to one.
The internet's security depends entirely on that one thing: patches.
There are none on-chain.
Contracts on $ETH are set in stone once deployed. Get it wrong, and it's wrong forever. $BTC had a fatal overflow in August 2010; within hours, the rules were changed and the chain rolled back.
The only ones who can pull the plug are exchanges. When $COINB faces a major incident, it does just one thing: halts deposits and withdrawals.
Every authorization you've ever clicked on-chain is a promise that nobody can patch things for you. Those few seconds after you click confirm are your entire patch window.
PHP has a foundation and people from big companies working on it. It made it through this time. But what about some obscure dependency nobody is watching? The same vulnerability, and who's going to fix it? Everyone uses it, but nobody pays. There's no telling how long it can hold out.
What matters isn't the vulnerability number. Any system designed around the idea that “we can fix it later” will fail on the day nobody fixes it. Free maintenance will always be a step behind attacks that pay.
Bitcoin is now at 80,441, down 0.46%. Ethereum is at 2,336, down 1.5%. Weekend, light volume.
#比特币 #美股 #币安广场
What really changed was the cost of finding vulnerabilities. There aren't any more people fixing them.
On October 21, PHP's official team disclosed two vulnerabilities, rated 9.2. No login required to plant code on a server. The default mod_php configuration was the worst: before your code even ran, theirs had already run—and you might not even have had time to glance at the logs.
The official team said there was no complete mitigation. CISA said to take systems offline if they couldn't be patched. Government websites in France, Germany, and the Netherlands really did shut down.
The patch touched 300 files and added 10,759 lines, more than 4,800 of them tests.
The Foundation admitted it: the delay was a structural failure, half process and half money. The team worked by consensus, and nobody dared make the call.
I believe that wasn't just modesty.
The people who write the core get no pay.
The people who find vulnerabilities get bounties, extortion money, and data.
What do you expect? It wasn't that nobody saw it for 22 years. The people who saw it had no incentive to do anything.
The real danger is weaponization. It used to take weeks to go from finding a vulnerability to writing an exploit, and defenders relied on those weeks to patch. Now models read through the night and turn out an exploit in a few hours. Those few weeks?
Gone.
That 70% figure only counts sites where the server-side language can be identified. Among servers that report their version, unsupported branches outnumber supported ones three to one.
The internet's security depends entirely on that one thing: patches.
There are none on-chain.
Contracts on $ETH are set in stone once deployed. Get it wrong, and it's wrong forever. $BTC had a fatal overflow in August 2010; within hours, the rules were changed and the chain rolled back.
The only ones who can pull the plug are exchanges. When $COINB faces a major incident, it does just one thing: halts deposits and withdrawals.
Every authorization you've ever clicked on-chain is a promise that nobody can patch things for you. Those few seconds after you click confirm are your entire patch window.
PHP has a foundation and people from big companies working on it. It made it through this time. But what about some obscure dependency nobody is watching? The same vulnerability, and who's going to fix it? Everyone uses it, but nobody pays. There's no telling how long it can hold out.
What matters isn't the vulnerability number. Any system designed around the idea that “we can fix it later” will fail on the day nobody fixes it. Free maintenance will always be a step behind attacks that pay.
Bitcoin is now at 80,441, down 0.46%. Ethereum is at 2,336, down 1.5%. Weekend, light volume.
#比特币 #美股 #币安广场
