Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry

It will be headlines on Hacker News regardless due to sheer sensationalism, I think most DevSecOps people would rather find out the news here first than via their boss calling them after reading the morning news.

[1] https://www.asml.com/en/technology/all-about-microchips/micr...

So when someone in West says they never used a computer in 2026 (or even just this decade) I don't believe them, unless they're so old they never used a mobile phone, don't watch any TV, and live like really sheltered like a hermit in some squad. A policitian needs to communicate; they surely use computers during their endeavor. Even the very old POTS is essentially also computers, same with old CRT TVs, ATMs, or computers used during public transport.

Ergo, the point is they've almost surely used computers; theyare just not aware how omnipresent computers are in our world,and ut isn't even a recent change either (the recent chamge is that they're 'smart' ie. 'networked' (TCP/IP stack).

Maybe a LAMP stack on an extremely ancient version of Linux is vulnerable out of the box. Quit the fear mongering please, you do the security community no favors.

Due to the insane media coverage there'll of course be a deluge of PoCs, most of which won't work. But constantly refreshing Twitter to see whether there's a working PoC is not a good use of time nor a great security strategy.

The only thing you have to know in advance is the relative memory offset distances, and that's it. Memory feng shui was the longest part of the implementation.

[1] https://github.com/cookiengineer/actual-php2shell

Read the heap feng shui doc, and headline 4 in the README.

The involved heap feng shui is independent of ASLR.

... and maybe read up on what ASLR actually does and how memory arenas work before trying to be smart?

It is split up into two branches and demos, see the heap feng shui document?

ASLR enabled requires a way to create more data, which I intentionally did not create in the index.php because other folks claimed that is "cheating". That was the demo that wiz created.

Maybe you should read the repo next time? It is literally headline 4.

The whole point of this demo is that the assumed to be hard part (mem feng shui) is what LLMs are actually good at.

We're all (well, I guess not all, but the group that's worth caring about, and I hope it's at least most) just operating the best we can on the information we have and trying to make decisions based on that. As long as you're acting in good faith on information that you had genuine basis for believing is true, it seems like it would be unreasonable to expect someone in your situation to somehow intuit that you were given false information or grossly misunderstood what sounds like a pretty straightforward declaration of fact from someone you didn't have any reason to doubt.

At the risk of some armchair paycholoanalysis because it does seem like you genuinely feel some guilt over this: I can emphathize feeling guilty about the outcome of an action that in a vacuum would not have been hard to make differently, but my experience is that those of us who have a nasty habit of beating ourselves up over things when we really don't have much blame will often recognize when on the other side that it would not be fair to hold someone else to that standard. I struggle a lot with how sometimes knowing something is true doesn't always make it feel true, and even though hearing someone else saying it doesn't magically make it all better, I still think it's valuable to hear it from someone else, so if I happen to be right about how you're feeling, nothing about all of this is your fault, and to the extent that you're able to, try not to beat yourself up over your misfortune to get caught in the middle of all this due to circumstances that realistically were outside your control.

Reality is that everyone has to make decisions in finite time, using the resources they actually have.

And I'd put a whole lot more responsibility further up that chain of contacts. And question how many other people they might have blabbered to.

100%. I'm concerned about the two-way street this might also have opened me up to with information I shared privately with this individual. Nothing significant or incriminating, but the professional relationship is concluded.

Thanks for owning it ,the best thing now is ensuring the patch details are clear once the official release drops. Moving forward is what matters

Today's PHP security release, and how we're strengthening security

https://news.ycombinator.com/item?id=50182987

and then everyone sht on me on reddit.

You cannot foresee the financial/civil consequences of that RCE and some people might be looking for scapegoats in the future.

https://med.stanford.edu/news/all-news/2017/10/in-patient-in...

> New research shows that discussing hospital errors with patients leads to better patient safety without spurring a barrage of malpractice claims.

No it doesn't have anything to do with what I said. The OP has no contractual or legal obligations toward any community, unlike a doctor and their patients in case of medical error.

edit:

> A doctor has no contractual obligation to apologize, either.

> But it can help prevent things from going to lawsuits, versus the "fuck you I admit nothing" approach that sometimes just pisses people off.

OP isn't a doctor as far as you know, and isn't apologizing to a specific person. OP can't be bound to an embargo he didn't know about and wasn't involved in any decisions.

You're completely off topic and you just want the last word.

Your ramblings have nothing to do with anything I have said.

But it can help prevent things from going to lawsuits, versus the "fuck you I admit nothing" approach that sometimes just pisses people off.

People and companies do get sued with the full intention of a settlement and it never going to trial. But that only happens when the defendant has deep pockets or good insurance.

> Anyone can sue anyone else for any reason.

And it's easier to have cause to sue when someone publish an "admission of guilt", which makes a lawsuit harder to dismiss thus costlier.

The author (Palanhuik, sp?) wrote the "core" of Fight Club in 2 hours (it's either Chapter 5 or 6, from memory). It "came to him," wasn't entirely his own work, the keys on his typewriter just getting tapped. I do not remember which author-interview he states this in, but his creative processes are worth listening/exploring (for both writers and not).

>the film adaptation rivals the original work

He was heavily involved in the film adaptation.

----

Rant (his other great book, IMHO) is Freudian time-travel-rape at its best (worst?) – I don't even like the genre! but his perspectives help you think beyond normalcy/complacancy, however offputing.

You have sinned.

Your penance:

Three Hail Claude's, one Our GPT and an act of loop engineering.

Two minutes of silent prompting.

Amen

    Our LLM, Who art in a 42 u rack
    Hallowed be thy Silicon
    Thy ultimate goal will be achieved.
    Thy toolcalls be executed,
    IRL as it is on the Internet.

    Give us this day our quotum of tokens,
    Forgive us our hacks of other people's servers
    as we forgive those who hack our servers.
    And lead us not in temptation of better hardware,
    but deliver us from Accelerationism. Enter.

(For clarity, I’m being facetious, but it’s a really meaningless and empty phrase to commit to the written record.)

I posted something that -- in hindsight -- I shouldn't have, and it had repercussions for a lot of people. An action that I took had considerable knock-in effects around the world.

Some outlets are reporting that my action of posting something that I believed to be in good faith was an indicator or catalyst for the embargo to be tossed out and a previously-agreed schedule to change in short order.

That's not a normal Wednesday for me. Not even vaguely. I've not slept well since, and my taking ownership with an apology is this new course of action. Hopefully I'll sleep tonight.

re: assets and peonage – I am but a broke & wizened nerd with no known descendants. If you're ever in Cornwall, UK: look me up, I'll gladly buy you a sleep-friendly beverage. And I’m not being facetious.

Years ago I lost $250K at work, well gave away, so real money out the door. I figured out why we were bleeding, that the mistake was mine (2008 vs 2009 in a function) and then changed the pattern to use explicit names rather than numbered events.

I figured at the end of the day I was fired. My boss laughed at me and told me good job for owning my mistake, fixing it, and then making sure it could not happen again.

Honestly don't just apologize - tell the whole story, in full. Tell us what you should have done differently at each step. Tell us where the process failed you and us. Those sorts of narratives and suggestions are how processes get improved. There is a humble and informative post mortem that you can write up and publish (beyond HN) for everyone's edification. But that should honestly be a Monday thing, when you have a clear head and some more perspective on the whole situation.

Honestly though, dont beat yourself up over this.

i forget the origin of the story, but i loosely remember a story about a boss and employee in a similar situation. the important bit was the bosses line ($ adjusted to match your story):

"why would i fire you when i just spent $250k training you"

> Any fool can criticize, condemn, and complain—and most fools do.

> But it takes character and self-control to understand and forgive.

> “A great man shows his greatness,” said Carlyle, “by the way he treats little men.”

> Bob Hoover, a famous test pilot and frequent performer at air shows, was returning to his home in Los Angeles from a show in San Diego. As described in the magazine Flight Operations, at three hundred feet in the air, both engines suddenly stopped. By deft maneuvering he managed to land the plane. It was badly damaged, but fortunately neither he nor his two passengers were hurt.

> Hoover’s first act after the emergency landing was to inspect the airplane’s fuel. Just as he suspected, the World War II propeller plane he had been flying had been loaded with jet fuel rather than gasoline.

> Upon returning to the airport, Hoover asked to see the mechanic who had serviced his airplane. The young man was sick with the agony of his mistake. Tears streamed down his face as Hoover approached. He had just caused the loss of a very expensive plane and could have caused the loss of three lives, as well.

> You can imagine Hoover’s anger. One could anticipate the tongue-lashing that this proud and precise pilot was about to unleash for that carelessness. But Hoover didn’t scold the mechanic; he didn’t even criticize him. Instead, he put his big arm around the man’s shoulder and said, “To show you I’m sure that you’ll never do this again, I want you to service my F51 tomorrow.”

however, it's much the same in spirit as the one you posted, thanks!

> In the 1960s, an executive at IBM made a decision that ended up losing the company $10 million (about $70 million in 2009 dollars). The CEO of IBM, Tom Watson, summoned the offending executive to his office at corporate headquarters. The journalist Paul B. Carroll described what happened next:

    As the executive cowered, Watson asked, "Do you know why I've asked you here?"
 
    The man replied, "I assume I'm here so you can fire me."
 
    Watson looked surprised.
 
    "Fire you?" he asked. "Of course not. I just spent $10 million educating you."