Post

“why wouldn’t the internet archive be using the latest php” probably the same reason my sonos speakers are like a decade old, they get the job done and would expensive and laborious to update and i am not a billion dollar company

“why not just take the site down to make updates instead of using ai” there was no official patch for old versions because even the the latest version fix took a long time. the company that broke the disclosure embargo even said “It really did take them months to build a real, working patch for it.”

if the internet archive went down for months, that would be catastrophic for them as a non-profit and honestly i believe our online society

when it comes to mitigating abuse online, you have to meet the match of the abusers at their tooling and that tooling today is ai. ‘All it took was a “basic prompt of ‘find bad vulnerabilities in PHP,’” Lorenc wrote in a subsequent LinkedIn post.”

theregister.comPHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk'Coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild,' Chainguard CEO tells The Reg

3 reposts35 likes

this isn’t making a yard sale flyer, writing a sci fi book, or putting bikinis on people, this is working as fast as possible with the legal tools available to race bad actors against the clock to protect people

instead of telling people who are pissed about ai being used to mitigate these vulnerabilities that they ‘just don’t understand’, help them understand. i just displayed how easy it is to explain what’s going on. you can even just repeat what i said if you want. if they scold you, mute and move on

people should be challenging ai use! it’s understandable that they are pissed, they likely don’t have all the context/info needed to work nuance into their framework for addressing ai usage around them. they are not the bad guys, nor are IA. the people attacking sites knowing this vulnerability are.