For what it's worth, I am writing this article because I have not much, but some skin in the game, mainly under the form of this blog. Other than that, all I can say is that, despite the fact that I don't particularly like it when I'm right, nor itself the fact that I am, I did fucking tell you so, didn't I?
Thirteen years ago, give or take a few months, I created this blog mainly on the grounds that I wanted to get away from the complexities of the so-called Linux/Apache/MySQL/PHP (abbreviated as LAMP) stack, where for the record, MySQL and PHP were the top contenders for unrequired complexity. MySQL because, why does a simple web log site require a specialized database system when the filesystem is a stone's throw away1. PHP because it's a shit language for the most part -- I would add today: just like the rest of 'em -- and that the main content management system on top of it, Wordpress, is a pile of garbage that comes with most of the things that I don't need, along with a very select few that I do.
Meanwhile, the blog went through three (3; III!) software stacks: some Haskell-based static generation framework that I got rid of once the environment got on my nerves; followed by a Lisp program written from scratch for the most part, which was by far one of the most reliable software artifacts that I wrote. Then, around 2019 I went through a whole foray into dynamic webpage generation, basically an attempt to rewrite the useful parts of Wordpress, i.e. comments, in Lisp. This attempt failed, and it was about this time when I took the strategic decision of moving back to Wordpress, or rather MP's version, that wasn't plagued by the usual Microsoftisms such as automated updates and whatnot.
It's been seven years since that last migration and what can I say, the whole joint works, warts and all. So when the 20th of October came, it was quite a surprise to find out that it wasn't even Wordpress per se that was compromised -- in fact, whaddaya know, MP-WP itself is rock solid despite the PHP horrors that befell most of the web back in those days2. So when all is said and done, I did my share of the work to plug all the known holes, and... so far so good. Only that it's not "all said and done", and when the next php2shell comes, I'll just regress back to static pages; and when httpd2shell comes, I'll get really pissed and throw it all into the proverbial garbage dump, 'cause computers suck and avoiding them has become a virtue by now.
Which brings me to the second part of this article, which I'll commence by remarking that web sites are today the most economically-efficient means of maintaining a public presence. Let me be clear: by "web site" I do not mean "Facebook page", "YouTube channel", "LinkedIn page", "Twitter profile" or whatever. Although all of these are technically web sites, they're way too loaded with extra baggage to compete with an actual plain HTML web site, and your presence there depends on your "agreeing to the terms and conditions".
Sadly, however, I foresee a future when this will no longer be the case. Just like yesterday's privately-hosted email servers are nowadays a liability and everyone uses Yahoo or whatever, so may tomorrow's web servers become one. Granted, I may be wrong and Apache, nginx et al. have been subject to stricter scrutinies than PHP. Or maybe Linux lacks subtle bugs in some of its common syscall implementations, say, recvmsg, that would allow attackers to take one step from TCP code into some otherwise hidden subsystem. It's all ifs and maybes, but for all we know, ifs and maybes could just as well go the opposite direction, y'know, so without jumping to any conclusions, allow me to exhibit a healthy dose of pessimism on the matter. And since we're here: I am trying to figure out the next steps in this game, but the more I think about it, the more I believe that the information asymmetry of this game of "security", coupled with the state-space search capabilities of LLMs, tend to skew the game heavily in favour of the attackers. So if I'm right, then it's going to be cheaper than ever to exploit web sites, and more expensive than ever to defend them, which will make Facebook, YouTube et al. into even more of a protection racket than they are today.
But anyway, let's hope that this time I'm wrong.
-
In case it wasn't painfully obvious, the so-called "filesystem" is just another database system, like the rest of 'em. ↩
-
I don't even want to go into any of the details. What do you want me to discuss? That the whole thing was a communication fiasco from the so-called "community", which was hoarding intel under the guise of "responsible disclosure"? Or do you want me to go into how the vulnerable code lied dormant for about fifteen years? and that no, I won't update PHP to 8.4 or whatever the fuck.
The only useful thing that I got from this was yet another reconfirmation that the whole stack, from hardware up to the highest point, is full of these little nuggets that are waiting to be discovered. And it's only a matter of time until your average LLM finds the next ones. Well, let me tell you, I'm not about to spend every day patching systems for this or that vulnearbility. ↩