Even Z

Coding is the equivalent of magic in the modern world. #SoftwareEngineer #DevOps #Cloud #AWS #Docker #InfoSec Opinions are my own

[Even Z @evenzdev]

Excited to announce that I will be presenting 'Demystifying #AWS Security Services' at #DDDPerth 2019. If you have always wanted to learn about AWS security services, come along and join me on Saturday the 3rd of August at Perth Convention Centre!

[⁵⁄₉ @fiveoutofnine]

So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and https://t.co/QlOXb3COq3 went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.

[Mitchell Hashimoto @mitchellh]

Beware people obsessed with outcomes instead of building outcome machines. Its worse than ever with AI, but these people existed before. Short term results above all else, etc. Don't fall into the trap. Invest in building strong fundamentals, invisible supports, and outcomes flow like water. An outcome machine.

[Mitchell Hashimoto @mitchellh]

Good moment today to remind everyone to stay frosty with AI. I was working on making a server stoppable via the CLI, and Codex decided the best path forward was to implement an unauthenticated network API to every server to shut itself down. Excellent work.

I responded with "I don't know about that." (I usually give more direct feedback but this was so absurd) and it thought for like 20 seconds and responded "Server stopping should not be part of an unauthenticated network API." Yes. lol.

By the way, the result I was looking for was that we automatically start a locally discovery Unix-socket bound server so I wanted it to discover that (using prior mechanisms already made) and gracefully stop that.

The driver is absolutely accountable here (me). My lazy prompting led AI to think I wanted to be able to stop ANY configured server I was talking to. Shame on me for thinking it was obvious here. But, I also reviewed it and found this idiocy, so, that's where good AI drivers come in. Also me.

[ClaudeDevs @ClaudeDevs]

As a result of a US government directive, we are suspending access to Claude Fable 5 for all users. You can continue to use all other Claude models.

Here’s what this means for you:

Across Claude products, new sessions will run on your selected default model or Opus 4.8, and existing Fable 5 sessions will end with an error.

On the Claude Platform, requests to Fable 5 will also return an error. Please update your integrations to other Claude models.

We know this is a disruption to your workflows; we appreciate your patience and support.

[NSW Police Force @nswpolice]

There have been NO reports of any incidents at Dover Heights - please do NOT share unconfirmed rumours.

Further updates will be provided here.

[Werner Vogels @Werner]

After many years at @amazon I can tell you that @ajassy is the absolute best person lead the company. More customer obsessed than any other leader I have met. #stilldayone https://t.co/NQXXnrbGur

[peter skillman 🇺🇸🇺🇦🇳🇱 @peterskillman]

Question: What do you dislike about using AWS, and what should we prioritise fixing? We care and our design team is passionate about improving your experience.

[Even Z @evenzdev]

@Don_IsGood @LatencyConf @gigaflare

[Even Z @evenzdev]

@GeoffreyHuntley @troyhunt something to talk about this Friday?

[Adriana Porter Felt @__apf__]

I figured it out - I let someone use my computer, and they installed a shady extension (which was later deleted). Siiiiiigh. Moral of the story: never be nice. (Real moral: use 2FA, which saved my account :)

[Richard Clarke @rsclarke]

https://t.co/AxrLXRW7pW @CircleCI Security incident. "We can confirm that absolutely no CircleCI user secrets, build artifacts, source code, or any other production data was accessed or exfiltrated during this incident. "

[Molly Struve 🦄 @molly_struve]

In case anyone was wondering, you can be introvert and still give conference talks

[Trent Jones @DakarRally]

Subtle joke from @evenzdev while demistifying @awscloud security @ #dddperth

[Tim Cook @tim_cook]

Kyoto Animation is home to some of the world’s most talented animators and dreamers — the devastating attack today is a tragedy felt far beyond Japan. KyoAni artists spread joy all over the world and across generations with their masterpieces. 心よりご冥福をお祈りいたします。

[CNN @CNN]

Alan Turing, the World War II code-breaker who introduced the basis of modern computing and was castrated for being gay, is the new face of Britain's £50 note https://t.co/wnAbVBBesj

[Matt Klein @mattklein123]

Focus on creating customer value and keep things as simple and boring as possible for as long as possible.

BUT, if you are lucky enough to find success, your development team will grow, you will end up moving to SoA, and then the 💩 will hit the fan:

[DDD Perth @DDDPerth]

🗳 Voting is OPEN! 🗳

We have 181 submissions this year of AMAZING quality. It's time to shape your ideal conference!

Voting is open until June 16 - you know that week will fly by, so start shortlisting today!

https://t.co/OpebjKSCR6