Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

blog.phpfog.com

Post reply on HN
Print view View original

21–30 of 202 posts

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#21

Post by sriramk »

citricsquid wrote: post #13

I mentioned this last time, but I don't think anyone was interested, but the "John" guy is compwhizii (same handle on Twitter) who runs the forums (facepunch.com) for garrysmod, a very popular game. I will be curious to see how garry (owner person) responds to this, or if he already has. Elliot is apparently VERY scared and blames John (compwhizii) (edit: not john, he blames someone else called supersnail1): http://w…

Reading through those forum posts, I have less and less sympathy for these guys.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#22

Post by bmelton »

geekfactor wrote: post #14

"We have hired professional white hat hackers with government level security experience to attempt regular pen tests on our system..." I guess whenever I read this kind of statement from now on I'll be thinking of HBGary and chuckling a bit inside.

At the risk of that comment being taken as a joke, I've done a lot of work with the federal government, and I can assure you that while the level of hilarity that HBGary has generated, the typical level of talent in government cleared individuals is not necessarily great.

I don't mean to impune the capabilities of the people involved (I don't know who they are,) and it isn't to say that you can't find some AMAZING talent in the government realm, but as in all fields, it's the exception, not the rule.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#23

Post by skeletonjelly »

mikey_p wrote: post #15
svlla wrote: post #12

php... a language by amateurs, for amateurs. phpfog... a service by amateurs, for amateurs.

Your argument could also apply to the Linux kernel.

I know the point you're trying to make, but it's a weak one.

75% of the kernel is written by corporate employees.

http://apcmag.com/linux-now-75-corporate.htm

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#24

Post by tzs »

Wait...their model is an EC2 instance per customer? The normal limits Amazon imposes are 20 reserved or on-demand instances and 100 spot instances per region. You can request more, but will Amazon really accommodate a one instance per customer model?

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#25

Post by tjarratt »

Aaronontheweb wrote: post #3

Goes to show you why the DRY principle (I might be stretching that analogy here, but bear with me) is important here - if you have old stuff lying around in production that was cloned a long time ago, you might forget about it and open yourself up to unfortunate incidents like this. PHP Fog is doing great work to make the PHP ecosystem easier to work with, and I hope they didn't suffer too much from this mistake.

Still stretching the analogy, but the same could be said of their password reuse.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#26

Post by jasonwatkinspdx »

tzs wrote: post #24

Wait...their model is an EC2 instance per customer? The normal limits Amazon imposes are 20 reserved or on-demand instances and 100 spot instances per region. You can request more, but will Amazon really accommodate a one instance per customer model?

Amazon is happy to. The limits you cite are merely the point at which you need to have a conversation with Amazon staff. They are quite happy to accomodate _much_ heavier usage from customers.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#27

Post by hitonagashi »

pdenya wrote: post #2

What a crazy story. If the timelines are accurate there was an extremely small chance of this happening. Bad luck all around. My site is still down, guess i'm in the unlucky 1%.

You don't hear about the 99% of the attempts that were successfully foiled by good coding practices/security audits, so given that we are hearing about a security breach at a competent firm, the likelyhood of it being a black swan event is probably fairly high.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#28

Post by greendestiny »

pdenya wrote: post #2

What a crazy story. If the timelines are accurate there was an extremely small chance of this happening. Bad luck all around. My site is still down, guess i'm in the unlucky 1%.

Yeah but the problem with 'things planned for the near future' is that they have a tendency to stay in the future until something like this happens.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#29

Post by mikey_p »

tzs wrote: post #24

Wait...their model is an EC2 instance per customer? The normal limits Amazon imposes are 20 reserved or on-demand instances and 100 spot instances per region. You can request more, but will Amazon really accommodate a one instance per customer model?

I've always assumed that the limits are there to make sure that no one can order 1000 instances and pay with a bad/stolen credit card. In other words, if the customer does a dine and dash, how much are we willing to lose?

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#30

Post by mikey_p »

skeletonjelly wrote: post #23
mikey_p wrote: post #15

Earlier quoted context omitted.

Your argument could also apply to the Linux kernel.

I know the point you're trying to make, but it's a weak one. 75% of the kernel is written by corporate employees. http://apcmag.com/linux-now-75-corporate.htm

True, I don't know what percentage of contributions to PHP are made while in employee of a corporation funding said contributions, but there are commercial supporters of PHP out there. I'm surprised how few people don't know that Zend exists.

The original comment just struck me oddly because I've come to assume that a large portion of the software that I use regularly was originally developed as an amateur project, or by amateurs.

Post reply on HN