Welcome home! Please contact lincoln@icrontic.com if you have any difficulty logging in or using the site. New registrations must be manually approved which may take several days. Can't log in? Try clearing your browser's cookies.
DOWNTIME — IMMINENT! [edit: now in the past!]
Linc
Site ownerDetroit Moderator
I am taking the site offline for emergency maintenance. I will put it back online as soon as possible, but it may be later this week.
2
Comments
Hello friends, apologies for the site being down without much warning for a long weekend. There is a critical vulnerability in PHP, the language that runs the software we use, and a patch was released last Wednesday. Releasing the patch necessarily also explains the vulnerability to would-be attackers (they can see what code changes you made), and there was a widespread fear that "AI" assistance would allow folks to begin weaponizing it immediately.
On top of that, this particular vulnerability had particularly severe consequences, including completely taking over the server and leaving little trace it had happened. Finally, our webserver is woefully out of date on software — so much so that I couldn't even apply the patch without upgrading the underlying operating system (Ubuntu Linux).
Given all those conditions and non-instantaneous replacement options, I elected to take the site offline to protect it.
The situation has evolved since then, and I know longer believe there is an imminent threat to the server. It's a difficult exploit, and "AI"-based automations have largely failed at weaponizing it. For more technical information, this is a good summary & signpost pointing to more sources and context: https://www.garfieldtech.com/blog/php2shell
So, for now, we are back online, unchanged, while I work on the replacement server with higher priority. Based on my experience, I believe this is the best balance of risks for our community. You are of course welcome to share your own views here, or ask questions.
I'll let you know when I have a more concrete plan for switching. I'm sort of "boiling the ocean" for my first major server admin excursion since the 10s so I'm taking the opportunity to do some research and find a solution that I believe is sustainable for another decade.
Any time I use the term "AI" I feel obligated to remind folks it's simply advanced autocomplete with a poorly-built software wrapper around it to somewhat control its output. More accurately, it's a Large Language Model (LLM), which is based on machine learning (ML), a well-documented field, which is just a fancy way of calculating a complex set of probabilities that are useful. LLMs just scale them up to every copyright & IP infringement they can commit by incinerating billions of dollars & crippling the open web to speed it up with scaled, automated theft.
It cannot actually learn, rationalize, make decisions, or even generate anything outside mashups of its training data. It ain't scary, it's just an annoying black box that seems particularly good at tricking vulnerable people into anthropomorphizing it. The only scary part is how folks choose to interact with it.
Hi Linc,
You, as you know, are not the only site/person who had to go offline because of this annoying worthless scam, data theft malware, whose bubble is being burst and culpable human operators being exposed as techno-bro international criminals.
I seem to remember you are on Mastodon. Good advice on there, on how to update as you know. None of the up to date Mastodon servers I use went down.
Good luck with upgrades.
https://joinmastodon.org/servers