PSA: the hackers are already in the house¶

Been watching an excellent video by Carl Brown on the PHP CVEs and other cybersecurity topics that made the mainstream news today. He points out, amongst other things, that Critical CVEs are not all that rare. PHP has had many over the years and so have other programming languages, libraries, and tools we work with all the time. That these things make the mainstream news, he attributes to the link with the AI hype and paranoia.

He also points out that AI-related hacks tend to become known because AIs don't cover their tracks, which professional hackers do. So, when they trample all over the place, is that worse than a hacker quietly sitting on your network, exfiltrating data and stealing credentials, then widening their access?

What this should remind us all of is that we should pay much more attention to the real risks and, to come to my point, for many of us that is not hackers but the business practices of companies we are forced to do business with. Not literally forced to but it is pretty much unthinkable that we ban them from our lives. I still have a Google account that I would love to shut down but, guess what, I cannot even use the school's absence reporting form without having an account. I still have a Facebook account because... You get the idea.

This is not even mentioning how manufacturers are spying on our everyday conversations, all part of the "service" they provide. We are not just leaving the stable doors open, we lure the horses out with carrots, then set the place on fire. I was going to write that we should all calm down about the PHP CVEs but am not sure if we should instead freak out.

One thing I know for sure, I will introduce Cybersecurity Fridays from now on where I turn off some crap I don't need, delete data from cloud services, patch a computer that was left alone for too long, or take some other sensible measure. If the PHP CVEs are mainly remarkable because they are some of many, many vulnerabilities that we have to live with, then taking small but routine actions on cybersecurity is the only sensible thing to do. Maybe next Friday I go to my local "buy nothing" group or the local recycling center and try to snag another really old TV set in case ours ever breaks.