But the Dutch government websites do generally (I hope) have users, which is one of the ways the "I need to hit the same php worker, uninterrupted, for about 10 to 30 seconds while absolutely no other traffic hits the site AND I can isolate the one worker from the pool" approach to exploiting fails.
Luck is not a security boundary, they should patch their servers, everyone should. It's not a good thing to have shitty memory management on your server.
However, is this really that exploitable in real world conditions? (no)
"There does not exists" and "I've not heard off" are different things. This is motivated reasoning on your part to tell the story that this isn't a big deal.
Most variants require a few requests to infer some settings, and then they can spam their arming-stage, and then their exploit stage. Granted, its not quite as easy as that, but hitting _a_ worker twice on a server once is not all that lucky.
So according to you they could have just imposed an upload cap instead and been safe? If all the cybersecurity experts had given useful advice like that earlier in the week people could have been safer and less panicked.
The Dutch government websites that went down have multiple endpoints to upload files that do not have a 1MiB cap.
But the Dutch government websites do generally (I hope) have users, which is one of the ways the "I need to hit the same php worker, uninterrupted, for about 10 to 30 seconds while absolutely no other traffic hits the site AND I can isolate the one worker from the pool" approach to exploiting fails.
Luck is not a security boundary, they should patch their servers, everyone should. It's not a good thing to have shitty memory management on your server.
However, is this really that exploitable in real world conditions? (no)
"There does not exists" and "I've not heard off" are different things. This is motivated reasoning on your part to tell the story that this isn't a big deal.
Most variants require a few requests to infer some settings, and then they can spam their arming-stage, and then their exploit stage. Granted, its not quite as easy as that, but hitting _a_ worker twice on a server once is not all that lucky.
Also, 03:00 at night is not a busy time.
So according to you they could have just imposed an upload cap instead and been safe? If all the cybersecurity experts had given useful advice like that earlier in the week people could have been safer and less panicked.
That is quite literally what I said yes: https://news.ycombinator.com/item?id=50224916#50228891