Only 'parts' of their website are down currently (e.g. download pages, linked from the home page: https://obsproject.com/welcome-redirect returns a 502).

I thought they were down earlier, but apparently they were just pre-announcing being down in about 30 minutes, until they finish patching their servers.

I've seen a number of notifications on X and Bluesky of people taking their sites offline, though. Supposedly Cloudflare is providing all customers a WAF rule that will mitigate the exploits they've been able to see so far (though they mention, this is not full protection—patching is still required).

I don't know, have you done anything to impress them?

I'm using Remark42; some downsides but somehow, spam has not been a big issue for me. https://remark42.com

I've started using atproto as comments on my static blog:

https://sequoia.pub/comments

Which is why suggestions like OP’s are never useful or actually serious. I honestly consider them snobby. Like the person who tells you you really ought to check your engine oil, radiator fluid, and brakes everytime you get in a car. It would prevent some awful issues sure, but it’s not gonna happen for 99% of people.

Having static site generator still require an admin endpoint that end users can use to author, publish or otherwise manage the content. Pushing that to a local tool means now you need to somehow synchronize that content across all of the end users devices without git. Not to mention if there is no server side component that means the client needs to have full permission to publish content on the server. Until recently ssh was the only option. Maybe someone could vibe an iroh app that gives you a vpn'd server side app without that now.

Generate static pages from your content system. Even for wordpress there's some projects. If you need adaptations, AI should be helpful. You can sell this also to bosses: Delivery of static sites consumes drastically less resources.

That's not a problem - as long as the PHP scripts are not reachable by the general public you should be fine, generally speaking.

These particular vulnerabilities affect PHP scripts accepting POST requests as far as I've been able to gather so far.

You might want to use Cecil ( https://github.com/Cecilapp/Cecil )

It's a static web site generator, powered by php :)

A WAF can block known _exploits_ it doesn't prevent the vulnerability from being abused by a new / other / slightly changed exploit.

Ah, so you’re saying that proper orchestration was happening, it’s just that someone leaked it?

What platform hasn't had security issues?

Anyway.

CCB is overtly a marketing organization, not an IT security one.

IIRC they don't even host their own website, The Chancellery of the Prime Minister does it for them.

> I have to imagine the vast majority of normal developers do not give a damn about security in being in security patch lifecycles on software.

I just don't think it's the developer's responsibility.

Depending on the size of the team of course, but the work that developer's do comes from someone else. Empower me to make decisions and I'll make them, but don't blame me for the choices other people make if you won't empower me.

I've worked at a company that delivered on-premise software, and the runners of said software were... risk-averse, but in a strange way in that they didn't really want to upgrade software if it didn't need to. So the software was stuck on PHP 5.something, also because newer versions required a RHEL update which they also didn't like to do.

I feel like I'm reading a conversation between bots.

There's no such thing as PHP 6. There's no such thing as PHP 9.2.

Due respect, neither of those make sense. PHP is boring software, and this website routinely suggests (1) use it if it is fit for purpose and (2) don't rewrite for the sake of it. For most sites, the engineering effort to have a static backup of their dynamic website (say, generated by Wordpress or Drupal) just isn't possible. They just need to power down and patch.

[EDIT: I see I may have erroneously extended your criticism to sites other than NCSC, for which it does make sense. I would still defend using PHP.]

> Not all hacks are used to steal data

Sometimes, they just want to send spam. Ages ago, someone got a hold of our company's webserver and all they used it for was sending a ridiculous volume of emails. Our ISP spotted the traffic spike and pulled our server off the network.

Oh I absolutely agree they should take it offline until the fix is ready, I just mean that the NCSC itself is very much still operational even if their public website is temporarily offline. Like a computer with the monitor switched off.

Whoops, sorry, that's right. Thanks!

Why is this fix “scheduled” rather than ASAP?

Given their site is mostly static and currently getting a lot of traffic, wouldn't it make sense to have it mostly be static html?

bit the bullet, it is what you think it is.