Dutch National Cyber Security Center is Offline because it uses PHP

(So old.....)

The first site I put up professionally was a handrolled static generator written in PHP for a state website. Users just edited text files, triggered a rebuild, and then there was a sync to prod if staging looked fine. They could even add new sections by creating new subdirectories, and Imagemagick would automatically conjure new menu buttons and the code would put them in the right place.

> Pushing that to a local tool means now you need to somehow synchronize that content across all of the end users devices without git.

This is not hard. Rsync? Rsyncd?

> Not to mention if there is no server side component

Why would there be no server-side component? What does that even mean? Just give them a script to trigger if you don't want them to have permission to do anything. Give them another script to revert if you don't want to get any emergency calls.

This is not advanced technology. Weird to talk about it like it's impossible.

> never useful or actually serious

So strange. That site was so simple to deal with that it stayed up for a decade after I left. Ancient technology.

That's reducing things too far. "What car manufacturer hasn't had car crashes?" All cars are equally safe?

There's a vast difference between different languages and CMSs and how likely it is for critical flaws to occur. PHP has a horrible track record and continues to surprise us negatively.

That said, if they're software packages from something like Node or PyPI, I do think that it falls on the developer. If the point is that leadership needs to give devs the ability to act on that, that's very fair.

So I'd agree it isn't not a coder or developer's responsibility when they're given a bill of materials and told how to build, but it is an engineer's responsibility. Comp should recognize that as well.

When a doctor makes a mistake they get to practice medicine in Peru for the rest of their life.

Announcing when this patch is going to be released should leave a much shorter vulnerable window with the exploit out in the wild than releasing it immediately and hoping people update before they're a target.

So they need to give time for infra people in all different time zones to wake up, learn about the announcement, and plan how to patch it.

The intended course of action is 1. take down website a few hours before the fix drops 2. apply the fix 3. only make website public again after it has been fixed

Scheduled release gives the option to turn things off on a set schedule while applying patches.

e: turns out several people answered this. Whoops.