At the moment I'm arranging a clean machine so a clean copy of the site can be uploaded, then have the most recent content re-added, then go live. Little details like "what modules" are so not on my radar: The new site will have the same modules the old one did, restored from a trusted backup. Anything else is Not My Problem at the moment.
Drush is a command-line utility for managing drupal sites. It lets you download modules, update core, run database updates, sync the DB, and a bunch of other stuff straight from the command line. If this is a one-time gig for you then it's probably not worth worrying about. If you have to do these things remotely often, it might be worth looking into.
For instance, when you don't have a security hot potato, you can update the site to all the latest code with
>drush up
...which updates core and contributed modules all at once, runs the DB update script, and clears the caches. If you only want security fixes:
>drush up --security-only
(well, not that simple. The right way to do it is backup filesystem and the DB then do those command. Drush also has backup options, of course.)
and what I've seen thus far suggests that the attacks were not going on before the announcement, which is scary. Someone went from bug announcement to widely-deployed automated attacks in a few hours.
That is scary in its own right, in a different way. That is the sort of dismal problem that is far too common.
I would find it somewhat comforting, though, if the widespread exploits were the product of an ignored bug. The reports of widespread exploitation started soon after this announcement. That someone might have gone from 0** to widely-deployed exploit in a few hours is something I find scarier than another case of an ignored bugfix.
**Well, "baseline to 100." It's sensible to assume that whoever did it had a pre-existing codebase and similar SQL injection code to work off.
![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
(no subject)
Date: 2014-10-30 08:46 pm (UTC)(no subject)
Date: 2014-10-30 08:51 pm (UTC)Today, this has changed, because the guy who was supposed to be doing it wasn't even monitoring the "fuck, patch NOW" mailing list.
(no subject)
Date: 2014-10-30 09:36 pm (UTC)(no subject)
Date: 2014-10-30 09:37 pm (UTC)(no subject)
Date: 2014-10-30 09:44 pm (UTC)At the moment I'm arranging a clean machine so a clean copy of the site can be uploaded, then have the most recent content re-added, then go live. Little details like "what modules" are so not on my radar: The new site will have the same modules the old one did, restored from a trusted backup. Anything else is Not My Problem at the moment.
(no subject)
Date: 2014-10-30 09:51 pm (UTC)Drush is a command-line utility for managing drupal sites. It lets you download modules, update core, run database updates, sync the DB, and a bunch of other stuff straight from the command line. If this is a one-time gig for you then it's probably not worth worrying about. If you have to do these things remotely often, it might be worth looking into.
For instance, when you don't have a security hot potato, you can update the site to all the latest code with
>drush up
...which updates core and contributed modules all at once, runs the DB update script, and clears the caches. If you only want security fixes:
>drush up --security-only
(well, not that simple. The right way to do it is backup filesystem and the DB then do those command. Drush also has backup options, of course.)
(no subject)
Date: 2014-10-30 10:13 pm (UTC)(no subject)
Date: 2014-10-30 08:52 pm (UTC)(no subject)
Date: 2014-10-30 08:56 pm (UTC)(no subject)
Date: 2014-10-30 09:26 pm (UTC)I would find it somewhat comforting, though, if the widespread exploits were the product of an ignored bug. The reports of widespread exploitation started soon after this announcement. That someone might have gone from 0** to widely-deployed exploit in a few hours is something I find scarier than another case of an ignored bugfix.
**Well, "baseline to 100." It's sensible to assume that whoever did it had a pre-existing codebase and similar SQL injection code to work off.