My Own PHP Interruption

Ton writes, in The PHP Interruption:

This site, and my other ones, and my business ones (including our NextCloud), were offline as precaution since yesterday afternoon. I was at LegoWorld in Utrecht with E and Y, when I realised what was going on, and left for home to take my stuff down.

The “precaution” was a notice from the maintainers of PHP, the programming language that powers this Drupal website, and much of the web, that there was going to be a critical security release of the language at 10:00 a.m. Wednesday.

I was in the same boat as Ton, and this site has only sprung back to life, after more than 24 hours offline, just now.

In my case I noted a mention on Hacker News of the issue just before I went to bed on Tuesday night. At the time the post had just three comments and the item was down at the bottom of the site’s first page; right now it has 656 comments.

I woke up on Wednesday to news that exploits of the vulnerability were circulating, and the advice from several reputable sources was that the best course of action was to take PHP-based websites offline until a patch could be applied.

So that’s what I did.

And then a funny thing happened, a thing that perhaps will be the positive outcome of all this: I kept the server offline.

For almost 30 years my professional life had a prime directive: keep the servers running at all costs. 

And I lived and breathed that, sometimes at a cost to my sleep, often at a cost to my relationships, and, in the hyper-vigilance that was always there, at great cost to my ability to ever relax.

Yesterday Lisa and I had a plan to go out to shut down our place by the shore for the winter. Prime-directive-me would have immediately cancelled that plan: keep the servers running at all costs. 

But I’m no longer working for anybody else. My maintenance of the webserver that’s bringing you this site makes me responsible to none but myself. No revenue will be lost if it’s offline. I have no technical reputation to preserve.

So I set down tools and we enjoyed a sunny afternoon together, vacuuming and cleaning and shutting off the water.

When we returned, I kept the good times going and went to a previously scheduled meeting of my Men’s Group. When I got home from that, though I did take a few minutes to get updated on patch progress, I went to bed roughly on schedule (old me, keep the servers running at all costs me, would have 100% stayed up all night, if that had been required).

This morning I went to a gym workout, came home to shower, went to interview a candidate for mayor, took a break, went to a therapy appointment, went out for lunch.

And only then I sat down to wade through the process of getting things back up and running.

Here’s a brief technical rundown, as much for me to remember as for you to know, of what I did, starting yesterday and running into today:

• I needed to update to PHP 8.4.27, the newly-patch version.
• I had a server at Hetzner running Fedora 42.
• Fedora 42 is no longer receiving updates, so the patched version of PHP wouldn’t be released.
• Fedora 43 would receive the update. But Fedora 43 will reach its end of life in December. I decided to go ahead anyway.
• I spun up a new Fedora 43 server, got it mostly set up, synced my Drupal and other code, synced my MySQL databases, synced files, and then waited for the patched version of PHP.
• The patched version of PHP didn’t arrive for Fedora 43 yesterday: I could see it going through the process of being built and pushed for testing, but it got stuck there (I did learn a lot about the PHP build process while waiting!).
• Late last night, just before bed, Remi’s Repository did have a patched version, and I installed that. Then I went to bed.
• This afternoon I finished up the migration: copied over SSL certificates, did some other readiness housekeeping.
• Switched over the DNS for all of my websites to point to the new server.
• Tidied up some missing dependencies.
• And here we are.

The collateral damage from all this was limited: Olivia’s blog was one of the sites that went down, and this happened to coincide with a need for her to write in public. She got frustrated, understandably.

There was that, and that various of my side projects—WhatsMyLot.com, CaminoFrances.info, TheIslandWalk.info, ThisBox.info—were offline.

The collateral benefit, though, of being able to release the commitment to the prime directive weight so much more than any of that.

Release from hyper-vigilance comes from unusual forms. This was one of them.