I write English / Escribo en Español.
Vidya / videojuegos. Internet. Cats / Gatos. Pizza. Nap / Siesta.
This user’s posts under CC-BY-NC-SA license. Ask me if you need a different permission.
PHP does have a number of official ones, yes, but the way they are designed still makes it often more efficient to just download their Dockerfiles and use as a guide to make your own (I’ve had to do that in particular because of how difficult it is to install some specific PHP extensions on their Alpine image sets).
My threat model is not changed: I want to serve something and I want to not be busy with "oh suddenly there’s a two PHP vulnerabilityies. My enemy is the world, but that is not really unchanged from before in a world where there exists capitalism and rent seekers want to collect from us even for breathing. I’m not intended to be unpaid tech support. So I just serve the things with reasonable scopes (under wireguard, or in a borrowed VPS, etc) and let it go. If an automated system manages to find a hole, computers are so fast that it’s not going to make a difference if I’m sitting in front of the chair vs enjoying some modicum of social life visiting a friend three cities away.
Before LLMs, the prospect of an undiscovered vulnerability was non-zero probability then, so what exactly has changed now?
The problem is not the prospect of an undiscovered vulnerability (there is always a vulnerability somewhere) but rather the prospect of a reduced response window.
There’s a wide gap of difference between “non-zero probability” (0.0076%) and “non-zero probability” (82.01734%).
So a multipart form “zip bomb”? Sounds like the kind of thing that would do… well, that. But also, by that point you don’t even need a WAF to block it, IIRC multipart forms can be disabled or their memory limit clamped on php.ini.
(Not that I’d rely on that; not everyone has access to php.ini. But then again, we are talking about a world where there are more than one (1) ways of dealing with problems)
Yes the vulns are real. No that does not mean a system with the vuln is automatically and noticeably exploitable: that assumes there are no other defense systems or simply other happenstance logical walls around (firewalls, datacenter range blocks, seven proxies, 28 NATs, Anubis, whathaveyou).
My understanding is that CVEs are ranked not by Real World conditions but rather under an “idealized threat condition” that imagines your machine is essentially connected with a straight wire to the root DNS serves of the internet, given a public IPv4 address, and the off switch is dislodged or somehow made unavailable.
Hey, never said I was laughing out of happiness… 😭
laughs in keeping an old archive site still in PHP5
The laws of pneumatics and hydraulics dictate that closing the iris not fully makes the produce go uuuuuh
stronger.
This is quite simply solved by using in your presentation a site that already rebrands Anubis.
The AI disclosure is important. Which one, where, how and why. Just to show an example why it’s important, it’s basically the same as this thing that is absolutely needed and normal in the food industry precisely because we allow people to do things the wrong way:
This food product is processed in the same tanks, conveyors belts and filters that also process Imperiling Allergen.
Basically yes. Matrix is in the unfortunate position of being a “nu-protocol”, something that should be good but it is intentionally designed to be bloated and wasteful just so that we (or really, techbros) can have a shiny new toy, instead of using proven, battle-tested technologies and standards that can run in a potato which is all we’ll have access to with how the RAM factories are going.
Harder, yes; impossible, no.
For example, even if there was currently not an alternative to a specific piece of software (might take a while, might be too niche, etc) nothing says you can’t use the latest version of Caddy or whatever before they got slopified. Lists like Open Slopware help find the correct release version numbers for that.
That sounds interesting. Any ongoing discussion on the subject?
xml dead
¿Really? Someone tell that to LibreOffice, they keep using it for their ISO approved file format!
It’s 2026… Why do people insist on skipping the fact that XMPP exists?
Anyway. Just set up XMPP.
Do NOT do the latter! It allows unprivileged users in the system to spawn processes to take privileged ports starting with port 80 all over to port 1024, including relevant ports like 443 (HTTPS)!
It’s powered off.
The fewer packages you have installed, the easier it is to upgrade. So if your stuff is containerized, upgrade should be mostly painless.
In my history at least, dist-upgrades have never themselves been a problem, not even when doing such things as a x86-to-x64 crossgrade upgrade (from Stretch to Buster, back in the time). The problem usually comes right after, with the first reboot, when something does not generate correctly in Grub or the new kernel’s initramfs is lacking a specific module, or a given mariadb flag you were counting on is no longer added by default, or somesuch. So always have a rescue boot ready.