News for hackers. Stuff that matters.

bulatb

Block it at your web server before it reaches PHP. Ctrl+F "nginx" or ".htaccess" in this thread for configs.
Re:Upcoming Critical PHP Security Release on Wednesday October 21, 2026 @12:55AM (#50176245)
By corrupting memory and causing the CPU to jump from the intended instruction to a different one controlled by the attacker, at which point their instructions control what your process does next. Getting shell does not mean getting it to feed a spicy string to system(), it means tricking something in the process into overwriting memory with bytes that, if read as instructions, tell the CPU to make a system call to spawn a different process running arbitrary code.

You could do that to an internet-connected toaster with a JPEG. The system() function has nothing to do with it.

Re:Why We're Banning AI on Thursday October 15, 2026 @04:11PM (#50109575)
Without taking sides:

People driven mainly by self-interest are more likely to act without principle, and also likely to be outraged when that's pointed out—because it's not in their interest. Accusing them of bad behavior is the outage because, when sometime is not principled, in general or on some issue in particular, their interests and their notion of the moral good are one and the same.

It is very hard for people who see wants as normatives to have productive discussion with those who see them as descriptives. The gulf between the value systems is too wide.

Re:Markdown in /src on Wednesday September 23, 2026 @10:24AM (#49816685)
Some tools will automatically ignore commits in a .git-blame-ignore-revs file. Git itself can "blame --ignore-rev <hash>" or "blame --ignore-revs-file <file>" since version 2.23.

  git commit -m "Autoformat source files"
  git log --format="# %s%n%H" -1 >> .git-blame-ignore-revs
  git add .git-blame-ignore-revs
  git commit -m "Ignore autoformat commit in blames"

  cat .git-blame-ignore-revs
  # Autoformat source files
  0a1b2c3d...

  git blame --ignore-revs-file .git-blame-ignore-revs code.src
Git can use it automatically too:

  git config blame.ignoreRevsFile .git-blame-ignore-revs
  git blame code.src
Though git-blame may fail or crash if blame.ignoreRevsFile is set but the file is missing (hence "config", not "config --global"). Since version 2.53, a configured ignoreRevsFile can be missing if the value starts with ":(optional)".
Ninja edit, sorry. I'm glad we got to salvage this from where it might have gone.

I can't keep writing now but I will try to organize some thoughts and come back later.

> humans do have that capacity, but our system is explicitly set up to give the most power to the greediest among us

My argument is that we don't have that capacity. The system that we have is what we have because it's what has self-assembled and would self-assemble every time if we ran it again.

I may be wrong, but that's what I'm claiming.

If we want a system different than what self-assembles, we should first admit what self-assembles, and admit it's not because of individuals not doing their part or whatever. The system is the way it is because the natural laws it follows lead it to that state. This is where the whole idea of coordination as a simple answer fails.

People won't spontaneously all accept an unappealing, morally unpleasant, complicated explanation of why things aren't better when a simple, pleasant, satisfying, even righteous explanation is available and fits their preexisting worldview.

I am tired of the moralizing arguments[0] from people sabotaging their own causes, blaming people who are doing something that might work instead of sabotaging harder. If I misunderstood and that's not you, I'm sorry.

I should have been less snippy at the top either way.

---

[0] https://news.ycombinator.com/item?id=42560779

I am saying human nature is the reason "just coordinate" has not resolved this problem, and denying human nature keeps us from coordinating on this problem doesn't help.

Ugh, this is like my catchphrase now, but: "If everybody just" is a description of a problem, not a solution. Specifically a problem that exists because they haven't justed and will never just, no matter what could happen if they just.

Coordination metaproblems where coordination problems that exist cannot be solved because of human nature are a consequence of human nature interacting with the laws of nature.

Of course, and I'm not saying that. Coordinated action is so stupidly effective that it barely even matters what you do, and long as you all do it together.

That doesn't mean it's possible for every problem. There's always a coordination cost. The larger your per-person cost times the number of people you need, the more unlikely the coordinated action is to happen. Spontaneous coordination is an oxymoron and improbable by definition. It's a situation where the system doesn't do what's energetically favored and instead does something else that isn't.

Ascribing agency to systems is a human bias. Ascribing it to groups of agents is both human nature and the fallacy of composition. Blaming individuals instead of looking at the system and the context is both human nature and the fundamental attribution error. This is one of many places where the bucket leaks.

Currently some groups with low coordination costs (and so high leverage) are coordinating to increase coordination costs for the groups that oppose them, using tactics that are independently high-leverage, multiplying their effect so much that they can make the opposition's costs effectively unbounded. Human nature makes the opposition wilfully, aggressively deny this and insist their costs are low and people are just bad and lazy. (Somehow, everybody being bad and lazy all at once does not reflect on human nature.)

The argument about coordination costs is more or less uncontroversial when projected into any other subject. It's only controversial here because of human nature. It's another leak.

Your opposition's agency is concentrated and yours is dilute. Human nature tilts the playing field, diluting yours and concentrating theirs. Accept this and adjust your strategy, or lose.

On no other issue would this type of wishful thinking be accepted.

If I pour some water in a bucket and come back to find it's all leaked out, and do this every day for all of human history and always get the same result, I don't conclude the water wouldn't leak if it just tried a little harder.

There's a hole in the bucket.

The brightest minds in STEM are often loudly, proudly, confidently wrong on every single thing except their narrow specialty in STEM.

Many of the people still rejecting climate change are scientists and engineers whose egos make them obligate contrarians.

Re:That's a Lot of YAML on Friday August 28, 2026 @08:05AM (#49477324)
I think they meant "no way," but maybe it's a joke about the Norway problem? YAML famously confuses Norway's country code ("NO" or "no" without quotes) with unquoted "no" meaning Boolean false.
Yay! I've argued this a few times here and it's been, uh, perceived as low quality.

I think "objective quality" can always be re-framed in terms of fitness. "Quality" is just not anything the fitness function measures, so it can't.

It's hard to really make the case because of course there's something real that people mean, colloquially, and it's totally valid. Lots of things objectively have properties most people would agree show quality. That's where it is, it's right there!

But all those properties can be described without the use of "quality" by just reciting every fact about the thing. The only thing that will be left, the only thing you can't communicate that way, is what the person thinks about those facts.

Quality is what we call the difference between what succeeds and what we wish succeeded. It's a measure of how closely the opinion of the person saying "quality" aligns with what is actually rewarded by the fitness function that objectively exists. The only thing you've learned when you hear "quality" is what the speaker thinks is good, not anything about the subject.

Quality does not exist until a (person, preference, subject) pairing happens. It's not real. It's literally not a thing. It's just a name for mixing up your is and ought.

When someone saying "quality" can point to the specific property that makes the subject quality, they're almost always pointing to what is, from the perspective of the fitness function, inefficiency, a waste of energy and effort, more spent than the system rewards.

Anyone who spends a lot of effort building skills to get particular results is going to believe those results are important, at least a necessary part of success, if not the whole definition. When people who did not put in the effort keep succeeding without those results, "quality" becomes the cope. It's shoddy work. They did it wrong. They cheated somehow.

And yet they succeeded.

Because "quality" is what a person says when is and ought don't match, a fact about the speaker, not the subject.

Re:The Git history command deserves more attention on Tuesday July 14, 2026 @05:49AM (#48904332)
My point to the OP is the same thing I'm saying to you. "I understand the thing and think it's fine" does not imply that nobody who understands the thing can think it isn't fine, or anyone who doesn't like the thing just doesn't understand it.

It's not some deep or interesting idea, but it needs to be repeated any time "git gud" is used as an excuse for Git's UX, which is always.

Re:The Git history command deserves more attention on Tuesday July 14, 2026 @12:26AM (#48902293)
I'm sorry (like actually sorry) if I'm getting into counter-condescension here, but, like...

> all you have to do to make is pleasant

This is an assumption about what I find unpleasant and why. I take it you think "reading information" and "understanding instructions" are some of those things I don't like. Your conclusion that I must not understand is based on that assumption.

The assumption is wrong.

If you can grant me that, my problem looks different. If you can't or won't, my summary was right.

Re:The Git history command deserves more attention on Monday July 13, 2026 @11:33PM (#48901970)
Let me eat the crow of getting drawn back in and cap this conversation with a summary. I think this is important because criticizing Git's UX is always like this.

OP: No one should be worried about using Git to do a thing.

bulatb: I'm worried it will be unpleasant.

seba_dos1: Here is what will happen when you do the thing.

bulatb: I know, but doing it will be unpleasant.

seba_dos1: You must not understand what's going to happen.

bulatb: I do. The process is unpleasant.

seba_dos1: You must not understand what's going to happen.

Re:The Git history command deserves more attention on Monday July 13, 2026 @10:57PM (#48901749)
I understand how rebase works and use it many times a day. Thanks for trying to explain but I won't respond further.
Re:The Git history command deserves more attention on Monday July 13, 2026 @10:22PM (#48901529)
Such as moving down a fixup during interactive rebase when it's going to conflict with parents, or I've added more commits mid-rebase, or the rebase started in a tool and now I need to think about the tool's command and understand how many times the rebase point is view is backwards to interpret which is "ours" and which is "theirs" and whether it's the tool, my editor, or my own experience I should ignore because it's going to mislead me.

None of that word salad should matter, but it does. Git will ruin everything with glee and there is always an excuse for why that's fine and it's the user's fault.

Re:The Git history command deserves more attention on Monday July 13, 2026 @09:57PM (#48901368)
I can fully understand a conflict, know it's coming, and fear it anyway because I'll have to deal with Git's behavior to fix it.
Re:Podman v6.0.0 on Thursday July 02, 2026 @08:09PM (#48769053)
Compose is for developers. RedHat is for sysadmins and so is Quadlet.
A backup is a second copy somewhere else whose only job is sitting there not being touched unless it needs to be restored.

Anything you're working with is not a backup, even if it mostly contains backups. Your local .git and your remotes are data to back up, not backups.

The only thing that is a backup is a checksummed snapshot of your data somewhere that the normal workflow that creates it can't destroy it, pushed there and left there, hopefully to never see the light of day again, unless requested by a testable and tested process for restoring it if needed.

Re:On The <dl> on Sunday May 24, 2026 @06:14AM (#48256039)
> nothing in the stack wants you to do that

Meaning treat semantic markup as a principle. Most modern tools are not that interested in 2010s ideas about separation of design and content.

Re:On The <dl> on Saturday May 23, 2026 @04:30PM (#48251169)
HyperText Markup Language is semantic. You're marking up a document to show what information it contains, where it contains it, and how it relates to other documents or information. Reading markup causes browsers to display things, but that's incidental.

In theory.

In practice, no one cares about semantics and the choice of tags is based on how a target set of browsers happens to display them.

Your question about who interprets markup is exactly right. In theory, you have no idea. Maybe it's a browser, maybe it's assistive software, maybe it's a browser printing, maybe it's some custom knowledge base with different views of documents for different users. In theory, you're supporting all of that by only marking up semantics and allowing the consumer to interpret them, because there isn't one right answer.

In practice, your client is Chrome.

In theory, that's irrelevant because you're using CSS to style semantic markup so it works in Chrome and still makes sense to other clients.

In practice, you're writing a web application, using a framework, and nothing in the stack wants you to do that.

Re:On The <dl> on Saturday May 23, 2026 @04:08PM (#48250971)
Too late to edit now, but I should mention putting titles in a list like that isn't valid. It's just to shorten the example.
Re:On The <dl> on Saturday May 23, 2026 @01:59PM (#48249721)
A <ul> is a list of things whose order makes no difference to its meaning. Rearranging a <ul> would change the presentation, not the information. Rearranging an <ol> would change both.

  <ul> Players
    <li> Alice
    <li> Bob
    <li> Carol
  </ul>

  <ol> Leaderboard
    <li> Bob
    <li> Alice
    <li> Carol
  </ol>
Is this an LLM responding to an LLM, lamenting the loss of human connection?

What a world it is now.

Re:Why "The AI Hallucinated" is the perfect legal defense on Thursday January 29, 2026 @04:16PM (#46816709)
We're taking about different things. Responsibility is volunteering to accept accountability without a fight.

In practice, almost everyone is held potentially or actually accountable for things they never had a choice in. Some are never held accountable for things they freely choose, because they have some way to dodge accountability.

The CEOs who don't accept accountability were lying when they said they were responsible.

Re:Why "The AI Hallucinated" is the perfect legal defense on Thursday January 29, 2026 @03:29PM (#46816114)
There's nothing to prove. Responsibility means you accept the consequences for its actions, whatever they are. You own the benefit? You own the risk.

If you don't want to be responsible for what a tool that might do anything at all might do, don't use the tool.

The other option is admitting that you don't accept responsibility, not looking for a way to be "responsible" but not accountable.

Re:Lennart Poettering, Christian Brauner founded a new company on Wednesday January 28, 2026 @11:10AM (#46797216)
"People don't learn lessons" is a lesson that people don't learn.
Re:Simplify Your Code: Functional Core, Imperative Shell on Tuesday October 28, 2025 @10:32AM (#45733394)
It can. SQLAlchemy has good support for types since 2.0, which helps a lot.

Older »