dwedge

I just realised I hate paywalls so much that I always close nytimes rather than logging in (I have a subscription). This one was particularly gross, the paywall blocked all of the article but left a banner ad at the top full of women posing in underwear. It's like the old internet is back

Can you give examples of kernel bugs that can be targeted on an otherwise locked down system? Let's say something running just LAMP and all other ports closed off with a software firewall.

There are plenty of out of support systems still in the wild and while I'm not arguing they are completely secure I was under the impression that kernel vulnerabilities generally make a minor exploit in something else worse (chained priv escalation for example) and generally are difficult to exploit on their own. If I'm mistaken I'd love to know

There are two linked in the article

It was your response. Of course you prefer your response.

The fact is you had no idea how useful or dangerous your advice was. PHP maintainers said to shut it down, how many people followed your advice instead? Did it work or just leave them vulnerable? Do you know?

Because you're heavily implying that the people who knew about the details of the vulnerability were panicking and thank god we had you with an LLM

This is just Claude output. Did you verify anything or just rehash the links?

As far as I can tell none of this is related to the current vulnerability in PHP itself. Even having a site that just returns echo "phone us on XXXX" is vulnerable apparently.

A dynamic language having access to all of the files it has access to is not unique to PHP. Vulnerabilities are not unique to PHP, and I doubt the Dutch National Cyber Security Center took their website offline because they lack user-specific roles in the database: https://www.ncsc.nl/index-en.html

So maybe save your elitism for a day when so many of us aren't already putting out fires? Congratulations on not being part of the 75% of the internet affected.

Given that the base you ran against was faulty and not actually RCE, I'm starting to get sceptical of the truth of your highly upvoted comment.

They've retracted RCE capabilities from that site, said they made a mistake and it's a crash bug. So what base did you use?

Big difference between getting people to buy 0.0000001% at that valuation, and getting them to buy 5%. Even if you assume SpaceX is worth zero, he's still worth $200B

Moat must have been written more times in the last 12 months than in all of history before that time.

In his pocket or what? When SpaceX IPO'd he was valued at over a trillion USD. Currently somewhere over 900MM, and worth more than the 2nd, 3rd and 4th on the rich list combined.

In terms of net worth, you are closer to Jeff Bezos than Bezos is to Musk.

> Is it more expensive to keep your systems upgraded and maintained or to have all your product get destroyed one arbitrary day and then have to pay to do the upgrade anyways so that the arbitrary property destruction doesn't keep happening?

It happened once. Did you do the maths here? Can you tell us which one was Kore expensive and what percentage chance there was of this hack happening?

Saw an interesting app on f droid that lets your encrypt the password with another password and print them as qr codes. Nice idea but no idea why I'd use it

With android changes this year how do you deploy it?

Presumably the bitwarden apps will stop working with them eventually

> and you can use bitwarden's phone client

What will you use when this stops working in the near future?

How do you force password manager usage?

This being on the front page at the same time as the coffee machine sending 1TB of data, and the icann application being submitted by Coffee Danger LLC is just beautiful

This being on the front page at the same time as the coffee machine sending 1TB of data, and the icann application being submitted by Coffee Danger LLC is just beautiful

3 years ago written in rust meant it was probably faster and smoother than other options. Now it means vibecoded

With github being the exception, I use comments to see if the article is AI. If it is, I prefer the condensed opinions in the comments. Not to say it can't be interesting I just don't want to waste time reading overly verbose generated text.

Apparently solving blocking extra domains due to hash collisions (reducing from 1 to 0) would be extra space "to solve a problem I don't have".

I dislike when LLMs talk to me like that. I hate it when humans do it, confidently spewing their overconfident llm assumptions to others

The URL is sent using http inside the https connection, so it's encrypted too. Your ISP shouldn't be able to see it unless they have root certs on your device.

It's not impossible that someone sees the URL, and if it's stored in an email the backups or local clients could store it plaintext, but I don't see how the URL is any more likely than the password to be sniffed during the connection itself

Using these tools can you switch everything off immediately (or at least within a minute) of total billing going over $X? Because if not, you're being disingenuous

What's with the strawman? Why don't you verify the balance you keep track of is correct periodically?

This is true for almost everything. The bank is still open for 2 hours a day if you want to check your balance. The point is that this anti-pattern is being pushed for more and more functionality.

From a website like that where you expect them to go missing, maybe. But that's not the point, the point is that useful functionality is getting gated.

I don't think you can track a package now without the app on aliexpress. It might be another website but expect it to become more common

> When we first got computers, this is simply what they were. By default they did nothing. They sat there and waited for you to have an idea.

It's ironic that we've come full circle here. This is generally what AI does - nothing that isn't prompted, and yet still part of the end and nothing like the beginning of the internet

It's interesting about MiSTer. It was wedged into the article so awkwardly and suddenly that it felt like a definite advert, but it mostly said it was shit and only get it if you like frustratingly broken systems. I still think it was a reverse psychology form of an ad