jopicornell

Well, that's a "mitigation problem", it was part the official mitigation: set two flags on the php.ini and block multipart forms. You can see them in the ghsa. If that's what they recommended and it was part of the most recommended mitigations on the intrnet (I already did that 6 hours before release without even knowing if sources were right). I see also recommended to shutdown your server. This wasn't official and I'd liked to know if that was the right path.

I agree. That's what I hoped they'd have released between preannounce and version release. I think it's the minimum and doesn't hurt anyone.

The complete silence I refer is after the incidents and leaks. They stated in their preannouncement "We reserve the right to release earlier should details of either vulnerability become public". That sounded to me that if something is leaked, they'll release earlier or clarify. Neither was done and only after the release, clarified things.

But yes, the preannounce was the right move and the leaks were unfortunate, complicating things. But if cloudflare, bunny and other actors start mitigating in their WAF, I think something has gone wrong and, either you act by releasing earlier or calm the waters saying "the exploits are wrong" as per stated in their post, they thought it was the case.

I have a lot of sympathy for the PHP team as well, I hope it doesn't sound like it.

A lot of speculated info was right: the mitigations were mostly right, the video showing exploitation was real and the release of a fixed image was real.

I think if you do a pre-announce, and you say that you could release it earlier or release new information and you don't, and there are reasons to inform your users, then even if it's the middle of the night for you, you should.

As they stated, they are a small team and they have changed their structure, and they are learning and improving. I think if something like this happens, info is vital for us, the administrators of PHP servers

I think the PHP security team and the whole PHP team could have been more communicative and keep releasing information, adapting to the news, suspected exploits and mitigations.

If a video is released showcasing the exploit and following mitigation recommendation, PHP should clarify what it is and if the mitigations are recommended or not. From the pre-announcement: > We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.

If no info is released by them, no other party should have released anything. If info is released or leaked from partners or involved parties, you should notify and explain what's going on.

But no, complete silence from PHP news or any PHP community member.

I get that it was a complicated situation, and I think PHP is the "less wrong" party involved, but I think this constructive and external criticism could help in the future. It has been an interesting day (GMT+2 here) and a rollercoaster of monitoring and mitigating without any reliable source.

Well, I'm no cryptobro by any means, but I see the usability in cryptocurrencies. As always, when humans touch something well built and thought, it goes corrupt.

The basis? It is useful to overcome censorship, inflation and money transfers without relying on third parties (or relying on burocratic, traditionally greedy and ancient parties). It has some uses as a ledger, but this has not come that useful. Or, in my opinion, useful projects are overlooked and only greedyness is what drives the space.

Your sentiment is not wrong, but I see it as a reflection of human currency interaction. If I say "I don't think I ever heard anything good coming out of cash" could be true. Why would we hear something good about something that only its bad uses are news and worth mentioning. Same happens with crypto. I know it is a bit of a mental stretch to use this argument and it isn't 1:1, but cash is being used illegaly as well.

I see a trend that all privacy focused projects have this bad press always: - Cryptocoins (used only by scams) - GrapheneOS/privacy focused oses (used by fugitives and crimibals) - Tor (Used for dark web)

and while that's true, I keep thinking that the interests for banning privacy focused projects is what drives that bad sentiment and bad press. Not only that, I know betwen black and white there are grays and colours :D

Just my grain of salt

Monopoly is not a nice thing. Maybe it is convenient, but not nice.

People that gives money to artists are the ones going to concerts and buying music directly to artists. Spotify gives cents to artists, incetivizing awful behaviour (AI music, aggressive marketing, low effort art...).

Dialogs are a great way to lose information. They are often dismissed by users that want to do their job and are interrupted by modals. Users focused on their tasks blindly dismiss dialogs.

Read the above as a critique to your strong opinion and not an opinion of mine.

My opinion is that toasts are great for notifications that can be reviewed/checked later, like chat notifications or finished background tasks.

What should be avoided, just for the same reason as modals/dialogs, is an overuse, causing fatigue.

If a vehicle can't react to the emmergency break of the vehicle ahead, it's their fault. Change the kitty for a child and the complaint of the scooter is nonsense.

Same as my other comment, it seems like you are involved in the project. Stop responding like this is facebook or reddit. Here we offer our expertise with all good intentions. They haven't said it is a simple task, you are assuming that they said that.

If you can't take constructive criticism or even respond to opinions you disagree, then it is better to not respond at all, because it is bad PR.

I understand that maintaining a project like this is hard, that you need to be compensated and that open source corporate usage tends to be disgraceful. But that's not what they are telling you. They are just shating their opinion, which is part of your potential customer opinions.

Share the rationale behind paywalling common features. Give us, if you have to respond, why you hide the pro features off the homepage, etc. Instead of this kind of childish reaction that adds nothing

I have already seen a few of your responses to criticism coming up toxic like this. They don't need to fork it, but some of your potential customers could. They are explaining to you their opinions, and in HN, this is very valuable.

Most of us have some decision at companies, which are your real customers, and criticism like I've seen you respond boldly and badly, is the criticism I think you should review and take into account.

Personally, I like everything of the pro, except the features that you decided to exclude. Doesn't seem pro features, but features you ramdomly decided not to open source them, and that could be ok. But instead of doing it like this, maybe put a restrictive license so that companies with more than 5 people have to pay.

But I think you should focus on premium/pro features that are really a plus, like your debugger, the bundler, etc. And find features that aren't common and give a plus.

And it is an opinion which you may disagree with, but if you respond to me, don't do it like that, because to me, it is not professional and I'll tend to avoid doing business with people that respond like that

That makes LaLiga look as if they were the victims, but they are not. They don't want to notify Cloudflare nor have done it any time since they started blocking it. LaLiga says that this blockings affects "hundreds" of people, and that they a rightful by doing that. Truth is, they are abusing their power and the spanish legal system to do whatever they want, as usual.

Cloudflare is not ignoring LaLiga and they are open to collaborate, but LaLiga refuses to do so, and are battling legally over it.

It's not a sponsored content but a happy user sharing with its community.

> You want me to pay to search the internet?

Yes. Or you pay and get privacy and good results or you don't pay and they decide which results are better for their profits. That's not how it should work. Companies should build good software so that users use them, not because they have the monopoly and can do dark patterns that result in good profits for them at the expense of the user privacy. Google is not a good software company anymore, their products are abandoned and UX is in extreme decadence in favour of AI.

On the other hand, Kagi uses AI to provide good results and give the best UX to its users. You see? The other way around.

By itself

I care what one of the most famous philosophers and thinkers of our times says. He's not the most up to date, but calling him an idiot positions you politically and intellectually.

Please tell me which laptop.

Also, is it powerful enough to have it run a development environnent (docker compose/k3s with db & cachd, intellij/vscode, etc) without having issues?

Genuine questions, I am no fanboy of anything

I cofounded a startup, trying to get innovation funding and I can say this is 100% my experience. Universities don't think a Software for managing dance and culture academies is innovative, but they are in the field.

That was one of the requeriments: to be certified by a university professor. That doesn't make sense: universities are research centers, but not the unique source of innovation (and in our country, not even a source in most fields).

Your comment is pretty on point!

Well, I'll have to hardly disagree. You want a laptop that its battery life is not 1 hour at best. That wasn't a thing in Windows/Linux laptops until M1 started using arm64. 6 Hours of intense work? Good luck with that.

Not only that, but being able to run very intensive work (Pro Audio, Development...) seamlessly is an absolute pleasure.

Its screen is one of the best screens out there.

The trackpad (and some keyboards) are an absolute pleasure.

The robustness of the laptop is amazing.

I don't care about the marketing of Apple, I don't buy anything new they launch, and I condemn all of their obscure pricing techniques for the tech they sell. But my M1 is rocking like the first day, after four years of daily use. That's something my Windows laptops have never delivered to me.

Apple has done a lot of things wrong, and I will not buy another Apple laptop in the future, but I don't want Nvidia on a Laptop, I want it to be portable, powerful and durable.

That is changing now, and it's amazing. I want my laptop to be mine, and to be able to install any OS I like. New laptops with arm64 and Intel Lake cpus are promissing, but we're not there yet, at least not that I have experienced.

Each to their own for sure, and for you, the nvidia requisite is important. For me it's not about brands, but usability for my work and hobbies.

Yes, I have to agree with responsivened vs stability. As I mentioned in another comment, my main stability issues could be hardware related, because I'm also a steam deck user and it has worked alright there (although I don't use the desktop mode daily).

For me, KDE is a better concept than Gnome, and I genuinely don't know which is better developed/mantained. But it is true that I always change after a week or so, and I've been a gnome user for longer periods of time.

I'll keep testing it, more so if I install updated hardware in my computer

I agree, I just used gnome as the other mainstream DE alternative. I am a happy user of i3, due to my 1070ti giving a lot of problems using wayland. That could be the culprit of my unstability. I want to change to AMD gpus for that reason, and I'll some day test it again for sure.

My last time using kde was a few months ago, and it was stability issues (which could be hardware related), but also cumbersome customization of main UI, and minor annoying bugs, that keep accumulating through usage.

Don't get me wrong, I love KDE concept and I don't think Gnome is making great decisions keeping it minimalist (I use i3 for that reason. If I want a DE I want it fully featured and customizable).

I'm just sharing my personal view and agreeing with another user. I know what users can think about fabulous software, and that they (we) are biased in many many ways.

That's something I think as well. I've tried 4 times through the years, and KDE always felt less stable and solid than Gnome. I guess it's the configurability of KDE that makes it that way.

I like the concept, but I guess maintaining it is no easy task, and people is more motivated to add things than fix them.

I use Unexpected Keyboard on android and it has been amazing. It gives you so much options and speed that other keyboards aren't even remotely close, and seems very close to what you've linked.

> Just use another distro

That's what Manjaro is, another distro. I'm not a fan of it, but EndeavourOS is pure arch with graphical installer, what's wrong with it? (apart from users opening issues or asking questions about specifics in Arch forums)

Arch has an awesome wiki, package manager and tooling, among other nice things. Arch is not only a complex installer of linux. I think that point of view is elitist

That's again an oversimplification. It's not black or white, it's more complex. And that shouldn't be passed onto the general population, but to the companies that have been exploiting the resources as if they were infinite. They have become megamagnates and megacompanies, and now that we ask for solutions, it should not be "ha, ok, pay more".

That's not how it works in countries with fully subsidized healtcare. It seems you are biased towards some intents that have been done in USA to subsidize some part, in a perverse, privatized and corrupt system.

In Spain it is the privatization of the healthcare that is "given to themselves and call it patient care", making politician friends (and politicians themselves) richer and corrupt, and selling it as a way to "fix the healthcare" that they are breaking.

Well, artificial means made by humans, not naturally.

Let's not forget that China is the producer of the world and we are also responsible of that.

Then there is the misconception that China doesn't care, but their cities are a lot greener and prepared for transitioning to green renewals than many west countries.

Not comment OP, but checkout has two very different uses merged into one: restoring files and switching branches. To not break compatibility, git has now switch and restore commands that make commands more readable and understandable.

You should avoid reset --hard because it will delete all your uncommited, and you could end up in situations where that's really bad. Using reset --keep will keep uncommited changes, and failing if any uncommited change cannot be kept.

In my hometown, Palma, in Mallorca, I live in a street where 50% of houses are owned by foreign people or investors/airbnb. The neighborhood is not 50% but not that low.

The problem? Prices skyrocketed, like a 10x in 10 years (for big houses, small houses 4x). I hear more english/german/sweedish than spanish (or catalan) in my dog walks.

Besides economic implications (a lot for local people trying to find places to live), there are cultural/social implications. The neighborhood used to be a community, where people were open to help and share. Now this is changing and evolving into an individualist neighborhood.

Our oficial language is being minoritized even more. This doesn't seem like the neighborhood we used to live on.

Not everything is economy. The intangible heritage is something we should take care more.

China has lowered the air polution in their cities by a lot. They are investing heavily in renewables and fixing desertification.

I don't mean by that that China is a communist country, because it isn't. It is a dictatorship with a capitalist vision. But they are more socialist and people based than others.

Why can I say that? Because they are effectively trying to fix the problems that their capitalist vision has brought, like environment contamination, pollution and desertification.

You've given the wrong example and proven right the other comment: A strong government can fix the problems a liberalized economy can bring.