vntok

If it's dumb and it works, then it's not dumb.

Please don't affirm things that you perfectly know you don't know.

No, author says right here in this threads that it's been hardened versus default:

> For those who are saying that the nginx config is unfairly difficult, intention was just to replicate a fairly normal config that was more realistic than you'd get in a lab environment. If we get to 24 hr+ with no solves I'll see about making it easier. In the meantime, seems like you can perhaps mitigate PHP2Shell with the right nginx config, so that's pretty neat!

But they just showed you their proof. You simply did not accept it, which they might or might not care about.

I suspect that they in fact do not particularly care about what you think.

Breaking Bad vibes here. "You don't want a ransom negociator, you want a ransom negociator!"

Not necessarly. For example you could have the machine print a ticket with the vote and show it to the voter behind a window. The voter:

- confirms (paper goes down the box) and exits the booth

or

- cancels (paper is burned) and votes again

You don't, you simply make both spend a few billion cpu cycles for it. The human will tolerate the one-time cost. The bot's owner won't because it's not scalable.

Calling $900 "a couple bucks" shows how wide a gap there is between perception and reality though.

Yes to both.

For (1) the vast majority of people don't want to spend what's probably on the roundabout of a thousand dollars for their homelab's homepage. You can easily see this in almost every homelabbing discussion on reddit or even here, where everyone focuses on cheap/hackish solutions to avoid overspending... except in hardware of course =) It's kind of become a meme at this point.

For (2), certainly, especially so considering that the author gave the illlustrator blueprints, photos, instructions, etc. for the commissioned illustrator to convert into dynamically-compatible svgs.

There's a lot of top-down implementing there with very low bottom-up artistry. This doesn't at all take from the final quality -which is pretty good- but it makes it easily replicable using current-gen AI.

Maybe the reason is simply that it's a cool idea?

This is typically the kind of hacking project that is preposterously non-economically-viable for 99% of homelabbers, let alone regular folks. Now, for the first time ever, AI is making it actually palatable for everyone who wants it done to have it done... and certainly much cheaper too at an equivalent quality level.

That is just nonsense. Is your work experience perhaps only in marketing-oriented shops for you to think that?

Most models from architect offices of any size will be larger; many experimental results from applied physics research labs will be larger; any single project from a film production company of any size will be larger; any combined weekly security log at MSPs of any size will be larger; any industrial plant's daily production indicators will be larger; any energy company's hourly operational measurements will be larger.

Yes, but (and? Because?) the advice is very good regardless of the software used.

A weird reaction. You're missing some very good advice, advice that is completely oblivious to the backup product... a now-defunct product which is only advertised by a now-defunct company, just the once (that's refreshing), very clearly and honestly (that's refreshing), at the very end of the slideshow.

A great typo.

If you do that you'll quickly pivot to selling drugs and gambling tips.

Indeed. Then again, it's on WordPress not to have directory traversal flaws in their core functions...

- especially the functions that are explicitely exposed to be used on front-facing interfaces (ie: templating functions).

- and especially when the security flaw in question was not only raised 9 years ago but described in details on the official documentation page of the affected function

> On a fresh WP install, a random user can't upload PHP files.

Indeed, but you don't need to upload anything as long as there's already a PHP file that allows you to execute arbitrary commands somewhere on the server, right?

Well, as it turns out, the default PHP Docker image has had such a file readily available until version 8.5 =)

Sorry in advance if you were joking, but for readers who aren't in the know: Hugo had, in fact, two 9.3 CVSS vulnerabilities just 11 days ago...

https://app.opencve.io/cve/CVE-2026-89259

https://app.opencve.io/cve/CVE-2026-89258

Yes. It's amazing how supposedly security professionals only take the base score "as is" and never adjust.

Many GUI CVSS calculators exist just for this, it takes a minute to requalify a vuln and adjust its CVSS based on your specific environment.

This one for example is pretty basic but works well: https://www.first.org/cvss/calculator/4.0

> These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in terms of complementary/alternative security controls in place, Confidentiality, Integrity, and Availability. The metrics are the modified equivalent of base metrics and are assigned metric values based on the component placement in organization infrastructure.

You need to reason about both probability and impact, not one or the other. In your example, it just means that the probability is very low, perhaps even down to 0 in your specific case. But even at a low probability, the impact of the vulnerability remains very high so it helps you reason about it.

For example, you might react differently to these scores:

- <8/10: check that your systems are indeed secure

- 8.6/10: check that your systems are indeed secure and tell your junior analyst to train on creating a custom monitoring rule for that attack and follow-up with you

- 9.8/10: double-check that your systems are indeed secure, ensure that if you had a hole another security layer would have caught it (if not, that's a problem!), set up a honeypot to get some info on the assholes that have repeatedly attacked you lately and will undoubtedly try to 0-day you in the next few hours, etc.

Ironically, this 9 years old comment on the official documentation page of one of the affected functions perfectly describes both the nature and remediation of this major security flaw:

> Paul Ryan 9 years ago

> Note that locate_template() does not prevent directory traversal attacks, so if you’re passing a user-provided template name to the function, be sure to verify that it’s from one of the three appropriate locations (active theme directory, parent theme directory, or /wp-includes/theme-compat/ directory).

https://developer.wordpress.org/reference/functions/locate_t...

> This is a somewhat situational Wordpress RCE that impacts only a couple themes. reply

That is dangerously incorrect, a whole lot of themes are vulnerable. The main pre-condition, "presence of a top-level directory named 'page-xxx' like 'page-templates' in the theme's directory" is actually an official recommendation in the WordPress documentation.

See here: https://developer.wordpress.org/themes/classic-themes/templa...

> As discussed in Organizing Theme Files, WordPress can recognize page templates stored in the theme’s root folder or in a first-level subdirectory of the theme folder. *The page-templates/ folder is a common convention* for organizing global page templates, but it is not required. Page templates can also be stored in other first-level subdirectories, such as templates/ or page_templates/.

It depends.

Are you part of the 99.99999% users of one of iOS+Apple or Androidlike+Google/Tencent or HarmonyOS+Huawei? If that's the case, you don't need to as the key is automagically saved by your OS' platform and synced with your new device.

Otherwise, you're such an extreme outlier that you probably either know what you're doing or can find out by yourself, right?

True, but it would have to be more than massive (order(s) of magnitude) to offset that gap.

Did you open the repo? There's a subdirectory with two dozens of files, around 300Kb of text.

Storing/visualizing small text changes over time as revisions is exactly what Git is excellent at, how else would you keep track of updates to the prompts?

Indeed. It's been very funny to observe introvert geeks progressively rediscover human communication over the past 3 years.

For decades, they were allowed -expected even- to be weird and communicate badly with their peers, let alone third parties.

Then, a whole zoo of processes, gamifications and other shenanogans were invented just to help them show normies what was up with their work (remember the planning poker game?)...

Now, at last, those people are actually ewpected to be able to explain their constraints, document the work, be accountable for the results and generally exchange contructively... Just, well, with AIs not with humans.

> NVidia has enormous operating margins, so a competitive solution doesn't have to match or beat NVidia's scale efficiencies; it just has to beat delivered cost.

But then that means you have no actual moat against the behemot, right? Your competitor can move into the market as soon as they want to, at much better cost (so at slightly better price)... and Nvidia certainly can adapt much faster around hard hardware specs innovation than a new entrant ever could.