PHP does have a number of official ones, yes, but the way they are designed still makes it often more efficient to just download their Dockerfiles and use as a guide to make your own (I’ve had to do that in particular because of how difficult it is to install some specific PHP extensions on their Alpine image sets).

My threat model is not changed: I want to serve something and I want to not be busy with "oh suddenly there’s a two PHP vulnerabilityies. My enemy is the world, but that is not really unchanged from before in a world where there exists capitalism and rent seekers want to collect from us even for breathing. I’m not intended to be unpaid tech support. So I just serve the things with reasonable scopes (under wireguard, or in a borrowed VPS, etc) and let it go. If an automated system manages to find a hole, computers are so fast that it’s not going to make a difference if I’m sitting in front of the chair vs enjoying some modicum of social life visiting a friend three cities away.

Before LLMs, the prospect of an undiscovered vulnerability was non-zero probability then, so what exactly has changed now?

The problem is not the prospect of an undiscovered vulnerability (there is always a vulnerability somewhere) but rather the prospect of a reduced response window.

There’s a wide gap of difference between “non-zero probability” (0.0076%) and “non-zero probability” (82.01734%).

So a multipart form “zip bomb”? Sounds like the kind of thing that would do… well, that. But also, by that point you don’t even need a WAF to block it, IIRC multipart forms can be disabled or their memory limit clamped on php.ini.

(Not that I’d rely on that; not everyone has access to php.ini. But then again, we are talking about a world where there are more than one (1) ways of dealing with problems)

Yes the vulns are real. No that does not mean a system with the vuln is automatically and noticeably exploitable: that assumes there are no other defense systems or simply other happenstance logical walls around (firewalls, datacenter range blocks, seven proxies, 28 NATs, Anubis, whathaveyou).

My understanding is that CVEs are ranked not by Real World conditions but rather under an “idealized threat condition” that imagines your machine is essentially connected with a straight wire to the root DNS serves of the internet, given a public IPv4 address, and the off switch is dislodged or somehow made unavailable.

Hey, never said I was laughing out of happiness… 😭

laughs in keeping an old archive site still in PHP5

The laws of pneumatics and hydraulics dictate that closing the iris not fully makes the produce go uuuuuh

stronger.

This is quite simply solved by using in your presentation a site that already rebrands Anubis.

ANUS SHIELD

The AI disclosure is important. Which one, where, how and why. Just to show an example why it’s important, it’s basically the same as this thing that is absolutely needed and normal in the food industry precisely because we allow people to do things the wrong way:

This food product is processed in the same tanks, conveyors belts and filters that also process Imperiling Allergen.

No, it’s free real estate for scams, slop and the like.

Basically yes. Matrix is in the unfortunate position of being a “nu-protocol”, something that should be good but it is intentionally designed to be bloated and wasteful just so that we (or really, techbros) can have a shiny new toy, instead of using proven, battle-tested technologies and standards that can run in a potato which is all we’ll have access to with how the RAM factories are going.

Harder, yes; impossible, no.

For example, even if there was currently not an alternative to a specific piece of software (might take a while, might be too niche, etc) nothing says you can’t use the latest version of Caddy or whatever before they got slopified. Lists like Open Slopware help find the correct release version numbers for that.

That sounds interesting. Any ongoing discussion on the subject?

xml dead

¿Really? Someone tell that to LibreOffice, they keep using it for their ISO approved file format!

deleted by creator

It’s 2026… Why do people insist on skipping the fact that XMPP exists?

Anyway. Just set up XMPP.

neocities

This now should have TWO upvotes from me!

(come on lemmy devs get to it)

Mobile

Heck no. Even if the app was the best available, it’s got to live in an environment that is already sending everything to Google / Apple and trying to whine about nudes where it can, maybe to send them to the Pedophile Elite.

Only if I had something like a Graphene phone, but with the prices incumbent in their current Motorola deal, that’s about a decade away.