I kind of hate how apt that is, while also being LLM-generated.
My bet is some bit of code was handed a slab of bytes representing the random key and just took the first one. This is easy to do in C for example.
(Yeah, no php here.)
3 Likes
This one made it to the non-tech news pages over here.
I hear various universities shut down a lot of their āstuffā
After hearing that, I shut down all my php containers (2 of which donāt hurt because who needs webmail or a db frontend all the time. but nextcloud is a pain).
My work place is frantically āsearchingā where PHP stuff might be running.
We offered to deliver an SBOM for our new project last novemberāhalf a year before first deployment. Nobody wanted it. Oh wellā¦
Now I am waiting for the fix to propagate to dockerhub
Also Hetzner who hosts both this forum and my stuff had an outage today. No idea what they messed up. But they had some switch maintenance and probably connected some cables or ports crosswise.
2 Likes
Our firmās HR software is offline from āPHP2SHELL, a security flaw in software used by many organizationsā so itās making the rounds
2 Likes
php is pest and cholera rolled into software. it really should be eradicated.
but as much as i feel like writing my own stuff to replace these systems Iām really not keen on writing my own web email client , i would rather shut it permanentlyā¦ nextcloud Iām really using a lot. it is open source though so i wonder how hard can it be to rewrite in a sensible language? Probably hard. (i have the repo checked out currently for reasons and i really donāt want to touch it)
2 Likes
I have spent the day very glad to be unemployed and no longer in charge of multiple elearning sites that all run on PHP and have millions of users between them.
Instead I spent the day mostly doing jigsaws while waiting to get on with jury service (delayed by the courtās own far stupider technical problems).
8 Likes
Here I have a new German word for you, for the people who set that up: Kompetenzbolzen
(competence + I wish I could give you a definition but the German dictionary at duden.de is currently not available due to a technical issue, okay leo.org is still up: so it basically means ācompetent like a boltā)
The end times are near when this gets outshone by a php bug.
I really do not think we need AI to destroy us, we can are doing just fine by ourselves.
1 Like
The only one Iāve found that my users and I are happy with is Prayer, now Very Unmaintained.
1 Like
Not too bad actually, itās just a presentation layer between browser and IMAP, but Iām working on bringing the SSL up to modern spec.
1 Like
Really nice alt-text. At least someone pays tribute ā¦
4 Likes
We met with friends yesterday, one of the ākidsā is just finishing his bachelor in Information Security and he told us a story how they were given a task to hack jwt tokens and they were told they had to just do the first 5 steps of the hack and present them as there was no actual known exploit ā¦ or rather nobody had figured out how to actually complete that specific hack.
So then came the presentations and this one student went through the 5 expected steps and apparently he wasnāt happy with just the 5 steps, so after some work he had found a 6th step which he then presented as a zero day exploit for jwt in class. Yay 
Security students.
They were then told the next lesson would be about āresponsible disclosureā
Yesterday, our friends son asked if at some point we could use my server for him to practice on. I told him only if I was sitting next to him. But Iād be getting a pretty thorough security audit 
4 Likes
Also backerkit seems to have freshly lost customer data. I am getting spam on my service-specific backerkit email address. Yay. Counting up by 1 (kickstarter is sitting at 4 currently, adobe at 2, amazon at 3 and dropbox at 2). Big services I keep and count up and small ones I dont use anymore I just delete the address.
3 Likes
Yesterday, I successfully explained the eMudhra certificate failure to my 91-year-old mother. She is not a mathematician or computer person - she was an actress, biology teacher, and lay preacher - but she does know what prime numbers are, and she grasped the idea of RSA public-key encryption.
When I got to the private key of 4, she thought she must have misunderstood me somewhere, because the error was so obvious.
A hint if you try to explain this: most very large numbers that people deal with are imprecise, being either large sums of money, or long periods of time. Emphasizing that the numbers have to be exactly right for RSA to work avoids misunderstandings.
eMudhra have quit the certificate business.
5 Likes
With a very passive aggressive press release, barely admitting to having made any errorsā¦
3 Likes