chockchocschoir

The problem with giving options regarding security is that sometimes the people who are responsible for setting up those, forget about "convenience versus security", or they get pressured by other groups to "forget" about that balance, and makes a lapse of judgement.

We could, by laws and software, enforce a certain standard of security for organizations. The question is how liable you should be for that. Would have to consider many variables like size of company, importance of information and such.

Presumably most people don't build their own desktop computers (think offices and alike) and those usually use the stock coolers that come with the CPU. At least in my experience.

A company focusing on one thing will always beat a company "focusing" on a hundred things. Noctua basically focuses on various cooling components, and only that sector, meaning they have deep expertise in that. Intel I can't even begin to list how many different things they are doing, while their main focus is processors. They have deep expertise in processors, but you can't expect them to be able to beat a single-purpose company like Noctua at their own game.

Granted, single-focus vs multi-focus is not the only factor, as sometimes multi-focus companies prove to us, but it is a great factor.

I don't like it either. I got good news for you and bad news. The good news is that emoji usage seems higher in open source/side-projects than in professional environments. The bad news is that yes, some people, even professionally, do use emojis instead of words. It is horrible, but I'm afraid it's only gonna get more popular as the population of young people become... Not young and joins the professional workforce.

Comparing Java Serialization with $language Serialization, and the usage of both of the languages, does Java have more RCEs per line written than $language? Or is it just a function of its popularity?

The "I mean" is added to give an informal tone instead of a "Here is a correction since you are incorrect" tone. Obviously it wasn't enough.

> And I don't believe that this kind of obsession with being technically correct will lead to great social outcomes.

There is no such obsession. It's a joke, meant in jest. I'm confirming that parent is correct, and that I'm just being nitpicky for the sake of giving the title a meaning even if it's incorrect.

Granted, in real-life social situations, it's easier to spot when people are joking, in comparison to online text-only comments. Especially when the place where you leave the comment is particularly famous for being dry.

Java doesn't make exploitable RCEs more or less possible than any other programming language. Or do you have something to back this up beyond the common "Java be bad" trope?

I mean, the stars in this visualization are not real, they are "virtual" in the sense that they are a digital replication of something real in our computers.

You're right, it's probably a typo. But the typo at least doesn't make the title incorrect, just changes the focus a bit. Most things in our computers are "virtualized".

Edit: seems people are thinking that this comment is trying to "correct" something. It's not. It was a failed attempt to bring humor to a typo that might as well not be incorrect. No need to further try to prove how socially inept I am.

One of the emails read:

    This is a chain letter which I received from Peter Baumbach a little while
    ago.  I know that all of you don't know me, but if you don't then you probably
    know Bill "Wadd" Waddington, who was here helping me think of names to whom
    to send this.  This letter is the infamous ARPA-net chain letter which
    caused much havoc a few years ago on the ARPA-net.  I think that it's pretty
    dead by now, but I just can't help but to send it along.

> Especially the contrast/magic number discussion

Speaking about accessibility, who came up with that name "magic number"? It's already an overloaded term with multiple meanings and even has one negative one (for constants that has seemingly "magic" meaning or not a fully understood one).

Even something like "contrast ratio" would be immediate to come up with, and much better name as it actually says something on the tin.

> Hey Pete, what is the magic number for our color scheme in article body text?

Makes no sense... Replace "magic number" with "contrast ratio" and suddenly it does make sense.

> Why should MS in the US somehow respond to a request from police department in Cuxhafen in Germany?

If a non-US company does business in the US, most people would expect the business to also answer to US law enforcement. You can't just operate in a business and not follow the law of that country. Same applies the other way around, you do business as a US company in Germany, you better follow German law. Hence companies tend to have HQ in one country, and then subsidiaries in other countries, who know how the local market and laws work.

One could make the same argument of any computer system where the security wasn't as tight as one could hope.

"But judge, they never patched their $software to the latest version, so technically the software allowed me to dump the contents of the IMAP server"

Intents matter. If you commit a crime ("Stealing" is a crime), it doesn't matter if you did so via software, contracts, smart contracts, blockchain or else. A crime is a crime is a crime.

Naming things is indeed hard, using multiple keywords for searching is not (both Google and DuckDuckGo supports this). "Drift pastebin" turns up two hits that would lead me to this project. This HN submission will make the repository score even better for those keywords, so expect it to be even easier to find in a day or two.

I'm not too familiar with YAML, so can't answer to that.

But re JSON:

> object keys in a different order

They can't be "in a different order" as JSON keys are not ordered. They can be whatever order, and would still be considered the same.

> array items are out of order

Then it's different, as JSON arrays are ordered. ["a", "b"] is not the same as ["b", "a"] while {a: 1, b: 1} and {b: 1, a: 1} is the same.

> you could UTF-8 encode characters or write out the same character using backslash notation, numeric or boolean data that might be wrapped in a string in one file but not in another

Then again, they are different. If the data inside is different, it's different.

I understand that logically, they are the same, but not syntax-wise, which is why I included the "differently formatted" "disclaimer", it wouldn't obviously understand that "one" and "1" is the same, but then again, should you? Depends on use case I'd say, hard to generalize.

Indeed. One could just do `diff $(jq . $fileOne) $(jq . $fileTwo)` and you'll end up with a "nice enough" diff even if $fileOne and $fileTwo were very differently formatted.

> Makes me wonder if your assertion is more based on the superficial media takes of the day, and not reality.

Again, it's based on watching hearings and other media released by my government when they are talking about technology.

I'm in no way laughing at them for not understanding something. But I am laughing at those who pretend to understand something, or who simply ignore something because they don't understand it. It's not that hard to find experts in certain subjects, and it's really bad that they don't leverage this more for subjects they don't understand.

I'm not saying because they are "old and experienced" they don't have any value nor wisdom. I'm simply saying that don't trust their opinion on things they don't understand. And if they don't understand something, I expect them to bring themselves up to speed on that thing, or bring in others who do understand that thing. I'm not expecting them to ignore that thing simply because they don't understand it, or worse, pretend like they do understand it when it's clear they don't.

I'd expect politicians who don't understand something to bring experts that does understand that thing, not to ignore everything they don't understand.

That's an unusual take on the technical capabilities of the "old and experienced". I agree that it's generally hard to secure, but many "old and experienced" in governments are not against new technology because they understand it, but because they don't understand it.

Watch any senate/congressional/government hearing about technology related subjects from your country's government and you'll see what I mean.

No, they're the same. Although here used in different contexts (trying to start a sync conversation VS marketing trying to get you to sign up for something), but they are effectively saying the same thing, "I need a minute from you for X".

Another non-confrontational way of dealing with this issue is to engage the first time they do it, and when the conversation is about to end, tell them "hey by the way, in the future I'd appreciate it if instead of saying "hey" and waiting for me to reply, you'd just write me the question in one go, as that would be less distraction for me. Thank you, hope you understand" or something similar.

This way there won't be any misunderstandings about why some people seem more responsive than others, because now that person knows how to communicate with you.

Fair presumption but no, I agree it should be fixed. I just don't agree with the authors idea of how important it is to fix it, as it's highly unlikely to be exploitable in the wild.

Even without any proxies/WAF, PHP is always run (except in development environments with `php -S localhost:4124`) behind a web server, usually apache or nginx. Not sure about apache, but nginx defaults to a limit of 1MB for the request size (via `client_max_body_size` https://nginx.org/en/docs/http/ngx_http_core_module.html#cli...) and I can imagine apache have a similar default as well. Even if you allow requests to carry 1GB of data, this is still not exploitable, and if you have that large requests anyways, you usually find another way of doing the transfer than using plain HTTP requests.

Even if someone wrote code like that, they'd have to have configured their web server to accept 4GB of input somewhere, which gets passed to that function. That adds another "rare +" instance, as most web servers ship with way lower defaults than that.

> Call me an optimist, but I think the framework churn is finally moving behind us.

Such an optimist!

For real though, I've heard this for every single "paradigm change" that has happened during the last ~20 years (and I'm sure many before me has heard it for even longer). Things will continue to move in some sort of direction.

It was claimed in the $lapsus Telegram chat by $lapsus themselves: https://twitter.com/_MG_/status/1506345542837628932/photo/1

From the screenshot:

> I don't think storing AWS keys within Slack would comply to any of these standards?

> There are efforts being made to run PHP on Serverless infrastructure

This is very interesting, I didn't know this. This is a perfect fit for PHP, as it was always designed with this model in mind, and the programmers that use PHP are already used to this way of developing, as that's exactly how php-fpm and mod_php already work and always have.

Honestly, I think the killer feature of Git was GitHub, and it was made popular by people wanting to use GitHub. The rest of the features were cherries on top of being able to use GitHub.

So I guess the killer feature for Fossil would be Fossil in that case, as Fossil is basically Git + GitHub but in one package, that works offline and local first.

Most importantly missing: DNS, which usually is handled over UDP (changing slowly now with DNS-over-HTTPS and some TCP resolvers). Without handling DNS requests via your proxy, you're still leaking information about yourself to the resolver you're using.

If you're interested in collaborating, I'm setting up a search service that includes OCRd text of every single document in the dump, to facilitate searching for people who know Russian and don't want to download the entire dump. Email is in profile.

Yeah, in the case of Git, the web ui is very simple, as Git only cares about code. In the case of Fossil, the web ui is extensive, as Fossil stores all types of data, not just code.

As an interesting example, the very website in this submission (fossil-scm.org) is in fact just a standalone Fossil website, running as you'd run your own repository. Everything that is on that website, is something you get for free for each repository you use Fossil for.