“we”? XD

fire 20% of their personnel

slopify

things fail

Sounds like a closed case to me.

reader

Atril and xpdf, I guess? Honestly I had never sat down to think and search this before.

What’s so wrong with XML? All web browsers use it (HTML is literally slightly-freeform XML), Libreoffice also does (XML is part of the Open Document format spec), Freedesktop… eeeh, let’s not mention them, and so far we are doing golden.

I’m unsure what’s the progress status over there so I’ll say “yes?”.

Which reminds me, I think there is a binding somewhere that lets XMPP send SMS messages, but dunno how if any is that related to phone call compatible audio.

Self-hosted messaging was solved decades ago, it’s called XMPP or Jabber depending on who do you ask. There are a number of services for it, such as Prosody or ejabberd, and there are both client apps (eg.: Conversations for Android, Gajim or Dino for PC) and a number of webclients (such as converse.js which can actually be shipped via a ejabberd install).

That said you could just set up an alternative Signal client that allows for custom servers, since the centralization of Signal only really exists at the level of the client only connecting to Signal’s servers… Signal’s people have pointed this out themselves, when offering bridge setups so that people could connect from Iran or other countries where those countries blocked Signal’s endpoints.

Hmmm, I’d… say… “get a better phone”, but there’s not much of a better alternative there.

Get a desktop / laptop computer?

Safari

Get a better browser? HTTP is as legit a transmission protocol as HTTPS and email are.

That sounds interesting. But then you have to convince your peers to install your certificate root, right?

HTTPS for everything means you have to buy into the cartel of “identity providers” that manage DNS and certificates, even if there are some mostly-good actors in there such as Let’s Encrypt, you still have the external dependency. As we have seen with cases such as Austistici, having that dependency can be a problem. It’s your call if it is in your case or not, but I wanted to raise this point because no one has pointed out that particular weakness vector so far in the thread.

In a very general sense, if your services are under a netbird or any sort of VPN where you control who gets account access or not, you “should not need” HTTPS. Might still be convenient to have.

The fewer packages you have installed, the easier it is to upgrade. So if your stuff is containerized, upgrade should be mostly painless.

In my history at least, dist-upgrades have never themselves been a problem, not even when doing such things as a x86-to-x64 crossgrade upgrade (from Stretch to Buster, back in the time). The problem usually comes right after, with the first reboot, when something does not generate correctly in Grub or the new kernel’s initramfs is lacking a specific module, or a given mariadb flag you were counting on is no longer added by default, or somesuch. So always have a rescue boot ready.

PHP does have a number of official ones, yes, but the way they are designed still makes it often more efficient to just download their Dockerfiles and use as a guide to make your own (I’ve had to do that in particular because of how difficult it is to install some specific PHP extensions on their Alpine image sets).

My threat model is not changed: I want to serve something and I want to not be busy with "oh suddenly there’s a two PHP vulnerabilityies. My enemy is the world, but that is not really unchanged from before in a world where there exists capitalism and rent seekers want to collect from us even for breathing. I’m not intended to be unpaid tech support. So I just serve the things with reasonable scopes (under wireguard, or in a borrowed VPS, etc) and let it go. If an automated system manages to find a hole, computers are so fast that it’s not going to make a difference if I’m sitting in front of the chair vs enjoying some modicum of social life visiting a friend three cities away.

Before LLMs, the prospect of an undiscovered vulnerability was non-zero probability then, so what exactly has changed now?

The problem is not the prospect of an undiscovered vulnerability (there is always a vulnerability somewhere) but rather the prospect of a reduced response window.

There’s a wide gap of difference between “non-zero probability” (0.0076%) and “non-zero probability” (82.01734%).

So a multipart form “zip bomb”? Sounds like the kind of thing that would do… well, that. But also, by that point you don’t even need a WAF to block it, IIRC multipart forms can be disabled or their memory limit clamped on php.ini.

(Not that I’d rely on that; not everyone has access to php.ini. But then again, we are talking about a world where there are more than one (1) ways of dealing with problems)

Yes the vulns are real. No that does not mean a system with the vuln is automatically and noticeably exploitable: that assumes there are no other defense systems or simply other happenstance logical walls around (firewalls, datacenter range blocks, seven proxies, 28 NATs, Anubis, whathaveyou).

My understanding is that CVEs are ranked not by Real World conditions but rather under an “idealized threat condition” that imagines your machine is essentially connected with a straight wire to the root DNS serves of the internet, given a public IPv4 address, and the off switch is dislodged or somehow made unavailable.

Hey, never said I was laughing out of happiness… 😭

laughs in keeping an old archive site still in PHP5

There’s a wide difference between being “chill” and letting yourself (and/or others) be raked without consideration.

And, tbh, Linus is not even that old to be able to use that as an excuse. He was born in '69 - he’s barely older than I am. Eduardo Artés was born in 1951 and is actively fighting technofascism, fronting everything from social unrest to presidential campaigns.

Learn to read. I did say “we”.