EGreg

Where are the bugs in Uniswap? Aave marketplace?

I miss the old days of decentralized networks, and smart contracts that were audited. Forget the shitcoin memecoins and zero sum games mania, the NFTs and the prediction markets. There is so much positive sum that can be done:

https://intercoin.org/applications

https://community.intercoin.app/t/fund-for-refugees/2688

Indeed, very shortly since digital computers were invented, there was corruption. For years, until the voltage could be controlled better and until IEEE standardized things.

Indeed, very shortly since modems were invented, there was need for error correction. They were slow and clunky. The only reasonable conclusion is that the Internet is a fad and not worth discussing. Same as this newfangled decentralized cryptography stuff.

Indeed, very shortly after the Web came out, regular script kiddies could write php websites with blink tags. Credit card numbers were sent in the clear with http. This “e-commerce” thing was a dangerous joke, only idiots would send their credit cards over the Internet. It would never catch on!

You misunderstand. The very reason that this Binance hack is a huge issue is that $5B was concentrated in specific wallets under specific keys.

A decentralized network of wallets and balances doesn’t present an attractive target for hackers specifically because the payoff per wallet is so small!

It is exactly the centralization you are defending, which is at the root of the problem. In the decentralized case, no one has to determine who is a student or a teacher. If a teacher needs to pass KYC with a marketplace, they do it once, and from then on can permissionlessly receive their small payouts.

I know what’s going to happen. I will explain what crypto is for and then it will get downvoted just because it says anything positive about crypto.

The point is to NOT have a single place with access to all the money, votes, etc. Every participant should be acting as themselves, and there should be no way to do things on behalf of others without their consent.

The point of smart contracts is to have code you can actually trust. Your bank or openAI can change their website, APIs and even their models tomorrow. That’s not great for trust. Trust is what enables things to scale.

The same way you trust other internet protocols to just “route around problems” and not have one single point of failure, that is the substrate for Web3.

Imagine a Web2 website such as a student-teacher marketplace NOT handling millions of dollars, accepting money from students and paying them out to teachers. Imagine it being simply an interface while the actual transactions are approved by the students themselves, and instead of the central site signing payouts with some keys, the teachers get paid through smart contracts and code on the blockchain. The site can still take 10% commission from everything, it would be above board, and it can never change it without the consent of the people. The business logic is in the smart contract.

(Since this comment has the keywords “crypto” and “web3”, I know what will happen in advance already.)

Notice that the hacking is mostly happening with centralized venues. And that is to say nothing of FTX, Celsius etc.

The original promise of crypto and blockchain was to cut out the middleman and NOT concentrate a lot of money under a few custodial keys.

If you took your crypto off exchanges when not in use, you’d be fine. Not your keys, not your crypto.

how do we know? it could be nonsense...

I’ll be straight with you… I think it’s the RLHF. That is the most load-bearing aspect

Instead of what patch? I just said this is for those who have NO PATCH AVAILABLE. I guess you need the strawman to make a valid point, though…

The mindset that every hacker and tinkerer has. Trying to take the system apart and decouple it.

Meanwhile most people just do the traditional thing

What if you ask your AI to make it for you based on the site?

Also, the Web is already open source

Because when you are trying to put out a fire, the fact that the fire extinguisher can fall over a year from now, is a really irrelevant reason not to put out the fire.

Right. But it can’t, for several reasons: 1) The proxy is open source and much simpler than PHP runtime or a web application. Its code only takes input and generates output. It is basically a pipe. It has no other capabilities to exploit. 2) The operating system, such as BSD or Linux, supports running processes under a user and enforces limits on that user. So you just jail this proxy — since it has one purpose. Unlike your application, which may do many things and you can’t restrict it, it may become a confused deputy

I wonder how much of their output is simple raw “superpositions” and how much is from far more generalized emergent structures as it is trained and has to learn latent representations.

Only the first layer is a “mashup” of the raw data, other layers start to recognize patterns across the data!

Right. But it can’t, for several reasons:

1) The proxy is open source and much simpler than PHP runtime or a web application. Its code only takes input and generates output. It is basically a pipe. It has no other capabilities to exploit.

2) The operating system, such as BSD or Linux, supports running processes under a user and enforces limits on that user. So you just jail this proxy — since it has one purpose. Unlike your application, which may do many things and you can’t restrict it, it may become a confused deputy

What this has taught me is that we should decouple as much as possible into microservices, so that we can properly sandbox each service, and that way we have chokepoints.

Well, PHP is in C, and I know C much better — but certainly this proxy is so simple, an LLM or even a mechanical program could transpile it to Rust or Go.

Either way, memory leaks here aren’t too relevant.

I just posted about it here a half hour ago: https://news.ycombinator.com/item?id=50197861

Well yes, but we have to think logically.

Relying on this patch, you're only protected against these specific CVes, but in general a proxy can protect you from more. It's strictly additive security, right?

And if you can't or won't patch your PHP, this is strictly better than getting pwned and having your PHP-FPM execute arbitrary commands. That's as bad as it gets, and you better hope that Linux user permissions can constrain it, but your apps are basically gone. PHP-FPM even allows PHP to overwrite .php files, meaning next time they are hit, it's completely arbitrary code that persists.

As a side note: https://qbixserver.com is a project I started several months ago, that is a pure PHP server without needing nginx, and it forks after loading your classes, instead of preforking like php-fpm. It's not vulnerable to php2shell, and it is able to rewrite php code on the fly when it loads it, to make it more safe. It does things like disallowing your php scripts to write to .php files, and it makes require($filename) check that $filename actually ends in .php ... a lot of stuff like that.

The security added by this proxy is strictly additive, it can't make things worse. This proxy can be run by a Linux user with no permissions at all, so it just transforms input. Can it have a sleeper code that transforms input in a way that causes your PHP to do something even worse? Well, this is why you should point Claude at the repo and ask it if it has any backdoors. It's completely open source and GitHub actions has been used to build the binary. So I guess if you don't trust GitHub, you can also compile it yourself, but then you're trusting GCC. (Ken Thompson has an interesting talk on Trusting Trust of compilers, from 30 years ago.) But at this point we're way past what people usually are concerned about.

Love it! Finally somebody gets it.

I got downvoted heavily by other HNers for merely offering a solution to protect people’s legacy PHP servers. They said it should be deleted and “not worth working on”. The solution was free and open source but these downvoters commented as if it was worse than having your server PWNED. I still don’t understand why.

For those who can’t patch their PHP for a variety of reasons right now, here is a proxy I developed that can sit between nginx or apache and your PHP-FPM, to sanitize inputs and prevent this (and other) attacks:

https://github.com/Qbix/proxy

Verify it

GitHub actions builds from source

Yes, PHP maintainers have released a patch for the latest versions of PHP.

If you're running earlier versions, or you're on a host that maintains PHP for you, you're unprotected... for a long time.

This is a proxy I have quickly put together, to use on our own legacy environments. It's free and open source (MIT license).

Recommendations:

1. Run it under a Linux user with no permissions to access any files. It's just a pure proxy -- transforming input into output on a network port.

2. Modify your server files (nginx, apache, etc.) to use the proxy in proxy_pass etc. before it hits your PHP. Boom, your apps should be protected.

3. As with any git repo, run it through an LLM. Do not take my word for anything... if you find any bugs, please submit a pull request.

Hope this helps the community that hosts websites with PHP! (aka 80% of the web)

Out of memory?

Yes. Take your PHP service offline for the next year, until you can find a way to migrate it off your host and rebuild the PHP yourself on your environment. That'll help.

It's not exactly a common situation. This is an emergency for many people. They are vulnerable and unprotected, and UNABLE TO PATCH their PHP... what do you recommend them to do?

This is MIT open source, run it through your own LLM. If you find a bug, submit a fix.

If you're paranoid, launch it as a Linux user with no access to any files. It's just supposed to proxy some network requests.

Oh it's been killed by someone?

What does that even mean?

Shit, some people on HN sure don't want any timely mitigations to be available.

It's free, MIT open source. It was the best I could do. Run it under a Linux user with no permissions to access anything. All it's supposed to do is proxy requests. Don't give it access to any files.

You're right, you should just leave your PHP totally unprotected.

I would recommend running this binary as a user that has no access to any files, it can just proxy traffic through a port. I will put that in the README.

You're right – need to fix the Cosmopolitan build in GitHub actions. On it!

UPDATE: Just going to ship a Linux binary for now, that's where most hosting is. Almost no one hosts from a MacOS or Windows machine. The Cosmo binary was overkill here.

I have heard Kirill Firsov say that, but does anyone even know the vulnerabilities? Could be a meme.

It isn’t just free. It’s effectively anonymous.

Most hosting (eg AWS) requires you to say who you are, provide a lot of ID. I think some don’t at first (eg Azure, Hetzner) but eventually you need to pay via a credit card, include your actual name etc.

With Cloudflare, you literally only need an email address. It continues to be free.

The second best is Hostinger, where you can pay with crypto.

Github pages is great too, but you don’t really get all the power to customize your own website.

No, the top US export is still USD.

That is how we get all those imports cheaper than most countries. Trump just made a deal w Putin for example to import Russia’s diesel … in exchange for USD.