WJW

For "research" purposes, no doubt.

So they do it to attract talent then, and not out of charity?

Yes, but it also has many conditionals, for example:

- The faster package may have been available for a shorter amount of time and so downloads have not had the time to catch up yet.

- Many people may not be aware of the faster package, but they would switch if they knew.

- Maybe people are aware of the faster package, but there are switching costs that prevent them from adopting it right now that are greater than the costs incurred from the slower package.

I might be in Cornwall in a bit, so I might take you up on that :)

But yeah, it happens. I could share some stories of me (being responsible for) bricking multiple ~200k circuit boards in a row, if that makes it better. In the end nobody really cared and the world kept on turning. Good decisions might come from experience, but experience comes from bad decisions. It's how it is.

So how does the exploit actually work? The best I can find is that they manage to use the corrupted generic decoder state to write a single pointer and associated PHP type information anywhere in memory, then immediately claim "this is RCE". Is that enough? From my (admittedly limited) understanding of such things, after writing code to the target memory you also need to be able to start actually running it. Or do they overwrite the PHP code (which is somewhere in memory) and then let the interpreter do its thing?

From the related article on calif.io:

> We therefore control where PHP places a pointer and its associated type information. This is application-dependent RCE under both Apache mod_php and PHP-FPM.

Both articles describe how you can end up with freed memory that still has pointers into it. I can understand that this should never be possible, but it seems to me that both articles skip the very important step of how to actually turn this into RCE?

From my (admittedly limited) understanding of these things you would not only need to write arbitrary memory, but also need to be able to jump to the relevant address to execute such things. Or do they overwrite the PHP (byte)code with their own and then just let the interpreter do its thing?

Because websites with news, continuously updated advice, job openings, etc aren't all that static? This type of site hugely benefits from having a easily understandable CMS that you can teach to more or less everyone in 2 days or less. I suffered through a few of those back in my time in the military, where an instructor would teach a class of 20-30 how to build new pages in the CMS

Now are there more powerful tools out there that result in more scalable websites? Sure. My personal sites are built around static site generators for that exact reason. But none of better tools are as easy to understand for non-programmers as wordpress or one of the other click-and-drag CMS tools.

Oh I absolutely agree they should take it offline until the fix is ready, I just mean that the NCSC itself is very much still operational even if their public website is temporarily offline. Like a computer with the monitor switched off.

Well, the public website of the NCSC is offline. Who knows what crazy proprietary stuff they have.

If they were going to implement it themselves it would be unnecessary to faff around with webassembly. They could just keep the native code implementation that they already have.

The problem is that XSLT has so few users that the browser writers don't want to waste any more time on it. Those few people who wrote their site around it will have to either rewrite it to use something else or add some third party webassembly implementation themselves.

Yes, because XSLT won't work in Chrome and Edge anymore.

No it really isn't. People have transmuted a few hundred milligrams of mercury into gold in the lab with multi-million dollar machines, but that doesn't make it economically viable in the slightest.

It would make sense if the AI companies were rationally valued, yes. But they're not, so it's not.

Refining takes big machines and a lot of energy. It's pretty much the opposite of free money, you need to invest a lot to unlock the revenue stream.

Forgive me for being a layman, but where do these new gluons "go"? It seems to me that pretty much all the energy in the bond between to particles is between those two particles.

But then when the energy becomes great enough and it snaps into a new pair of gluons, do those new gluons go anywhere or do they stay in between the original pair of particles. Do the original particles shoot off into the distance because the force holding them together got converted into some new particles?

Is there a link where I could read more? At these super small scales all my intuitions break down so I'd like something more mathematical to get a grasp on things :)

This is true, but in things like OnShape I can do it with two clicks whereas in OpenSCAD it's always at least 20 minutes of thinking and trying out.

OpenSCAD is super cool and my go-to for simple things, but for anything more involved than a cube or cylinder with some cutouts I tend to revert to "normal" CAD programs.

Perhaps, OR it might be that most people in the markets (think that they) are not all that exposed to the valuation AI labs and so their eventual collapse doesn't matter.

Or perhaps they consider the upside from cheap Chinese models to hedge the effect that OpenAI/Anthropic collapsing would have on their portfolios. This would make sense for (hedge funds holding) most companies: they don't really care about who supplies the AI, as long as they get it at roughly the same price as their competitors.

Why would they assume it's a temporary issue though? There's been drama around wordpress for years now, and almost all of it has been around the CEO.

How does this even work? Surely if you are going to move them out, you'd revoke the severance package first?

It would be interesting to see graphs of how similarly "unprovable" sabotage actions have developed in Russia over the past few years. I doubt we'd ever see accurate reporting out of Russia, but it seems like an obvious thing to do for both Ukrainian intelligence and also for the wider West. It's also be likely to be underreported on because neither the perpetrator nor the victim gains all that much from reporting these kind of things.

1. Because many ancient monarchs claimed they had divine backing as the basis of their right to rule. A ruler wearing religious symbols strengthens that association. Chess kings from non-christian countries don't have crosses but go with other symbolism.

2. Because the most famous miracle performed by Jesus is that the crucification didn't stick: he rose from the dead after a few days and ascended to heaven not much later. So the cross is not so much a murder weapon as a callback to the central promise of christianity: that believing will grant you eternal life in Heaven after you die. It should be noted that early christians didn't really use the cross as a symbol btw, that came much later.

Why is this obvious? Beeswax is not particularly expensive I think?

I have bad news to tell you about your "digital" computer.

Using this as a greenhouse vent actuator is pretty cool. It just makes so much sense.

Even normal fridges are a memetic virus, fridges clearly live in a symbiotic relationship with humans. They make our lives better and in return we create more fridges. If they weren't useful to us, we'd stop making more fridges. Any medieval human who sees a fridge would instantly recognize why it's useful and valuable.

OP is right, anything popular is virus-like. Richard Dawkins invented the word meme for this all the way back in 1976.

Maybe this is because I'm not a native speaker, but I'm having difficulty parsing this. What breaks? Do you mean time slows down during the retreat, or does the effect persist afterwards?

It's also true that if you raise you expectations enough then you will never be able to hit them.

Keep in mind that it's not always a case of "shoot for the stars but hit the moon if you miss", sometimes it's "shoot for the stars and suffer crippling burnout for 20 years, after which it's too late to recover to anything meaningful".

Being realistic, for all it's boringness, does have advantages.

Not OP, but there's a nuance. In general there's nothing wrong with wanting to be useful, but it is definitely possible to take it too far.

If you get sick and need care, you are typically not "useful". But that doesn't mean you instantly lose all value. I've had colleagues who would feel almost physically ill if they were somehow not able to respond to an incident somewhere, even if they weren't even on call at that point. Almost all of them burned out at some point and were no longer able to respond to anything, even if they'd wanted to. That's not healthy, and it weakens everyone in the long run.

Resting without guilt comes from the realization that you cannot keep the world running all by yourself. Let others pick up the work when you need a rest, so you can shelter them when they are down.

It's not (purely) the sales and finance people, planes need to be able to get off the ground to be useful at all. I doubt even an A380 would still be able to lift off if you strap a dozen inches of armor plating to every part of the plane that could possibly be reached by shrapnel.

I meant it as satire, yes.