codedokode

"Standard shell" also should allow Ctrl + C for copying, it makes no sense to use a different combination for console.

UNIX doesn't exist anymore, and C has lot of negative points (easy to create buffer overflows, integer overflows, use-after-free, and other vulnerabilities).

Emacs is probably older than me why should we care about what they used in 80s?

Why are they using weird key combinations instead of traditional Ctrl + S, Ctrl + A, Ctrl + C used in desktop applications? Why every console program wants to be a special snowflake and not use standard key combinations, please explain. I do not care that 40 years ago someone used Ctrl + C to send SIGINT, it is 2026 now.

The problem is too few lines of code and controls can fit on a small screen. How many lines of code fit on your 12 inch screen? On my screen there are 40 lines and some space for window headers and top bar.

I remember when software asked for a permission to check if there are updates available. Commercial software became complete garbage.

Mandatory EULA must be banned. Any device must be usable and provide all features advertised without accepting an EULA.

"bestest" CPU is not required, but with 13 inch screen you have to either make everything tiny and strain your eyes, or have only 10-15 lines of code in the screen. Also, modern websites and apps use gigantic font size and you will have like 3 paragraphs of text in one screen.

No, I do not. How does this solve the small screen size problem?

I read that Chinese found a way to upgrade DRAM on GPUs, for example, making RTX 2080 Ti with 22 Gb DRAM, or RTX 4090 with 48 Gb. The modded cards are better (by price and RAM size) than the new ones manufactured by NVIDIA, although some say they are not reliable.

13 inch screen is a toy usable only for browsing social media and not for real work.

It costs like how many standard laptops? 3 or 4? They use the most expensive CPU (but not having best cost/performance ratio) for example.

What is the profit for a manufacturer if you buy one laptop and use it for 10 years straight instead of buying a new one every 3 years?

Also they not only solder DRAM, now they solder keyboards so that you cannot replace it easily. My garbage keyboard broke after just 2 years of using and I had to solder ~100 plastic pins to replace it (and the replacement keyboard turned out to be not of a great quality).

What a garbage company, artificially limiting the performance.

This is why "right a reprogram" should exist. Anyone should be able to reverse-engineer and reprogram anything that has a CPU.

We use SMS OTP as a second factor. Although banks of course want to save some cents and use push notifications for those who has a mobile app.

In Russia, all banks I tried, are usable via web app (because smartphone apps live only 1-2 months before they are detected and removed from app stores). The disadvantage of a web app is that it is not always-on, doesn't allow tracking users are well as a real app, and cannot display advertisement notifications.

Why not just use a web app from laptop at home? Why do you even need an app on your phone? So that you can urgently transfer money to some scammers you met in the street?

I do not have any banking apps, and I log into a bank account maybe once in month or less often.

Many Android phones are not unlockable without hacking. They use cryptography to protect the bootloader and to get the unlock code for your own phone first you need to provide them all your information.

You can be impolite at your home as much as you want but in public spaces we need to enforce politeness with harsh punishments.

It looks disgusting so I wish there was a hefty punishment and AI cameras.

Great let's pay everyone's fare from your income then.

No the punishment should be harsher, not for an hour but 40-60 hours, or fine of $1000-2000. Otherwise they will never learn to respect rules. Especially in the subway where you cannot "accidentally" jump over the turnstile.

I regularly see how people are not paying the bus fare (here in Russia). And the only reason why they do not pay is because the punishment is light (fine of ~25 USD) and chance of being caught and actually prosecuted is close to zero. So paying does not make economical sense.

Why write? Put your unpatched PHP server to the Internet and someone will show you working exploit.

No, PHP interpreter is written in C where such things happen every 100 lines of code. If PHP interpreter was written in Rust, this vulnerability wouldn't exist.

To be fair, C has simplicity as an attractive feature (compared to other languages) but being memory-unsafe is unacceptable, so we need either memory-safe C or stop using it.

If the server supports file uploads (like profile avatar), you can upload an image with embedded PHP code in it.

To be fair, 2024's "PHP-CGI" and "Windows" are legacy features nobody is probably using. CGI was a technology to write servers using bash scripts (most popular programming language for Linux) and has been outdated for like what, 20 years?

No. I think writing PoC and exploits is a waste of time and nobody should do it. PoC brings zero value to society and only helps criminals. If there is use-after-free, it is potentially exploitable and needs to be fixed ASAP. If you don't believe the theory, just keep using the vulnerable version.

Just keep your servers with outdated versions and someone will "test" them for you.

Lot of non-working PoC and slop are actually good because they waste hackers time to find the working exploit.

From my understanding, the vulnerability is a use-after-free, i.e. PHP allocates memory, stores pointer to it, frees it, maybe re-uses the memory for something new and then accesses the pointer. So totally exploitable.

Note that use-after-free would be prevented in memory-safe languages such as Java, Go or Rust.

I actually looked through PHP code responsible for parsing POST request body and it's pretty bad [1].

First, there is a huge function, that is hard to read and reason about. Second, instead of proper parsing of "Content-Type" header to extract "boundary" parameter, there is just a set of substring searches which is not correct. It doesn't mean there is a vulnerability but it means PHP can read the header in a way different from a standard-compliant implementation (such as web server, WAF etc).

[1] https://github.com/php/php-src/blob/master/main/rfc1867.c#L7...