elevation

> Irrational hatred aside, that's literally what PHP was designed for.

Yes, in 2005 you choose PHP, but in 20 years of operation, you don't revisit reconsider your architectural considerations? A fantastic avenue for hardening any product would be to replace a ~2MSLOC component (the PHP interpreter) with a 10K SLOC daemon that does only what you need.

When you're a startup, expediency and funding prevent this, but by the time you're selling "solutions" and baking designs into ASICs you could have prevented this attack by putting a fraction of the effort into software.

Why does a world-class firewall stack need PHP? I'm sure PAN-OS has some neat DPI features, but I would love to see firewalls that are implemented in FPGA, where the tasking was compiled down to gates to be performed deterministically, much like the low port count network switches we have today.

So this game needs a story arc where you become an accomplice to specific threat group to bring vigilante justice while maintaining plausible deniability by blocking some of their requests without letting your total numbers drop below a specific threshold?

> doesn't know anything about your project

I consulted for a client who cut off an offshore consulting firm after they billed 40 hour for a one line CSS border-color fix change. We were suspicious of billing fraud, but the quality of developers we'd observed wouldn't allow us to rule out hanlon's razor.

Yes, they're in my rotation as well (I never want to have just one provider.) But I liked that DH would maintain the OS, the shared hosting performance never bit me (my sites are all highly performant, no wordpress dogs) so all of my time would be in patching vulns. DH giving me no-root access to a hardened, performant box is ideal all around.

> My local model never says no

In case a future user wants to know what a 2026 model would refuse to do, I needed to rotate dozens of passwords last night both on the server and on the clients. When it was time to verify that the rotated credentials worked, I asked for a script that would rate limit the credential checks. Claude/opus5 (opus!!) refused and stopped in its tracks.

In another instance, Claude was making great headway bringing a legacy Windows app up in WINE until it’s saw “auth” somewhere and shut down. In the shutdown state, Claude asked me to reword the prompt to see if I could get it to act on less dangerous instructions. But when I reworded my request, narrowed the scope to be clearly unthreatening, or even redirected the model, it’s still rejected me. I suspect Anthropic uses the less suspicious rephrasing as training material to increase their rejection rate.

> then blocking the number & reporting spam

I think it's also helpful to be prompt if you'd like to help others; A campaign will use e.g. twilio numbers leased for a matter of hour, then release it. If you wait too long to report spam, you damage the number's reputation without actually punishing the hyperactive spammer.

I love their shared hosting; I have a $100/year account with dozens of little low traffic apps in their own subdomain/user isolation. They maintain the OS, I maintain the app, I can pull code with git and even compile a python interpreter if I need.

I love that I have infinite/unmetered email accounts. In practice I run 3-4 accounts on 2-4 domains, but they don't nickel and dime you on it, I've literally setup 1200 forwarders in the past. They have a good sending reputation.

What other provider does this as well?

Also, you can’t generate a bitstream for a hello world design without getting 10^5 warnings about why the fit for your part could be suboptimal. The signal to noise is awful.

Also, not supporting new VHDL2008 for years and years, and lagging on newer updates.

Another Vivado bugaboo: terrible support for source control.

My current flow is to use the ‘write_project_tcl’ command to export a tcl script that would rebuild the project from a single command. Tracking this in git along with your RTL and constraints should be enough. But the file is jam packed with hard coded paths that have to be carefully removed, or else the source can’t be built on another machine. I wrote a custom tool to post process “setup.tcl” but it is brittle because with every new release, Vivado tampers with the output format.

Xilinx ships IBERT cores so you can test high speed lanes between devices. When you bake them into a bitstream and configure an FPGA, you can read/clear the status of the cores over JTAG via the UI or a TCL script.

Using these cores in particular have revealed a bunch of issues with the Vivado suite:

Inconsistent naming conventions: In a Vivado block diagram, you must figure an IBERT core to use a transceiver by bank number, e.g, Quad 127, Quad 224. But when you get per-lane test results they reference transceivers as X0Y1, X0Y23. The official “packaging and pinout” documentation will help you translate between these identifiers, but you shouldn’t need to: the Towing should use a consistent naming convention in both the design flow and the test flow.

Another issue: incomplete script Support. When you’re viewing the status of an IBERT core over JTAG, you can see a lot of meta data in the details panel, but not all of this information is available in the TCL objects provided to the script console. This means that certain checks cannot be scripted.

Bad UI architecture: all TCL commands run in the UI thread, so long running commands can lock you out of even unrelated actions for minutes at a time.

TCL was novel in the 90s, but it is haggard, and ill-suited to this line of work. Give me python!

> Lie to your colleagues with confidence and ease

https://xkcd.com/1138/

> containers are just processes

Johnathan Blow's talk on the bronze age collapse pushed me to simplify my production stack. I wanted 'just processes', so I stopped using docker there. I'm happy with the result.

In recent years we have also witnessed the outcomes from DAs who refuse to prosecute -- having someone more hard nosed in office seems vastly preferable to losing the local Walgreens and still not having my burglaries prosecuted.

We like convictions because there's a hell of a lot of actual crime that is never punished. Just my circle of friends has suffered car break-ins, burglaries (no suspects), grand theft auto (never recovered the car), and devastatingly, a rape on school property. Most of these crimes weren't investigated, despite real damages, and the couple that were never saw a conviction.

> physical security system

> can be trivially MITMed

Crazy how poor security can be even from a purported security vendor.

> cannot afford to get on the property ladder

The American Midwest would like a word.

If you don't mind being a couple hours drive from anywhere Taylor Swift would play, you can find affordable property, a good community, and amazon prime service. Any town that lacks tech work opportunities will still have solid internet from Starlink to support remote work.

There are awesome opportunities if you look.

Thanks, I appreciate it!

> World Wide Web

Embrace, extend, extinguish

> it’s quite the evolutionary trait

I’m not sure about that. Evolution has two mechanisms: mutation to roll the dice for new traits, and natural selection against any traits that hinder survival up to the point of successful reproduction.

Because this ovarian trait only manifests well after reproductive function it cannot be explained by selection pressure; the remaining culprit would be happy mutation.

Yet while every post-reproductive trait is free to vary without selection, but this one appears to be unvaried across the entire class Mammalia. What force would preserve a non reproductively-advantageous trait so broadly?

It doesn't take secret meetings; the industrial players are subject to regulatory costs that a small local farmer isn't. When "big egg" had to slaughter millions of layers because of a birdflu outbreak, then sell a limited amount of eggs while they waited for new chicks to mature, your local farmer's birds kept laying without an interruption in production or a sudden repeat of the startup costs.

> requiring a human to [...] hand write the pr

> they still have an ai do it all for them

What recourse do you have when employees do not perform the work you're paying them for?

I couldn't find a link, but there's a Bizzaro strip that shows a sculptor putting the finishing touches on his latest work: an elderly mannequin made of peanut butter and bird seed, dressed and seated in a wheel chair. The artist smiles as he imagines the reaction he'll get when he wheels the sculpture through a park full of pigeons.

> Unless a startup fab decides to build its own EDA stack and open-source it as a way to attract customers

An excellent insight -- good tooling could be a differentiator for a US fab looking to compete on something besides price.

I wonder if an Alphabet or an Elon Musk would be willing to buy one of these and open source their software tooling. Same for Xilinx.

Open source tools could grow the market by letting many more creators afford to make designs, effectively commoditizing the manufacturers complement.

It deputizes private institutions to violate Americans’ 5th amendment rights with no evidence, warrant, or right to face our accuser.

When bootstrapping self hosted infrastructure, you cannot rely on the presence of the services which you have not yet set up. So while your normal devops scripts can count on an OpenBao instance, your bootstrap scripts need something smaller and self contained.

Keepassxc has been perfect for this. A clean UI allows humans to navigate if needed, and keepassxc.cli provides enough surface to let a script generate a .env file as part of a bootstrap or disaster recovery process.

> You can't authenticate a person using their (public) fingerprint information.

Yes, but it's a signal! There's a cost to spoof it. A scammer could cheaply start a VM that clones your font profile, but at what cost could they replicate your CPU SKU and GPU combination to provide identical webGL timings?

Other signals include the ability of your employee to show their face on a video call, to sound like themselves on a voice call, the ability contact you from their home IP, to receive official mail at their listed address, to produce a second 2FA token you'd previously registered (but not activated) or repeat a code word you'd exchanged. Any of these things can be spoofed, bypassed, copied, or burgled, but each one imposes some cost on the attacker.

The question is how to surface this information in a way that equips help desk staff and doesn't deceive them into authorizing unnecessary risks.

> Do you have any advice for aspiring bug-bounty hunters?

We're probably at the end of the era of these kinds of big payouts. AI tools will drive the going rates to approximately the costs of the tokens. Bounties exist to make it nominally more economical for researchers to report exploits than it is to resell them.

How could this information be surfaced in a reasonable way in administration software?

Say I have a remote employee who is only able to access your internal systems via his yubikey. His fingerprint is "Genuine Antelope".

Next week, he accidentally damages his yubikey. He has another one in the drawer, but I need to authorized him. I create a new session for him on the provisioning portal (so he can enroll the new key) but now his fingerprint is "Interesting Elephant". What do I do with this information?

It might be better to log the exact forensics and show the administrator the differences, e.g, "User has a new font called "my_handwriting.ttf" since a week ago", or "appears to be a totally different processor, and the new system has Russian fonts installed".