lol768

My favourite part from the first video is how much effort it took to drag up from the bottom of the screen to get back to the home-screen. This reflects my experience with how iOS handles touch gestures in general.. also super easy to accidentally activate "Reachability" mode!

Fully agree. Moved to FrankenPHP's static build (which was ready very quickly) to get away from it. Don't intend to ever use the "official" images again.

> The PHP security team closely monitored and inspected appearing PoCs after the leak but did not identify any functional exploits at the time of release/public disclosure

Okay, but how close did they get? Were they close enough that a determined actor could've (perhaps using an LLM) managed to get to a functioning exploit?

The PHP Foundation should manage it, the Docker ""Official" Images" approach clearly just doesn't work properly for responding to vulnerability patches.

> as of my comment, this is not endorsed by PHP

Are you speaking officially here?

There are various mitigations suggested online, including completely blocking multipart requests at LB level. Is the combination of both effective?

> edit: Mitigation for impacted versions is to set `session.upload_progress.enabled = Off` in php.ini

I think this is only partial mitigation: https://x.com/Dinosn/status/2112717168349712734

I have additionally followed the advice to just ban multipart uploads before the request even touches PHP (luckily my app doesn't use them at all). I do now know if this conclusively resolves it.

There comes at point at which it is better for everyone to just disclose the details and pursue Full Disclosure. I think we reached that point hours ago.

It has been incredibly frustrating watching Twitter and that (potentially, I don't know how reliable the leaks are) being a better information source than anything else, at least so that those of us hosting stuff ourselves can try and explore if there are any defensive measures that can be put in place in lieu of any actual fixed builds being released.

I suspect this is already being actively exploited now.

https://x.com/J4ck3LSyN/status/2112703096443097263

They've now posted a proof of concept as well.

> This stopped once LSP was designed

No, it didn't stop. In my experience, LSPs are still incredibly poor and comparatively primitive vs the actual analysis that JetBrains have implemented. It's night-and-day different in terms of the supported refactorings, actual understanding of the types and the codebase etc.

Also, LSP is just poorly designed and inefficient. JSON-RPC was an awful choice, the specification text is not well-written and the whole thing feels like a Microsoft pet project for VS Code than an open specification that everyone agrees works well.

Resolved, but can still affect customers for up to 4 hours...

So many problems here, and no signs of an updated SDK that behaves properly on malformed input.

> Every other brand's EV is the machine gun.

Nissan have decent BEVs, though - the new LEAF is great to drive.

I know the United States is significantly behind the curve on EV adoption, but I really don't understand who would want this, it's the worst of both worlds.

There are echoes of the incident that happened in 2023, here. There appears to be very little infrastructure in place to validate and reject bad data, without taking everything else down in a catastrophic failure.

https://archive.is/FBjl7

> Accrescent is the end goal for a secure and private app store but it's still in alpha

Note that nobody (new) can submit to it today; the developer console HTTP 503s and is only available to an allow-list of developers.

Yes, and the UK's industry body - Rail Delivery Group - has thoroughly screwed up distribution of the timetable data for this trial... so no online retailers (with the exception of BR Fares) will be selling tickets for the operation. Hardly a fair trial.

Issues seems to be completely broken, just getting unicorns.

Interestingly the API still works for creating an issue (but webhooks weren't fired).

They've also started revoking previously valid tokens. I can no longer use RedReader with the API client I had created for this purpose.

The only winning move now is to start impersonating their app.

If you have a decent IDE, it'll offer you the ability to swap between the "old" and newer way of doing things when you encounter code written in one of the styles.

I can't say I've had any issues getting code using the new syntax through code review though. C# 14 has been out long enough that the team is familiar with much of it, and the IDE is helpful at reminding you to consider adopting new syntax. That aside though, the collection expression syntax is pretty familiar for anyone who's ever written e.g. JavaScript.

> Because Google has more resources to secure their browser

They've kneecapped ad-blockers, when ad networks are perhaps one of the biggest causes of malware installs/page hijacking/other unwanted behaviour. I'm not sure how you can consider Chrome remotely secure in this light.

Same, my Dad ordered it for me at the time; sits on my desk :-)

Yes; many (Alpine/Debian) containers in K8s on GKE for production rail ticketing infra in the UK.

There's not tons of noise being made because for the most part it all, Just Works and that's fairly boring. Perf, memory usage etc gets better every release. As an ecosystem, I'm pretty happy with it. I reach for other languages for smaller microservices.

> The alternative would be that each school develop their own platform for this

I worked at a university which did exactly this, in the UK.

It was a bespoke platform which integrated incredibly well with the rest of the systems the university used because it was designed from the ground-up to meet the institution's needs, there were regular user groups involving academics to understand what features needed to be built/worked on etc. At one point it was all OSS on GitHub too, in case other universities could've found it useful. It handled plagiarism detection (integrating with Turnitin), marking, exam grids, coursework submissions and feedback, seminar allocations, personalised timetables & mitigating circumstances.

The in-house dev team was vastly cheaper than anything SaaS would've cost, as well. It also maintained software for on-campus parcel deliveries, online exams, opinion surveys, a mobile app for students/staff, the SSO system, the course catalogue, car parking permits, a content management system and more.

They already prevent advertising the sorts of foods that contribute to obesity to children, and encourage you to drink less sugary drinks by applying tax to them (though unfortunately manufacturers have responded to this by reducing choice and adding artificial sweeteners instead of selling something at a higher price that can be enjoyed once every few weeks.

I don't think any of this is unreasonable in a country that picks up the tab through both subsidised dental care and completely free-at-point-of-use healthcare.

> They're great for big business at scale

> They are wonderful for big business

I (sadly) completely disagree with this. There are still so many basic things they don't expose, and it feels like you're fighting an abstraction designed for a start-up that doesn't want to think about the complexities of payments at all. For example, you have to fight a battle to get the card IIN exposed to you. There's no way to see the electronicCommerceIndicator (ECI) for Wallet payments (it clearly has it, since it's shown in the dashboard if you dig deep enough, but it's kept from you). For their Direct Debit integration, they apply limits on the payment amounts you can initiate, but there's no way to actually see the current value of what these limits are. The same Direct Debit integration also doesn't let you customise the payment references used (GoCardless lets you do this to identify e.g. individual invoices on customer bank statements).

Some of the APIs clearly haven't been thought through - e.g. for disputes you can't programmatically retrieve the evidence submitted by the card issuer. Which means you can't build any sort of sensible custom integration for handling disputes. And besides, they don't even support pre-arbitration (which the card issuers know about and take advantage of frequently because they know their decisions outwith the card scheme chargeback guidelines cannot be challenged effectively).

Their Google Wallet integration is worse that Braintree's and doesn't support the web-based flow.

There's not nearly enough visibility when things go wrong, particularly with their 3DS integration (which was failing for Samsung Internet browser users for us, and we had to fight to get looked at - nothing ever got published on the status page despite the fact this significantly affected your chances of securing liability shift) and you have to escalate via an account manager to get any sort of useful support case response.

One of the first things I did when I was involved in the set-up of online support ticket system for a GB rail retailer was https://xkcd.com/806/ compliance. If the support request body contains the phrase "Shibboleet" the ticket will be assigned to an engineer.

Equally it's not hard to teach front-line when to escalate, and ensure L2 and beyond are approachable. Even better if L2/L3 can keep half an eye on tickets that come in for anything that looks particularly interesting.

I'm confused, many of these examples state that they don't work in my browser (Firefox) - but the live demo works fine? Are the demos poly-filled?

I've found it to happen much more frequently than that, unfortunately. Usually it's because the modal is two DOM elements - a backdrop, that fades out the rest of the content and sits on top of it/prevents interaction; and the actual consent modal. Websites then use various mechanisms to prevent scrolling. uBlock is often only removing the actual dialog, so you end up with a page you can't scroll up or down and can't interact with.

If you're going to turn the filters on, it's worth being aware of this because it's far from flawless.

Jeez, what a mess. Some of those issues have over 5000 events on them.

I really hope that didn't send emails out to people.

I don't. YouGov's data suggests 77% of the UK populace has a negative view of the brand. Musk has destroyed its credibility.

This looks very cool, some immediate thoughts though:

- "TiXL is an open source software to create realtime motion graphics" - pedantry, but software is an uncountable noun. You cannot have a software.

- It wasn't immediately clear to me from the homepage that it's Windows-only. Appreciate it appears to behave under WINE, but it'd be good to make clearer.

Barclays have always played silly games with this stuff, they used to fund a whole team whose job it was to waste time on security theatre (this was nearly ten years ago).

Plenty of UK banks that don't require this, and whose apps will also work on a rooted device. Monzo will display a warning that sets out the fact there's an increased risk, and then lets you be an adult and choose to continue to use the app if that's what you want to do.

The best part is that the Current Account Switching Service makes it very easy to make the jump from a legacy bank like HSBC.