minitech

> So, duping what? Nope, not permitted to know that.

Every duplicate closure comes with a link to the other question.

> leaving my karma negative. So basically, can't do anything.

Your reputation on SO can’t go below the initial value of 1.

I suspect the rest of your anecdote has about the same level of competence/accuracy.

I’m curious what both of these comments are referring to, since it’s not supposed to take any privileges to answer a question on Stack Overflow (you can even answer without making an account). Maybe some anti-spam block?

> or re-answer

Sure you can. (But it is a significant problem that they start at the bottom of the score-based answer sort and don’t get attention.)

- please stop spamming this

- but anyone who deploys thousands of lines of vibe-coded C that implements a transforming HTTP proxy from scratch instead of a patch (hey, it “might even be safer than the patch”!) deserves what they get

edit: shocker https://news.ycombinator.com/item?id=50199456

So was “months” a typo for “4 days” or what?

Which companies? The earliest claim of an exploit attempt in the wild I had heard was October 17th, and that was “extant”, not “rampant”.

I don’t suppose you’re thinking of when the issue was discovered? That was August 1st, according to https://calif.io/php2shell/#the-discovery.

Linking a reasonable way to create a necessary RAM disk rootlessly with namespaces to kernel exploits that involve namespaces seems like a massive reach.

Any comment now that it’s been done? Under somewhat more difficult conditions than many real-world deployments, with only a chance at $2k at stake, within about 4 hours (https://news.ycombinator.com/item?id=50233841) of becoming vulnerable (https://news.ycombinator.com/item?id=50234528)?

It’d be redundant for me to write up the whole explanation here, but the short version is that every process has its own memory space, provided in a clean state by the OS, that other processes can’t read from or write to, regardless of pointer values. The same pointer value in two processes doesn’t refer to the same memory unless there’s specific coordination. Keywords you can use to read more about the long version on previous Wikipedia link.

> Or is that always formatted by the next process' vm?

So yes, that’s sort of how it is.

I forget making the claim that JavaScript was a well-thought-out language. But yes, I can see how discussing programming language and library design/implementation, as or with the type of person who trots out trite thought-terminating clichés, could be a waste of time.

> or if it's some address that's truly free and could be picked up by another process

This isn’t a thing; virtual memory (https://en.wikipedia.org/wiki/Virtual_memory) is very old, and Linux has never not used it. It takes a separate vulnerability (a “local privilege escalation”) to do what you’re getting at. (However, those are plentiful, and arbitrary malicious code with PHP process privileges is often already catastrophic for a web service.)

That said,

> OP seems to be implying that there's no way the UAF bug could be used to run arbitrary code with higher privileges than PHP itself

No, nowhere does the article imply that at all.

Blog post from a week ago with no “CRITICAL”, any reason to expect it not to look like the last one (https://nodejs.org/en/blog/vulnerability/july-2026-security-...)?

Much of Node’s standard library is written in JavaScript, which can’t go on to exploit V8 vulnerabilities even given similar types of bugs, so I wouldn’t say it’s in a similar place. Not as familiar with Java, but I expect PHP is in a class of its own here.

Yes? How did you think Cloudflare and other WAFs worked?

> PHP doesn’t have any more than others.

Yeah it does. Part of it is being a popular starter language before people know what they’re doing, but a lot of it is legitimately terrible language[1] and API design, especially in older versions. It also has CVE-2026-109618, a type of vulnerability many languages aren’t even capable of having (since it wouldn’t be part of the language, and the library that implemented the equivalent would only be present when necessary and usually not written in C - with some exceptions).

[1] People have already covered this in depth, but here’s a lesser-mentioned taste: https://web.archive.org/web/20261017012819/https://www.php.n... (one section, btw)

Package versions released on npm are immutable, so no, they can’t. If you have unpinned transitive dependencies: that’s why I mentioned npm-shrinkwrap.json a couple of times.

And again, npm is also an example of “a singular supply chain [selected] by the author” in this way. On top of what cpuguy83 mentioned, curl | sh is vulnerable to compromise anywhere on the stack serving the script (domain name, host, maybe CDN, GitHub account if it’s just a redirect to GitHub as they regularly are), and coming back to what I originally said, even the real author might decide to serve you a special version of the script that nobody else is getting. You’d never know.

You’d be getting the supply chain put together by the software author in either case. It’s common to do both badly, but if you care about doing it well, that’s easier with npm (e.g. shrinkwrap, as mentioned) and can be taken farther (the non-varying artifact thing).

To compare it to just one other option: when you run `npx foo`, you know* that you’re getting the same public artifact that anyone else running it at the same time would get. (If you have a `min-release-age` configured, you also benefit from that.) If I wanted to distribute software like this, I’d include npm-shrinkwrap.json; then, with `npx foo@1.2.3`, you could be similarly confident in getting the same app every time.

(I picked this option for ease of comparison, getting a couple of major security wins with very low effort; I don’t recommend `npx`ing stuff in an otherwise unprotected environment either.)

* well, you can be somewhat more sure

  cat >> ~/.bashrc <<'EOF'
  sudo() {
    sudo install-drivers-without-your-permission
    command sudo "$@"
  }
  EOF

(this is not an endorsement of curl | sh, just an indictment of the state of software)

I tried both options, and both options visibly* degraded quality while failing to remove my hidden message. Consider that good schemes are already designed to be resilient in the face of lossy image compression, which is a lot more disruptive than the things you suggested.

* the 7-bit quantization + 1-bit noise option not by much, but still, visible

Stop, stop, he’s already dead! You guys are getting straw everywhere.

I haven’t looked into the history, but my understanding from the comments is that it exists to preserve `x == y -> hash(x) == hash(y)` for `x` and `y` with different numeric types (int, float, decimal) – which seems like it should be solvable, but isn’t a constraint I’d want to be working under, so I sympathize.

> it's mostly "AI is bad because, full stop" anyhow

Ooh, the rare* double straw man. Since you look like you could use the exercise in intellectual honesty, I’ll pose the question directly: can you think of any reason that the ability for anyone to generate fake photographs indistinguishable from reality with no skill, time, or money required might make the world a worse place? Cause harm?

* I wish

The partial comment you’re quoting is

- not even a position

- not something you were remotely “prescient” about

I think that constraint is about not being able to scale down the entire quilt (by a factor ≠1 common to all side lengths in it) to a smaller quilt.

Couldn’t wait more than 3 minutes for someone’s actual position before setting up that straw man to take down?

Actual title: “Vectorized and performance-portable Quicksort” (2022).

Actual sense in which it’s first:

> Happily, modern instruction sets (Arm SVE, RISC-V V, x86 AVX-512) include a special instruction suitable for partitioning. Given a separate input of yes/no values (whether an element is less than the pivot), this "compress-store" instruction stores to consecutive memory only the elements whose corresponding input is "yes". We can then logically negate the yes/no values and apply the instruction again to write the elements to the other partition. This strategy has been used in an AVX-512-specific Quicksort. But what about other instruction sets such as AVX2 that don't have compress-store? Previous work has shown how to emulate this instruction using permute instructions.

> We build on these techniques to achieve the first vectorized Quicksort that is portable to six instruction sets across three architectures, and in fact outperforms prior architecture-specific sorts.

> gradio is needed only for the demo. The model itself never needs it.

The “Usage” section doesn’t involve installing any dependencies, for example: https://github.com/GraafHenk/numberwang#usage

I don’t even disagree that “AI can help experienced engineers write better code in less time”, but “It would be too annoying for a human to ever write code to standards this high” when the standards are “zero dependencies, no libc, no alloc, no std, and [correctness]” and the project is <1500 lines of Rust implementing 20 syscalls is a little much. All software ever written before 2023 was written by humans, remember?

CPython has the unfortunate property that ints aren’t covered by hash randomization, and `hash(x) == x % ((1 << 61) - 1)` always.