orkj

From the reporter of the React vulnerablility, Lachlan Davidson

very interesting to read.

However, if I am reading this correctly, your PoC falls in the category described here: https://react2shell.com/

> Anything that requires the developer to have explicitly exposed dangerous functionality to the client is not a valid PoC. Common examples we've seen in supposed "PoCs" are vm#runInThisContext, child_process#exec, and fs#writeFile.

> This would only be exploitable if you had consciously chosen to let clients invoke these, which would be dangerous no matter what. The genuine vulnerability does not have this constraint. In Next.js, the list of server functions is managed for you, and does not contain these.

Context: This is from Lachlan Davidson, the reporter of the vulnerability

> what is an auth description?

They are probably referring to the text in the basic auth "pop-up" which is usually set like

WWW-Authenticate: Basic realm="my text"

Did you see this one? https://www.casio.com/europe/watches/casio/vintage/product.A...

This sounds like a great idea for a feature for the OP. Cool feature to kickstart the database. Take a photo. Something something AI. 150 rows filled in

Seems like general good advice, but for me it was simply a matter of `atuin import auto`. The initial response was similar (as in, here is no history, where is my history, this is useless). Then I read this page where it said to import, which seemed relevant:

https://docs.atuin.sh/

Not sure if that was the missing case for you, but just in case someone reads this and gets the same feeling as me

The description of the repo is "A compendium of absurd "open-source" licenses." Which I think is relevant to change the title to (the addition of the word "absurd" specifically.

The word "bad" is also used several times, and can be argued is also useful to put in the title

Tangentially related: I have been having a ton of fun programming for the sensor watch lately: https://www.sensorwatch.net/

Granted it's far from as smart as pebble, but that battery life... ♥

Built https://violinist.io, a PHP / composer update service in 2017 and it passed that figure probably something like 2021?

Does something like this exist for my phone, android specifically? Any good recommendations?

It's mentioned in one of the first references in this article:

https://boehs.org/node/everything-i-know-about-the-xz-backdo...

IRC activity

This made me think of http://prose.io which I remember was a thing 10 years ago. Pleasantly surprised it still is a website, not sure if it still works. But I remember the basic idea being similar, except Jekyll only.

If you are using some of the library packages (i.e nodejs / ubuntu / golang), you can resort to using ECR Public:

https://www.docker.com/blog/news-from-aws-reinvent-docker-of...

To quote the example in the article:

You can pull the images by simply switching from using docker pull ubuntu:16.04 to docker pull public.ecr.aws/docker/library/ubuntu:16.04. We automatically push images to ECR Public when they are updated on Docker Hub so you will get all the latest releases wherever you pull from.

$ docker pull public.ecr.aws/docker/library/golang

@technics256 But also not as a reply, so it's more visible:

I have had luck with using Amazon ECR Public https://www.docker.com/blog/news-from-aws-reinvent-docker-of...

To quote the example in the article:

You can pull the images by simply switching from using docker pull ubuntu:16.04 to docker pull public.ecr.aws/docker/library/ubuntu:16.04. We automatically push images to ECR Public when they are updated on Docker Hub so you will get all the latest releases wherever you pull from.

Replying to myself. I guess I read that a bit too quickly:

> In Node.js, the answer involves a WebSocket to TCP socket proxy, Asyncify, and patching deep PHP internals like php_select. It's complex, but there's a reward. The Node.js-targeted PHP build can request web APIs, install composer packages, and even connect to a MySQL server.

Hm, that sounds very interesting and promising

I did know of those, I'm just assuming its going to cause some sort of problem with network calls and sockets and what not (they mention this specifically as part of the caveats)

Genuinely curious: does this mean you can run WordPress as a cloudflare worker (ignoring database for now)? https://developers.cloudflare.com/workers/runtime-apis/webas...

> There's another thing that really split the community, many want automatic security updates to Drupal core, but the Drupal core devs have taken a hard stance against this.

That might have been true at some point, but certainly is not the case anymore. In fact, automatic updates is a "strategic initiative" for Drupal core:

https://www.drupal.org/about/core/strategic-initiatives/auto...

This still means there is no out of the box way to update Drupal core automatically _yet_, but you can in fact do so with a contributed project, developed and maintained by people that are contributing to the core initiative.

It's in the FAQ in the readme, which links to this issue: https://github.com/go-gitea/gitea/issues/1029

Basically... They're working on it

I feel it's relevant to mention this post is from 2014 (reference: how I interpreted the archive at https://danluu.com/)

For those not familiar, there is a "useless use of cat" (https://porkmail.org/era/unix/award) which I have a feeling this title is referring to

> And lastly, if you're reading this, Daniel Coffmane #1687979, whoever you really are: Well played.

I went to read the comments here to see if Daniel somehow acknowledged this

Having so many issues. Cloning repos, setting up containers for the actions. Downloading packages with the API, logging in to the container service. Just, everything really. Totally killing my efficiency today, I am sure I have retried dozens of CI jobs by now. And nothing on the status page.

What about the thing that we for some reason slapped on there with pride? "Made with notepad". Remember those buttons/ribbons?

Thanks everyone for validation. I just told them that there are 2 options:

1. Change the response times by a lot and find a price for that.

2. Not continue the conversation since the product does not meet their requirements

I am confident this is the right decision

Thanks. They are not paying six figures, no :D

Great advice! The wording in the draft does not even mention that the SLA should have a fee, so I don't know if they expect it to be flat or if they are trying to trick me into getting it as part of the custom plan I am offering them ;)

Very good points, I will for sure use this mentality when getting these details in

>Consider suggesting a very lax but cheaper SLA to them, they might not care much, maybe it is just a check-box on their end?

Also a very good point, and something I asked them about. Could be just copy paste and that they really don't need those numbers towards me.

Otherwise thanks for the great advice!