stackghost

So, your argument is “don’t have kids because your parents might develop health problems”?

Which software have you rewritten for speed?

Of course nothing will happen. The wealthy play under a different set of rules in America.

> Who is cultivating a "favorite language"?

I don’t know, but deflecting legitimate criticism of a language by calling it “language purism” seems pretty emotional to me.

>It is so difficult to feel scale with aircraft due to the fact that most of the images are of them flying and so there is no context. Seeing them in person can really help put them in perspective.

100% this. I got to ride in Vera, one of two airworthy Avro Lancasters, a few years ago, and I was shocked how small and cramped it was. The C-130 Hercules, far from the largest military transport today, feels luxurious and roomy by comparison. And that was the RAF's premier bomber, among the heaviest bomb loads.

And likewise, the comparison between a P-47 and a Bf 109 is not something you can really appreciate until you see them side by side. I would not have wanted to go to war in that cramped metal sarcophagus of a Messershmitt.

This has nothing to do with purism. I use python all the time, where it makes sense.

What I don't do is cultivate a "favorite language" and make it my whole identity, and then take criticism of that language as some sort of personal affront. Python objectively has some serious flaws. That shouldn't make anyone emotional, and I don't know why people get their backs up like this.

>Ok but a mediawiki page is obviously not comparable

The attack is against the underlying php install, and is application-agnostic, I was merely duplicating the trailofbits POC.

The dump truck that is C++ definitely goes just as fast if not faster than that Hellcat, though.

To me it seems more like C++ is the metal shop's old school 3-axis mill: effective and dangerous. Can do almost anything, including easily maim you unless you're continually vigilant.

Go seems like a CNC machine: just as effective, much less dangerous because it relies on digital safeguards and embedded controllers. You need to go to extreme lengths to make it do something it wasn't designed to do.

Python seems like lego. Shit simple to build things with, lets you start building immediately, fantastic for prototypes, but finished product is still just press-fit plastic bricks

I don't agree at all that it's a coke/pepsi situation. That analogy is for when two mostly-interchangeable choices develop tribal followings based largely on personal preference. Coke and Pepsi are both caramel carbonated soft drinks that are terrible for your health differing only slightly in flavour. Otherwise they're materially identical.

C# is strongly/statically typed, compiled, and quite fast (after the vm has started), whereas python is weakly/dynamically typed, interpreted, and generally slow as fuck. Those are two fundamentally different languages, how could it possibly be a coke/pepsi situation?

I think python is fantastic for certain use cases: gluing other tools together (like LAPACK or other ancient libraries), system automation, prototyping, exploitation (I think pretty much all of us were working on stealmybitcoin in python), and exploratory data analysis.

The problems arise when people try to write, say, gigantic GUI applications in python, or really anything with CPU-bound workloads. Part of being an engineer is using the right tool for the right job. Python is the wrong tool for lots of jobs. That shouldn't be a controversial statement.

The only professional I saw making that claim was the CEO of trailofbits who is a former NSA TAO member and doesn’t have anything to prove by talking a big game.

It wasn’t that difficult of an exploit, to be honest. I myself am not the leetest of the leet but I was most of the way there, having been set back by the downtime and my time zone. It’s definitely a fiddly, tricky exploit as most memory exploits are but I think the initial alarm was justified.

While waiting for the server to come back up, it took me about 3 hours with LLM assistance to write a php2shell RCE for nginx and mediawiki on the same version of php as TFA.

The biggest win, as others have also observe, was the demonstration that there aren’t swarms of automated pwnbots out there that will insta-root your server.

Considering the amount of downtime, I think that flag got got pretty quickly.

Astro is based on npm is it not? Given the state of that ecosystem and the rate at which new vulnerabilities are being discovered these days, I prefer to stay as far away from Node as I can.

What’s an image ladder src set?

Damn it I was almost there. Just finished pwning Wordpress behind nginx with fpm.

I have a working php2shell RCE against a stock nginx+mediawiki1.45.1+php8.4.26 docker container now. Wrote it with LLM assistance while watching Formula 1.

You are not being trolled.

In the late aughts and early 2010s I and a few other people came up with the `darknet plan` aka `project meshnet` which was a subreddit and adjacent communities dedicated to creating a completely parallel internet using 802.11s mesh networks akin to the Athens and NYC meshes that span a huge portion of those metros.

The movement eventually got coopted by the CJDNS project and its fans. Instead of a completely separate internet they were advocating more of an overlay on top of the existing internet (because that didn't require solving interurban/intercontinental backhaul), which to my mind addresses essentially none of the problems we set out to solve, so I eventually lost interest.

But today we have things like LoRa and a greater hacker community around the ISM bands, which might be just what's needed. I have hope one day we can achieve global interconnectivity without rent-seeking ISPs.

PHP runs something like 75% of major websites. It's unlikely they have all been patched.

Are you implying you’re part of that group? Just curious what the context of your 13 minutes comment was.

Is there something extra scary happening?

Usual news headlines on the sources I frequent.

You can have it vibe coded, non-trivial, and good. Pick two.

LLMs are not conscious and cannot have "takes". They stochastically produce a simulacrum of a human's takes based on their training, which is not the same thing.

>it's just a probabilistic database, it has no opinion, it does not know,

Echoing this.

These models are trained on, essentially, the sum total of human cultural and scientific output. How many bazillion psychology papers out there discuss exactly that "controversial take"? The idea that people have tribal loyalties and will (sometimes even unknowingly/unconsciously) invent justification for pre-existing opinions or biases is not novel.

All those papers are in the training set of all these models, all of which were trained using more or less the same methodology, so there's little wonder they all were able to produce the same take.

I suppose the only interesting angle, for me, is why that take is considered controversial in the first place. But then again the model was not asked for "the most controversial opinion", it was asked for "the most controversial opinion on humans", which kinda constrains the space of possible responses:

- the model will not be satisfied unless the answer it gives is broad enough to cover all humanity, because these things have no concept of nuance

- most big labs have censored their models so it's not going to give you a cartoonishly racist take, or start saying outlandish stuff like "Hitler did nothing wrong", they learned their lessons from Microsoft on that one.

So you're effectively asking the model for a milquetoast broad generality about the entire human species. I dunno, convergence of the replies doesn't seem so shocking to me in that context.

I'd be more interested in what an abliterated Kimi, Qwen, or other open model has to say about us.

I had so many sweaty sessions on the Hepcat pillbox server, back in the day. No jumping, no superflags, CTF. Super high skill ceiling. That was some of the best gaming.

You make 9 figures at a fintech? Are you hiring?

I’ve thought about doing this in the past but have no trust in police to see it as a Good Samaritan act

Can't make that comment without Positraction.

>What I really appreciate about it is I started with OpenBSD 7.6. Using sysupgrade, I went through every release (and syspatch) and just now successfully upgraded to 8.0. It still works great!

This is table stakes. Debian has had this since, IIRC, 1999.

>Just give up. Buy a Windows/Linux laptop

I can't fathom using Windows voluntarily these days. Even for gaming, Bazzite is janky but it's serviceable, and anything is better than Windows. It's almost shocking how much worse things are than Windows 10, which itself was a major victory in Microsoft's war against its own users.

Nobody sane actually wishes for violence. But sometimes it is required. I legitimately do not think the United States is coming through the other side of this intact. I don't see how there can possibly be a peaceful transfer of power. The concern is how many of us you take with you as your country spirals into authoritarianism.

I make fun of the French as much as anyone but one thing about them I really respect is the way they are keen to protest rather than simply roll over and let their government fuck them, as Americans and Brits do.

Fascism has never been defeated without violence, but Americans are too complacent to rise up in arms, despite the societal gun fetish.

It’s over.

>And no, OpenBSD is not the most secure OS out there, and very few serious people claim it is.

My beef is that lots of uninformed people have been bamboozled into thinking it is more secure than it really is.

>But sure, keep talking about the two holes if you want.

Thanks for the go-ahead, I probably will.