lambalicious

@lambalicious@lemmy.sdf.org

• ⁨Comment⁩ on ⁨For users with public facing services: How does the current explosion of AI-discovered vulnerabilities affect your threat model and willingness to be public facing?⁩ ⁨⁨1⁩ ⁨day⁩ ago⁩:

  My threat model is not changed: I want to serve something and I want to not be busy with "oh suddenly there’s a two PHP vulnerabilityies. My enemy is the world, but that is not really unchanged from before in a world where there exists capitalism and rent seekers want to collect from us even for breathing. I’m not intended to be unpaid tech support. So I just serve the things with reasonable scopes (under wireguard, or in a borrowed VPS, etc) and let it go. If an automated system manages to find a hole, computers are so fast that it’s not going to make a difference if I’m sitting in front of the chair vs enjoying some modicum of social life visiting a friend three cities away.

• ⁨Comment⁩ on ⁨⁩ ⁨⁨1⁩ ⁨day⁩ ago⁩:

  So a multipart form “zip bomb”? Sounds like the kind of thing that would do… well, that. But also, by that point you don’t even need a WAF to block it, IIRC multipart forms can be disabled or their memory limit clamped on php.ini.

  (Not that I’d rely on that; not everyone has access to php.ini. But then again, we are talking about a world where there are more than one (1) ways of dealing with problems)

• ⁨Comment⁩ on ⁨⁩ ⁨⁨2⁩ ⁨days⁩ ago⁩:

  Yes the vulns are real. No that does not mean a system with the vuln is automatically and noticeably exploitable: that assumes there are no other defense systems or simply other happenstance logical walls around (firewalls, datacenter range blocks, seven proxies, 28 NATs, Anubis, whathaveyou).

  My understanding is that CVEs are ranked not by Real World conditions but rather under an “idealized threat condition” that imagines your machine is essentially connected with a straight wire to the root DNS serves of the internet, given a public IPv4 address, and the off switch is dislodged or somehow made unavailable.

• ⁨Comment⁩ on ⁨PSA: PHP warns it plans to release 2 emergency patches imminently (today 14:00 UTC)⁩ ⁨⁨3⁩ ⁨days⁩ ago⁩:

  Hey, never said I was laughing out of happiness… 😭

• ⁨Comment⁩ on ⁨PSA: PHP warns it plans to release 2 emergency patches imminently (today 14:00 UTC)⁩ ⁨⁨3⁩ ⁨days⁩ ago⁩:

  laughs in keeping an old archive site still in PHP5

• ⁨Comment⁩ on ⁨⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:

  This is quite simply solved by using in your presentation a site that already rebrands Anubis.

• ⁨Comment⁩ on ⁨Lutris v0.5.21 and v0.5.22 arrive with Valve's Sniper runtime support and new game runners⁩ ⁨⁨7⁩ ⁨months⁩ ago⁩:

  Reminder that Lutris is AI/slopware now, and the dev is proud of it.

• ⁨Comment⁩ on ⁨[PSA] Wifi warning on the refurbished OLED decks⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  Wait, the Deck doesn’t have an Ethernet port?

  It’s a Linux machine!