Raj Siva-Rajah (@binaryfire) header
Raj Siva-Rajah (@binaryfire) profile picture

Co-creator of @HypervelPHP. Swoole team member. DevOps engineer. Game dev. Singer in @thesunpilots.

Joined July 2011
Photo by Raj Siva-Rajah (@binaryfire)Photo by Raj Siva-Rajah (@binaryfire)Photo by Raj Siva-Rajah (@binaryfire)Photo by Raj Siva-Rajah (@binaryfire)Photo by Raj Siva-Rajah (@binaryfire)Photo by Raj Siva-Rajah (@binaryfire)Photo by Raj Siva-Rajah (@binaryfire)Photo by Raj Siva-Rajah (@binaryfire)
Raj Siva-Rajah retweeted
We lost one of the greats of stage and screen today. And, in my book, a tremendous friend and man. I learned so much from him. I will miss you, Patrick Stewart, all of my days. @mang0ld
1,245
43,723
744
351,355
3,547,384
Raj Siva-Rajah retweeted
SIR PATRICK STEWART (1940-2026) Before everything else, Patrick was defined by being born and bred in Yorkshire, the proud county in the north of England which he loved to the end. You could hear it in his accented voice and in the stern honesty with which he told you what he thought and felt. Yorkshiremen have no truck with half-truths or avoidance of big issues. He wore his heart on his sleeve, which made him a man to rely on, to admire and in my case, love. We first met as ambitious young actors with the Royal Shakespeare Company half a century ago but we weren’t in the same productions. My first strong memory was a few years later, meeting him in the street in central London when he told me about an offer to take over a leading part in 'Star Trek'. “But Patrick think of your stage career in the UK. Do you really want to risk—getting lost in Hollywood for years and years?”. Well, he took the risk and thank goodness for us all that he did for not just his devoted Trekkies but film and theatre audiences, who marvelled at his using international celebrity to star in a string of cinema successes ('X-Men' of course) and in great classical plays by Shakespeare, Ibsen, Arthur Miller, Peter Shaffer, Pinter and Beckett at Stratford-upon-Avon, in London’s West End and on Broadway. America was his adopted home, where he met his adored Sunny who has cared for him through sickness and health, through thick and thin. But he never forsook his origins: and the proudest achievement of the most respected and beloved actor of his generation on either side of the Atlantic, was his appointment as Chancellor of Huddersfield University in Yorkshire. His farewell performance in 'Avengers: Doomsday' is yet to be seen. Ian McKellen 29 October 2026 Photo: University of Huddersfield
3,281
90,935
4,290
468,442
6,407,238
Your apps, packages and infra are only as secure as the team member with the weakest security hygiene. Using 2FA, VPNs etc. isn’t enough. Train your teams on how to spot social engineering and have policies in place to confirm sensitive requests are real before actioning them.
20
Raj Siva-Rajah retweeted
Im sorry im not buying this ‘not reviewing code’ thing. Maybe later, but certainly not now, even with frontier models with max thinking Every single day I’m catching nonsense. If you’re merging this shit without looking, the systems your working on are either - not important and/or - have zero consequences for being wrong
189
62
15
1,131
55,521
Mixed feelings about this. I learned so much from Stack Overflow but it became a pretty unpleasant community towards the end. Either way, end of an era 🫡 nitter.gq/DanielLockyer/status/2…
New record for Stack Overflow: <1000 questions posted last month
29
Replying to @aschmelyun
I starred this to get my cat on the wall🐱
243
100% agree, it'd be great to have different cooldowns for different packages. But from what I can see Composer only supports a global period and full exemptions: packagist.com/docs/cooldown-…. Same as pnpm. So for now you have to choose one default. I don't think there's a definitive answer. Respected security researchers disagree on the duration and there are good arguments on both sides.
1
23
Totally get that you don't want to wait too long or you risk delaying fixes. Just seems like 1 day is too short for a lot of the detection windows, at least when you consider all languages. Elastic recommends 14 days too: elastic.co/blog/shai-hulud-w…
25
Replying to @naderman
JFrog analysed a bunch of package hijacking attacks in 2023 and concluded 14 days was the safest bet: jfrog.com/blog/n-day-hijack-…. Is there a reason that'd be different for PHP? I'd have thought the same concept applies - older means more time for detection (especially in less popular packages)
3
51
Cooldown dependency policies have landed in Composer! Everyone should be enabling this in their PHP projects. I recommend at least 3 days - that’s long enough to avoid most supply chain attacks. But if you don’t need to be on the bleeding edge, go 1-2 weeks.
1
2
293
Raj Siva-Rajah retweeted
I miss when software felt like it was designed by people who had spent their entire lives thinking about software.
94
102
25
2,287
546,347
Replying to @nicolasgrekas
Thanks Nicolas, appreciate the clarification. Yes, it’s definitely a different mental model, no argument there. “Not PHP” just lands differently when you're helping maintain it. Looking forward to seeing where the background worker work goes. Looks promising.
4
692
Just watched a talk from @nicolasgrekas, Symfony's core maintainer, about his new FrankenPHP work. I was excited to check it out, then I heard this: "This is not about re-inventing the way we do PHP. Swoole is not PHP. Swoole is something else. With a language that looks like PHP. Nobody is talking about moving an existing PHP application to Swoole because it doesn't fit the model." As a Swoole team member and co-author of a coroutine framework, I find this disappointing. The implication that Swoole isn't "real PHP" is just unnecessary divisiveness. Options are great. Innovation is great. Personally, I prefer using an async coroutine runtime. You prefer something different. And that's fine. There's no need to disparage other parts of the ecosystem.
3
2
1
49
20,539
Somewhere, a CTO just found out their servers still run PHP 5.6 💀
1
67
If there’s one good thing to come out of this PHP CVE mess, it’s that people still running v7 (or even v5 😬) will be forced to upgrade. Hard to believe that ~50% of sites are running EOL versions. Especially in this day and age.
1
83