One must imagine I’m happy
Mountainside
Joined April 2019
- Tweets7.3K
- Following1.2K
- Followers81.9K
- Likes257K
Pinned Tweet
I will be keeping a list of books read this year, along with a short review about them, and a rating.
The rating is a 1-5 scale:
5: This is one of my new favorite books
4: I would include this book on a list for anyone who asks for a book recommendation
3: I would recommend this book, but it would come with heavy caveats
2: I wouldn’t recommend reading, but I didn’t regret having spent time with it
1: I regretted reading this
memetic_sisyphus retweeted
Imagine trying to brute force 1 out of 394,020,061,963,944,792,122,790,401,001,436,138,050,797,392,704,654,466,679,482,934,042,457,217,714,972,106,114,142,662,548,849,156,408,066,279,903,068,160 possible values and getting it on the 5th try.
In companies across the world right now some extremely concerned nerd is trying to convince an older executive about the importance of turning off everything and nothing he says will translate.
Yeah the things I worry about with this stuff isn’t the major sites. They pay big dollars to fix stuff like this, I know there are gaps but still. I worry about like my local pizza restaurant. There’s no way it’s getting fixed in the next 5-10 years.
You might just want to stay offline for the next few days, BTW.
These newly discovered PHP vulnerabilities are no joke.
PHP powers about 70% of the global internet, and these are 'critical vulnerabilities'.
Expect massive data breaches, website outages, malware, and remote hacks of 'smart appliances'. Your passwords, personal info, credit card details, and emails are vulnerable.
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
Not good
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
memetic_sisyphus retweeted
Cheap labor is the most expensive decision you could make
memetic_sisyphus retweeted
I have said for years that software engineering is far too undisciplined, looks like we finally have to pay down all the security debt incurred by lazy practices
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
“A P-384 private key should be a random 384-bit number, which gives you 2³⁸⁴ possibilities (or roughly 10¹¹⁵)” they used the number 4.
Remember, "4" is not a good option to sign certificates. Neither is "56" or "115".
theregister.com/security/202…
A lot of symbology in Christian and renaissance art can be linked to one Ptolemaic era work: The Hieroglyphics of Horapollo. (Note that The Book of Emblems 1593 heavily drew from this older work).
This was the work of a Greek scholar living around the time of cleopatra attempting to make sense of Egyptian hieroglyphs. He wrote the symbolic meaning behind each glyph, and the philosophy behind choosing each symbol. His work is almost 100% wrong. Using it, you would be unable to translate any ancient Egyptian writings. However it does make for an interesting workbook for someone interested in symbology.
Some 15 centuries later his work resurfaced. Not as a way to interpret ancient Egyptian, but by Italian artists who desired a set of symbols to interweave into their works. The book became a hit, only a few hundred years after it was written.
Here’s what it says about the eye:
“To symbolize speech, they draw a tongue and a bloodshot eye. For the primary element of speech is the voice, the secondary the eyes. For words do not arise in the soul perfectly formed and changing with its changes, especially since other words are used for the soul among the Egyptians. And when they wish to symbolize speech differently, they draw a tongue placed above a hand: thus giving the primacy of speech-making to the tongue, and to the hand, which carries out the desires of the tongue, second place.”
It describes the eye as being primarily associated with speech. Specifically a blood shot eye. God, whose voice is creation, is shown as an eye. The word, the truth. Blood shot appears as fire, filaments outward. Later the triangle came to represent the trinity, and the eye took on the sense of omnipresence, but these were later interpretations.
Nearly all of the symbols used in this era of art work can be found in this book. Now over two thousand years later artists are still using symbols described by it. Amazing considering the underlying material is a failed attempt at translating a dead language.
Why? It’s a democracy. Why would I be ok if the other side is importing votes to win elections? Why is that not a valid thing to be upset by?
Why? It’s a democracy. Why would I be ok if the other side is importing votes to win elections? Why is that not a valid thing to be upset by?
This quoted post is unavailable.
If you were to give this advice to someone it would be impossible to conclude anything other than you hate that person. Since they’re offering this advice to women in general, the natural conclusion is they hate women.
No, I think it’s perfectly valid to be upset that foreigners come to your country and then vote against your interests. Especially when they’re doing so because the other party wants to bring more foreigners in to vote against your interests. You can’t have rule by the people and for the people if one side simply changes the people when they don’t get what they want.
