Always Learning "Distance lends enchantment" 💻RC W2'23 🎙Fish Tales Podcast: https://nitter.gq/t.co/m3z9mdeyz1
Central NC
Joined February 2022
- Tweets239
- Following185
- Followers96
- Likes305
Pinned Tweet
May is here and so is Fish Tales with @JoshuaKGoldberg!
He's an author, speaker, open source dev & great human & we recorded a fantabulous episode covering TypeScript, his book, his background and more.
youtu.be/zoUyS2n7aUo
leetrout.com/fishtales/e8/
Lee Trout retweeted
If you run PHP anywhere, patch it today.
Two RCE bugs in PHP core, CVE-2026-109618 and CVE-2026-109619, both 9.2. Reportedly, every release from 5.4 up is affected. Fixes shipped this afternoon (UTC):
8.5 → 8.5.12
8.4 → 8.4.27
8.3 → 8.3.36
8.2 → 8.2.35
8.1 and older get no official release. Check your distro or LTS vendor for backports, or upgrade.
Two things people are getting wrong 👇
1/ Plenty of companies run PHP without thinking of themselves as a PHP shop. WordPress is PHP, and so is that admin panel, that status page, and the staging box nobody decommissioned. Check every host you own that answers to the internet, including the ones nobody has logged into in a year.
2/ The risk went up sharply when the patch landed (30 mins ago!). Details leaked yesterday, and a few attackers already had them. Cloudflare saw attack traffic at 07:43 UTC, hours before any fix was made public. Now the patch points everyone at the exact bug, and writing an exploit from a diff is a short job.
If you can’t patch in the next few hours, Cloudflare’s WAF rules block the known attack patterns, including on the free plan. They only help if traffic actually goes through Cloudflare, and attackers are already tweaking payloads to get past them. That buys you hours, so spend them patching.
Lee Trout retweeted
We're making @fencer_security available for free to help secure open source! @AnthropicAI @OpenAI and a bunch of other companies signed a letter asking everyone to fix their security issues, and we're giving back by ensuring Open Source contributors have good tools too!
Three routers for the frameworks under the sky
Seven for the SPA kings in their halls of state
Nine for the developers doomed to debug
But One Router for the TypeScript Lord on his throne
In the Land of TanStack where the route trees lie
Actually helping you maintain compliance with better security with minimal friction
If you were impacted by the recent Delve issues and want to harden your security posture, we (@fencer_security ) will be happy to help you out.
For anyone that signs up in the next two weeks, we will give you 15% off an annual subscription and provide white glove onboarding ourselves. This will include our full platform of code, infrastructure, runtime protection, static code analysis (SAST), dynamic application security testing (DAST), identity management and SIEM.
We typically work with software companies between 20 and 500 employees.
While we don’t ourselves do the compliance part, we integrate with many of the large vendors in the industry (Vanta, Drata, etc.)
Feel free to DM me or comment below.
Lee Trout retweeted
🚨 META’s head of AI safety and alignment gets her emails nuked by OpenClaw​​​​​​​​​​​​​​​​
>be director of AI Safety and Alignment at Meta
>install OpenClaw
>give it unrestricted access to personal emails
>it starts nuking emails
>“Do not do that”
>*keeps going*
>“Stop don’t do anything”
>*gets all remaining old stuff and nukes it aswell*
>“STOP OPENCLAW”
>“I asked you to not do that”
>“do you remember that?”
>“Yes I remember. And I violated it.”
>“You’re right to be upset”
LMAOOOOOOOO
This is 100% it. It's basically a toll to do business via process gatekeeping. Wanna start a B2B SaaS? Well have at least $10k to go through the audit. Just remember the magic words: compensating control. You don't have to capitulate to every control nor every auditor demand. 1/2
SOC2 / ISO27k1 (probably most compliance) is mostly performative. Useful in theory, but in practice it’s entirely busywork.
Vanta/Drata make the slog somewhat bearable, but not painless.
I think what’s actually needed is a prescriptive company OS - Clerky + Carta + Rippling + Vanta - where good structure and processes make things like SOC2 fall out naturally.
But the space is so dull and ossified that real improvements seem impossible
Lee Trout retweeted
Ghostty is now a non-profit project, fiscally sponsored by Hack Club. mitchellh.com/writing/ghostt… I view terminals as critical infrastructure that should be stewarded by a mission-driven, non-commercial entity that prioritizes public benefit over profit. Ghostty is now that.
Lee Trout retweeted
Yes - 100%
I keep telling people "programming is understanding" - the computer is a machine that tests if your ideas are correct.
Once you understand a problem the program can usually be written pretty quickly.
Understanding a problem can take years. nitter.gq/potetm/status/93447449…
The essential bit is that developers understand that the value we provide is understanding itself. Not the artifact per se. (Though understanding w/o an artifact is potentially worse than vice versa.) nitter.gq/joeerl/status/93447253…