Can every software project who DOESN'T have a 9.0+ CVE from the past two days impacting them please raise their hand?? I think that'll be easier.

@MaddieM4 From my point of view, a reliable system can be summed up in a single thought: "When EVERYONE can review, inspect and audit the code, it therefore becomes more reliable."

This line, in fact, is what allows open systems to be more secure (because no matter how many vulnerabilities they have, there is quick correction, review, documentation and traceability) in such a way that no closed system can keep up.

RE: https://scoat.es/@sean/117480478803436020

I wanna say something a little more nuanced here:

It is easy and cheap to produce software that *mostly* works. It is also easy and cheap to learn enough programming to produce programs that are good enough for your own personal use.

The extra 90+% of costs that Mr. Coates is talking about here are *all* in the gap between "mostly works, most of the time, for me and people like me" and "works for sure, always, for everyone."

I did not realize at all that Electron apps use their own internal cert store. I'd never have guessed, because what an insane design decision, but geez here we are I guess.

you'd think EA was just waiting for a day like this to announce shuttering Bioware, while people are talking about major web vulnerabilities

how many computer security companies are basically a terrarium for weird little guys, just a place where they can fuck around and you can watch carefully what direction they're headed in

the main thing that's good about the web as a medium, imo, is that you can just chuck something into a directory and then it will appear in web browsers around the world. you can edit the file and hit save and refresh. the magic that you feel is the core of the entire thing. and as far as i've seen, Web Development, as a discipline, has focused for the last few decades on systematically destroying that magic

i really like PHP. in my experience, its full of insane issues and functions called "doThingSecurely_final_FINAL". but it's a tool, like excel or hypercard, that lets a normal person make Web without years becoming a Web Developer. you could just throw it onto a server and make a view counter or whatever. just mash it in there in the HTML for some basic dynamic feature on an otherwise-static page. wow! then 'Developers' ruined it, like with javascript, by trying to use it to make actual software

@gaditb ohh huh. so basically turning it into an embedded programming sort of thing… that could be neat. …“(s?)sg that compiles to a program with exactly one malloc” lol

@mhoye "They have taken untold millions that they never toiled to earn

but without our brain and muscle not a single wheel can turn"

Seems like a good day to remind people that blaming tools that have been maintained by underpaid devs or volunteers or with little to no support for decades - or worse, blaming those underpaid devs or volunteers - without assigning any responsibility or culpability whatsoever to the negligence of companies that have made millions or billions or hundreds of billions of dollars off the backs of those underpaid devs or volunteers' work is picking a side.

Or... what do electron apps use. 🫣

@cpsdqs Like the complexity pre-calculation doesn't need to be bounded.

As a simple e.g., having just `INCLUDE <>` gives you a naive
~"max include-path length" * "max filepath length" bound for the state-space of a deterministic process of generating the output,

and a naive ~"max include-path length" * "max filesize" bound for the max time/output.

With validation makkng sure that "max include-path length" is a finite number -- no loops. (I guess, also that none of your files are /dev/urandom or something and have inifinite length, too.)

@gaditb personally whenever i make one of these i just add a vm instruction count limit and a stack/heap size limit and call it a day. but computing the actual space-time complexity… intriguing possibilities for websites. maybe you could have a bound on the amount of computation per output byte-ish and reject programs in advance??
after all, streaming the response would naturally dilute the time cost…

@djsundog I dunno, I'll bet that "CRITICAL VULNERABILITY IN THE PUBLISHED LOG TABLES" happened at least once during the pre-chronometer Age Of Sail.

actually I have been working towards setting up a dial-in BBS (over real phone lines)

NO PRIME NUMBERS OR PHP NEEDED

"How much memory will this take to render" cna and should be computable statically for every possible path.

"Tongue awareness day" but for security.

The PHP #security issue shows once again how much our society relies on mostly volunteer work.

Look at PHP Foundation @thephpf finances:
https://opencollective.com/phpfoundation#category-BUDGET

- Reimbursed $67K on development work this year
- Received: $642,755 last year

Compare these numbers with the amounts companies have made with products & services built upon #PHP. Our digital foundations are built on the backs of #opensource volunteers. Governments & companies need to invest in our common digital infrastructures.

Why do you need it to be turing-complete? You don't need it to be turing-complete. Do the turing-completeness elsewhere and do the rest here it'll be fine.