This seems like a good explainer of the issue.
https://eliastaylor.com/noexploit/

None Pizza with Left Beef is 19 years old as of this week.

do not worry, am not affected by the php vulnerability, mew. am secure soffware. although personally, i think that four is a very good number and i don’t know why people are so upset about it

It's Wednesday and I can't learn about the Monday infosec disaster because of the Tuesday infosec disaster so I assume the hat trick that lands Thursday is going to be pure cartoon violence.

So, much like I rail about decisions to copy the designs of the social media platforms we’re trying to avoid here in our voidspace, why are we continuing to copy the software development platforms of the corporations we loathe the output from? Why build our communal efforts around their craptastic profit maximalist worldview?

Slow the fuck down. Make small useful things in small groups. Things that build on other small useful things built by small groups. Release it and then start thinking about what’s going to go into the next version, if there needs to be a next version. Keep an eye on what folks are saying in case you need to issue a hotfix. Stop dribbling out every little tweak and idea you have and look to having a shared, cohesive, comprehensible vision for what correct looks like for your software instead. Then take the time to make it correct. You’ll be happier, your users will be happier, I’d be willing to bet on it.

Here's my summary of why websites are offline right now, and why nerds are laughing at the number 4.

I've attempted to explain the jargon in use, so those interested but not working in tech have a chance at understanding what's going on.

https://natgray.co.uk/blog/why-websites-are-offline-and-nerds-are-laughing-at-the-number-4/

Just waiting for the news that actually rust's borrow checker has never provided memory safety and has accidentally been embedding a complete turing machine in all your binaries that will run arbitrary code for anyone who sends it the number 27

@MaddieM4

I worked in #infosec in the "naughties." Even back then, I thought the prevalent concept of "security as a product" was laughable.

With all of the stuff that's going on today, I wish we'd just start over from scratch using NASA Apollo-esque coding standards. Do less, and make it solid. Heck, go for some Djikstraesque "provability." I dunno. Everything is just so slipshod.

(And to those reading, I'm not saying that as an attack on the PHP devs. They're doing the best they can with the resources they're given, and should be commended for working so hard to hold up 70% of the web, for crying out loud)

help i am a man what can i do proactively to keep sexism from making it harder for us to make software aside from purging the sin from my heart??

a few things
- make u workplace ADA and OSHA complient
- do not use "culture fit" (aka "do they have my same hobbies") as hiring criteria
- have an office administrator on payroll whose job it is to do stuff like make sure there is enough coffee n pens n shit; if u cant afford one dont make this a female senior engineer's job for some unholy reason

staring across a wasteland of lockfiles that require immediate attention, forever, we must imagine Sisyphus singing, "I like dep bumps and I cannot lie"

I always think that Marguerite (1907) by Henri Matisse looks like an underground/indie comic book published by Fantagraphics in the 1990s.

I deleted my Facebook account in 2017 because I saw what was coming and I didn't like it. I didn't "deactivate" it, I deleted it, according to all the "are you sure?" prompts I recall wading through to get the final message that if I don't log into it in the next 30 days, it's all gone forever.

This morning I woke up to a 2FA email request from Facebook, to the email address I last used with the service. It was a legitimate email from FB so I decided to see if my account was really just deactivated instead of fully deleted. Welp, guess what? I logged in with the password stored in my password manager, and it sent me a new 2FA code. I continued all the way in, and absolutely nothing was actually deleted. All of my friends from that era who still had Facebook accounts were in my friend list, my last post from the summer of 2017 was still there, and many more sent before that, along with photos that I recall individually deleting before closing the account just in case.

Facebook lied. Imagine that.

Of course I immediately went through the whole deletion process again, confirming I was sure at least seven times, and got the same "if you don't log in over the next 30 days all posts are deleted and unrecoverable". Gee, where have I heard that before?

I will try logging in around the first of December just to see what happens. As for that first 2FA request this morning, clearly someone has my FB login info. I know there was a breach a few years ago but I wasn't concerned back then since like a good tech person I only ever used that password on that site (which I confirmed with my password manager), and besides I had deleted my account right? ...Right. And I know that even if they really "delete" it this time and I can't get back in, they still have my data forever.

So the moral of the story (and we all know this already, don't we?) is that all corporations; all data holders and harvesters; all social media companies; all entities trusted with our personal and financial data, are lying to us. They are all defying the law, they are all disregarding their own data retention, privacy, and security policies, and they know they can get away with it so they do it with impunity. I'm in the US so there are virtually no laws protecting my rights. But even in the EU, the GDPR is not enough. Facebook/Meta was recently fined nearly a quarter of a billion Euros over "right to be deleted" legislation, and they brushed it off like the minor inconvenience it was.

introducing: Brick Linux
- no features
- doesn't work
- protects you from all threats
- breaks your computer

calling men who commit micro-aggressions sexist is like telling people to stop climate change by using paper straws. In the case of the classic "talk over woman during meeting" and similar, calling some tired out guy who fell back on the shitty behavioral script programmed into him from childhood a sexist and shunning him does nothing. Excusing it does nothing. Instead, make systems in which the easiest choice for someone who is tired and distracted is one that isn't sexist

lol I have also seen the dreaded "ask senior female engineer to make coffee", and each time it wasn't some alpha male power play, it was a breathtakingly stupid move by a guy who hadn't had his coffee yet. okay so his subconscious brain thinks women should do domestic labor. he probably is in denial about it because his conscious brain knows that's bad. Make the easiest action be to not ask a woman to make coffee by havin one of them fancy coffee machines with buttons n shit

So if men are just so endearingly dumb that they can't conceive of something like "our cool standing desk setup is hostile to women because women are on average shorter than men" how can we design systems so these poor guys don't have to worry about making that mistake?

well it's simple, if your cool office setup is OSHA complient and ADA complient, probably an average woman will be able to do work there 🤔

You don't even have to make a single man fix the SIN IN THEIR HEART to combat sexism!

Seems like a good day to remind people that blaming tools that have been maintained by underpaid devs or volunteers or with little to no support for decades - or worse, blaming those underpaid devs or volunteers - without assigning any responsibility or culpability whatsoever to the negligence of companies that have made millions or billions or hundreds of billions of dollars off the backs of those underpaid devs or volunteers' work is picking a side.

the main thing that's good about the web as a medium, imo, is that you can just chuck something into a directory and then it will appear in web browsers around the world. you can edit the file and hit save and refresh. the magic that you feel is the core of the entire thing. and as far as i've seen, Web Development, as a discipline, has focused for the last few decades on systematically destroying that magic

A little off-topic for this account, but just wanted to take a moment to say a big thank you to all the Wikimedia SREs, Incident Coordinators and everyone else involved in keeping Wikipedia up and running during this PHP vulnerability[0].

[0] - https://en.wikipedia.org/wiki/PHP2Shell

internet taken offline by huge pulse of smugness from static site operators