Fun fact: in HTTP/2 civilization there are two established ways to negotiate a connection over unencrypted TCP

you either just blindly assume that HTTP/2 is supported and send the connection preface (which looks like a fucked up HTTP request)

OR

you send whatever request you intended to send using HTTP/1.1 rather than HTTP/2, but add a Connection: Upgrade, HTTP2-Settings and HTTP2-Settings: headers to the request; the HTTP/2 server is then supposed to respond with a HTTP 101 status and continue further communication over HTTP/2

the initial HTTP/1.1 request still needs to be properly responded to, but the response becomes a HTTP/2 stream, meaning multiple versions of the protocol are used to service the same request ! fun

fruit is canon in Gears of War: E-Day btw

who was responsible for the PHP vulnerability? have they apologized? https://hachyderm.io/@maxine/117479948626572185

I am legitimately quite worried about a lot of old blogs and forums that remain the best source of information for fixing older devices and how they’re going to disappear. What the internet archive does might aid preserving them, but not keeping the information findable or accessible, and it’s somewhat tragic to me that the wiki spirit never spread to a lot of niche hobbyist communities

i walked past the nuclear regulatory commission earlier today after an appointment with a doctor who has malpractice insurance in case he fucks up his very critical work he studied for many years to be able to do. if a nuclear reactor explodes, is that an opportunity for humor? https://circumstances.run/@hipsterelectron/117479746276716624

Now, because not everything is software you stil and there needs to be pure code that's testable and reproducible, and people need to be able to use locked-down setups where only a single nonstandard root is trusted, the TLS APIs should not just inspect /etc/ssl themselves. They should take an explicit argument for the trust anchor. But they should come with a "get system trust anchor" method that uses the certs from /etc/ssl.

oh are people claiming php was "found" by "AI" that's cute https://todon.eu/@hembrow/117479755455227295 no the takeaway is not that they wasted energy to "find" it, it's still that they're lying to you about what "AI" does. this is propaganda regardless of whether it's well-meaning

I miss the summer.

#unix_surrealism #comic #cve

@anghenfil the upgrades have been pushed, but they are failing to build. We are working on fixing it, so asap.

ai is for losers

Some of the problems I wasn't even aware of with stuff embedding its own copy of the ca-certificates roots, rather than using the system ones, is mind boggling.

There should be a consensus that, for software you ship, you use what's in /etc/ssl. The same way you read DNS config from /etc/resolv.conf and custom hosts from /etc/hosts rather than embedding your own nameserver and host record config.

Who the operator trusts is *system configuration data* that is variable, not part of your program.

@OpenCloud the entire go package ecosystem is managed by google in an extremely direct way so vulnerabilities are kept under close guard for use by US intelligence agencies and naturally are not publicized widely like PHP. which system is more trustworthy?

It's called two factor authentication because there are two factors and they're both two.

the go package infrastructure is managed entirely by google's little hash collision system https://social.opencloud.eu/@OpenCloud/117479528056424594 "dot eu" my ass

it's personal home page when it should have been collective home page

php is disable 😔

@hipsterelectron dowloading 9 gorillion gigasharts of rust crates to get infinite memory rn

@milo i also find it hard to use and don't think it's possible to make a general safe API as safety is often dependent upon application requirements and therefore a safe language is one which can propagate such requirements. for all rust says about memory safety, the unsafe modifier is a shockingly simple frontend lint

waiter waiter ! more vulns please !

RE: https://social.treehouse.systems/@musl/117479682150841568

@hipsterelectron rust has its own troubled history with uninitialized memory. they had this function called mem::uninitialized() that became basically deprecated because it was too hard to use safely. now you have this weird stuff like MaybeUninit which is a lot harder to understand. maybe my takeaway would be like "oh the reason that these APIs are tricky to use safely is because there actually are really ugly bugs lurking on the other side if misused"