101–110 of 130 posts
Earlier quoted context omitted.
I think if somebody wants to describe themselves as an "ethical hacker", and a conference wants to let people talk about exploits they've found, the minimum bar for disclosure is at least a description of a mitigation that could be taken, and ideally an actual code diff if its an open source project. There's a bit of street cred for finding a 0day, a bit of glamour about figuring out the puzzle. There's not much for…
Selling hacks is ethical
Something I'd really like is for PHP to somehow be stricter on the number of arguments passed to a function. As of now, PHP emits an error if arguments are missing but not if there are too many. A way to bake that in without breaking old code would be to allow function definition to put an explicit stop to the argument list, for example using the void type keyword: function foo (int $a, string $b, void) : bool { ...…
One of the main advantages of actually allowing more arguments is forward compatibility: You can, within a library, provide an additional argument to a callback without actually introducing a BC break for all users. My favorite approach would be allowing too many args on dynamic calls (closures, and function calls with dynamic name, not method calls in general) and otherwise rejecting it.
"function current_thing(id: Int, callback: Fn(Int)) {}" and, when you decide you need more you have a myriad of options to add these. From the despised "function current_real_thing(id: Ind, success_callback: Fn(Int), error_callback: Fn(Error)) {}" to "some_namespace:current_thing(...)" via "OtherClass::current_thing(...)" to "load current_thing from NewImplementationOfThing" and so on.
Being strict and explicit isn't opposed to being flexible. And strictness and explicitness is most often a predicament to allow for future change, rather than hampering that future change.
It's far easier to refactor, maintain, test and reason about strict and limited implementations than to do so with dynamic, runtime-magically-changing implementations.
Earlier quoted context omitted.
PHP has decent FFI, nothing is stopping you from using the same libraries as you would with Python. Here's someone's quick hack as an example: https://github.com/dstogov/php-tensorflow For an interpreted language PHP itself is ridiculously fast and the VM is rather small so you can use something else cough Elixir cough for parallellisation. I use it all the time for data wrangling stuff and database imports because i…
PsySh I’ll have to check this out. Though not popular php can be a surprising decent scripting langauge.
Earlier quoted context omitted.
I'd be curious to read about what percentage of active PHP devs use the recent features. The last time I worked in a PHP codebase (2020?) was half PHP 5 (bad) and half PHP 7 (much nicer). Curious if there's any real info out there on this
The Laravel ecosystem folks seem to be always up to date in recent PHP developments. At least, that's my impression.
Earlier quoted context omitted.
I think if somebody wants to describe themselves as an "ethical hacker", and a conference wants to let people talk about exploits they've found, the minimum bar for disclosure is at least a description of a mitigation that could be taken, and ideally an actual code diff if its an open source project. There's a bit of street cred for finding a 0day, a bit of glamour about figuring out the puzzle. There's not much for…
Selling hacks is ethical
Earlier quoted context omitted.
I've previously used that to do something. Fell flat on its face. But the fact they literally had to create a tool to solve this problem confirms my point.
I use it all the time and it works great. You need to know what you're doing.
Earlier quoted context omitted.
Selling hacks is ethical
Let's suppose you are right. Why not accompany that with a proposed fix, too?
Earlier quoted context omitted.
Breaking something is easier than protecting everything from all fronts. Hackers write the worst code, but all the mess needs only one successful hit to become a 0day.
Instead of making a website about it, you can take any step of your exploit chain and change the code that exploit cannot possibly work, and submit that as patch. You would still get a CVE number assigned that you can add to your resume. For example, look at the glibc/iconv CVE some other user posted[1]. In the section "Out-of-bound write when converting to ISO-2022-CN-EXT" they have mapped out the boundary checks. B…
Surely someone doing all this would already have submitted a patch if they felt comfortable.
Earlier quoted context omitted.
PHP has decent FFI, nothing is stopping you from using the same libraries as you would with Python. Here's someone's quick hack as an example: https://github.com/dstogov/php-tensorflow For an interpreted language PHP itself is ridiculously fast and the VM is rather small so you can use something else cough Elixir cough for parallellisation. I use it all the time for data wrangling stuff and database imports because i…
PsySh I’ll have to check this out. Though not popular php can be a surprising decent scripting langauge.
It's very popular, as in a lot of businesses use it, it's just not fashionable.
I think it's a great tool to have. It had gradual typing before it was cool. You can type in like a page of code including the layout and render whatever in a PDO-supported database on a web page, served by the builtin web server, which is great for data exploration and things like SQL optimisation. At the moment I'm handling some data flows and conversions in a project with something like a terabyte of email and office documents that need to go into RDBMS, because there are some liberally licensed lightweight libraries (in contrast to the bulky stuff in Jakarta-land) and the performance is good enough to not be a bottleneck.
Edit: And when a library isn't good enough, I can usually trivially fix or extend it because it's in a familiar language and written by a simple minded person like myself.
There's a degree of clunkiness and incoherence in built-in API:s that might be off-putting at first but the included batteries and PsySH make for a quite decent tool anyway.
Earlier quoted context omitted.
I think if somebody wants to describe themselves as an "ethical hacker", and a conference wants to let people talk about exploits they've found, the minimum bar for disclosure is at least a description of a mitigation that could be taken, and ideally an actual code diff if its an open source project. There's a bit of street cred for finding a 0day, a bit of glamour about figuring out the puzzle. There's not much for…
Selling hacks is ethical