181–190 of 405 posts
Earlier quoted context omitted.
This. Actually fuck the whole dynamic web. Just give us hypertext again and build native apps. Edit: perhaps I shouldn't say this on an VC driven SaaS wankfest forum...
Imagine if wikipedia was a native app, what this vuln would have caused. I for one prefer using stuff in the browser where at least it's sandboxed. Also, there's nothing stopping you from disabling JS in your browser.
Earlier quoted context omitted.
This. Actually fuck the whole dynamic web. Just give us hypertext again and build native apps. Edit: perhaps I shouldn't say this on an VC driven SaaS wankfest forum...
You may be interested in https://geminiprotocol.net/
Earlier quoted context omitted.
FWIW this was fixed in 2020
I've not used PHP in anger in well over a decade, but if the general environment out there is anything like it was back then there are likely a lot of people, mostly on cheap shared hosting arrangements, running PHP versions older than that and for the most part knowing no better. That isn't the fault of the language of course, but a valid reason for some of the “ick” reaction some get when it is mentioned.
Most modern web languages like nodejs are far worse due to dependency rot, and poor REST design pattern implementations. =3
I completely understand marking the software that controls drinking water as critical infrastructure- but at some point a state based cyber attack that just wipes wikipedia off the net is deeply damaging to our modern society’s ability to agree on common facts … Just now thought “if Wikipedia vanished what would it mean … and it’s not on the level of safe drinking water, but it is a level.
You can download the entirety of wikipedia and store it in your own offline immutable backup.
That's small enough to live on most people's phones. It's small enough to be a single BluRay. Maybe Wikipedia should fund some mass printings.
What you do not get however is any media. No sounds, images, videos, drawings, examples, 3D artifacts, etc etc etc. This is a huge loss on many many many topics.
This was only a matter of time. The Wikipedia community takes a cavalier attitude towards security. Any user with "interface administrator" status can change global JavaScript or CSS for all users on a given Wiki with no review. They added mandatory 2FA only a few years ago... Prior to this, any admin had that ability until it was taken away due to English Wikipedia admins reverting Wikimedia changes to site presenta…
Seems like a good time to donate one's resources to fix it. The internet is super hostile these days. If Wikipedia falls... well...
This was only a matter of time. The Wikipedia community takes a cavalier attitude towards security. Any user with "interface administrator" status can change global JavaScript or CSS for all users on a given Wiki with no review. They added mandatory 2FA only a few years ago... Prior to this, any admin had that ability until it was taken away due to English Wikipedia admins reverting Wikimedia changes to site presenta…
Seems like a good time to donate one's resources to fix it. The internet is super hostile these days. If Wikipedia falls... well...
Earlier quoted context omitted.
Yeah, basemetrika.ru is free now. Should we occupy it? ;)
I registered it about 40 minutes ago, but it seems the DNS has been cached by everyone as a result of the wikipedia hack & not even the NS is propagating. Can't get an SSL certificate .
Earlier quoted context omitted.
Seems like a good time to donate one's resources to fix it. The internet is super hostile these days. If Wikipedia falls... well...
My understanding is that Wikipedia receives more donations than they need, surely they have the resources to fix it themselves?
Too much app logic in the client side (Javascript) has always been an attack vector. The more that can reasonably be server side, the more that can't be seen.
The amount of javascript is really beside the point here. The problem is that privileged users can easily edit the code without strong 2FA, allowing automatic propagation.
It's simply a calculated risk.
How much business and application logic you put in your Javascript is critical.
On your second unrelated comment about Wikipedia needing to use 2FA, there's probably a better way to do it and I hope mediawiki can do it.