I guess nearly everybody has installed the patch by now
I admire your belief ;)
ATM almost 80% of scanned services are still vulnerable. Considering that **About 54% of PHP services hide their version** and are not counted as affected or patched.it doesn’t look too good
AFAIU this is not about the size of the file but making the php process that runs a file surpass the configured limit (of RAM). At which point sometimes something goes wrong with letting go of that memory and then the second vulnerability allows using that limboed memory that not only shouldn’t be used but also can contain some internal values from the first one
@[email protected] I think i_am_not_a_robot has a point that it’s too soon
For unrelated reason I had to wipe my blocklists on VPS for a moment. Just during a few minutes one of my containers was getting hammered with all kind of .php requests.
Even if it wasn’t used in the wild before, it seems that now bots are running in circles with those new toys
Yes, but from the page I linked
One really amusing thing in common with most of these "PoC"s is that they lean on “LFI”, or local-file-inclusion, to make the vulnerability. In non-php terms, their exploit chain requires the server to already have a severe code-level vulnerability.
It’s not rare for PHP apps to be fucked in some sense, but requiring the server to have an existing vulnerability where users could
cat /etc/passwordis an insane pre-requisite. If you need this, this does not make this a severe bug.
For sure that this is still a bug that should be patched. But I do remember “don’t eval on user sent stuff” rule. Or is this really prevalent in PHP ecosystem?
What’s up with the culture on Nostr?
Lemmy and history, no. On Lemmy you can see comments from Mastodon and posts (toot with a Lemmy community pinged inside. Which is rarely done but happens). But not the toots themselves
Piefed now allows to directly follow accounts (similar to Mastodon, Friendica, etc) and you can start getting the new toots after following an account https://piefed.zip/c/microblogs
Thing is, Fediverse is not a product
Yes, but then a comment mentioned the “hug of death” - high spike of requests resulting from a link being shared on some site, and OP asked why centralized sites were also creating problems
There was another post regarding previews some months/(knowing me probably a year) ago and personally I would go with federating previews. With a button for mods to refresh it from source for when something goes fucky
But social networks have been creating random bursts of requests, this way or another, even in the times of centralized socials
From server’s perspective the only difference between those is the user-agent. Traffic is the same
Also https:// itsfoss.com/news/mastodon-link-problem/
https://en.wikipedia.org/wiki/Slashdot_effect but people were going in, looking at the link, sometimes overwhelming the server
despite how they don’t block the triad - but at least PieFed.zip allows individual users to do so, if they wish. And after they figure out how, and that there is a need for such, which nobody it seems will officially recommend to them
On piefed.zip a new user has hexbear, grad and lemmynsfw put in their account filter. And the welcome DM that is being sent includes info that we do this and how to manage account filters. So as long as the new users read the DM, they from the start have the info how to block instances for themselves
We don’t defederate often. I think it has been the selling point for some of our users. But PieFed offers much better blocking (compared to Lemmy at the time when I migrated), so we can have an instance for both - those who want everything, and those who don’t
And btw, effectively speaking we don’t do vote quota on PieFed.zip
Migration of user with joined communities etc works. But if you want to migrate whole instance, that won’t be so easy. Mainly because other instances will still think yours is Lemmy. I think that in the long perspective what would be the easiest would be to
something(usually people put piefed here).downonthestreet.eudownonthestreeteu (I don’t know how it’s done but it was done for lemm.ee)Technically it’s a migration to another instance but you’d keep your history etc
running pods: 98
Oof, my lab is lightweight compared to yours but I’ve been thinking of putting up a grafana for mine too. Would you mind sharing how much resources it takes to run and roughly how much storage does, let’s say, a month of data take? I know that it all depends on what one puts inside but just as a reference point
That is my understanding too. But then when I was reading the article, there was a line somewhere that in order for the exploit to be successful, the server needs to be using eval