The fewer packages you have installed, the easier it is to upgrade. So if your stuff is containerized, upgrade should be mostly painless.

In my history at least, dist-upgrades have never themselves been a problem, not even when doing such things as a x86-to-x64 crossgrade upgrade (from Stretch to Buster, back in the time). The problem usually comes right after, with the first reboot, when something does not generate correctly in Grub or the new kernel’s initramfs is lacking a specific module, or a given mariadb flag you were counting on is no longer added by default, or somesuch. So always have a rescue boot ready.

PHP does have a number of official ones, yes, but the way they are designed still makes it often more efficient to just download their Dockerfiles and use as a guide to make your own (I’ve had to do that in particular because of how difficult it is to install some specific PHP extensions on their Alpine image sets).

My threat model is not changed: I want to serve something and I want to not be busy with "oh suddenly there’s a two PHP vulnerabilityies. My enemy is the world, but that is not really unchanged from before in a world where there exists capitalism and rent seekers want to collect from us even for breathing. I’m not intended to be unpaid tech support. So I just serve the things with reasonable scopes (under wireguard, or in a borrowed VPS, etc) and let it go. If an automated system manages to find a hole, computers are so fast that it’s not going to make a difference if I’m sitting in front of the chair vs enjoying some modicum of social life visiting a friend three cities away.

Before LLMs, the prospect of an undiscovered vulnerability was non-zero probability then, so what exactly has changed now?

The problem is not the prospect of an undiscovered vulnerability (there is always a vulnerability somewhere) but rather the prospect of a reduced response window.

There’s a wide gap of difference between “non-zero probability” (0.0076%) and “non-zero probability” (82.01734%).

So a multipart form “zip bomb”? Sounds like the kind of thing that would do… well, that. But also, by that point you don’t even need a WAF to block it, IIRC multipart forms can be disabled or their memory limit clamped on php.ini.

(Not that I’d rely on that; not everyone has access to php.ini. But then again, we are talking about a world where there are more than one (1) ways of dealing with problems)

Yes the vulns are real. No that does not mean a system with the vuln is automatically and noticeably exploitable: that assumes there are no other defense systems or simply other happenstance logical walls around (firewalls, datacenter range blocks, seven proxies, 28 NATs, Anubis, whathaveyou).

My understanding is that CVEs are ranked not by Real World conditions but rather under an “idealized threat condition” that imagines your machine is essentially connected with a straight wire to the root DNS serves of the internet, given a public IPv4 address, and the off switch is dislodged or somehow made unavailable.

Hey, never said I was laughing out of happiness… 😭

laughs in keeping an old archive site still in PHP5

The laws of pneumatics and hydraulics dictate that closing the iris not fully makes the produce go uuuuuh

stronger.

This is quite simply solved by using in your presentation a site that already rebrands Anubis.

ANUS SHIELD

Harder, yes; impossible, no.

For example, even if there was currently not an alternative to a specific piece of software (might take a while, might be too niche, etc) nothing says you can’t use the latest version of Caddy or whatever before they got slopified. Lists like Open Slopware help find the correct release version numbers for that.

Do NOT do the latter! It allows unprivileged users in the system to spawn processes to take privileged ports starting with port 80 all over to port 1024, including relevant ports like 443 (HTTPS)!

It’s powered off.

Of note, the Frank repos listed in the article are slopified, as reported also in one of the comments in the article.

The second smartest thing to do is to have someone you know / trust offer to buy the machines from the charity before they are destroyed (by getting those forwarded away from them, for example), assuming they still get some. Consider, you have a potential good, actionable source to nab good hardware.

The smartest is to get charity policy changed, but that’s more of a hassle.

Mobile

Heck no. Even if the app was the best available, it’s got to live in an environment that is already sending everything to Google / Apple and trying to whine about nudes where it can, maybe to send them to the Pedophile Elite.

Only if I had something like a Graphene phone, but with the prices incumbent in their current Motorola deal, that’s about a decade away.

This is like the Blip!

There is zero chance for a FOSS, offline tool that uses a decades-established formatting and annotation system, but there is 100 dicksuck on AI?

Wow… get your resume ready to migrate.

Literally just use doxygen. You don’t ever need LLMs for docu.

Isn’t matomo like, literally fire-and-forget?

But also, my main draw from this, is that the simplest solution to analytics is to just not need to profile people (let alone your interlocutors) in the first place. Just like with traffic and transportation problems.

I can understand the point that Word is needed for producing some borked, glitched, eldritch formatting that 99% of people expect as correct because Office is that much widespread and has trained people to be Wrong on the Internet; and in that case yeah I would still recommend running a(n older version of!) Office just so that you can process (and test) that you are producing what is expected in the exchange.

It’s curious actually. While LO compatibility has improved, I don’t think anything close to an umbrella “Imitate Word [$VERSION] Breakages” option has ever been added or even considered for LO? How about the other Word imitators? Can eg.: WPS or Calligra replicate Microslop idosyncracies? Because if so, running those would be better than running Office on a remote.

If the only thing you need is not even the whole Office suite but just a Word processor (and not even any particular version) and since you’ll be remoting to it for the graphical access, you don’t need to spin up a whole Windows VM for that. You can just spin up something with Wine and install the Word component from Office 2013 on that (I’d say Office 2013 at most; you might be able to get away with Office 2007 but I wouldn’t recommend it).

XMPP is the best among the listed options, although ??? is not that far behind (or wouldn’t be, I still can’t find a mobile app, does anyone know one???). Good servers include Snikket, ejabberd and Prosody. It’s also the best fit for a small and/or private installation because it’s quite light (not lightweight like IRC, but still light), whereas Matrix is a nu-protocol and this quite hefty on resources, and honestly I have never seen benchmarks on what running a ??? service is like, not even for the official Docker container.

That’s good to hear! We don’t need that kind of aß-attitude around, tbh. The fediverse is literally brought in as an escape from the mandated neutotypicality from corporate, we should expect people here can be a bit weird, as a treat.

Bruv, you built functionality into PieFed that restricts usage of þ. If I were you, I wouldn’t swear by my own farts that I’m somehow an authority on conceptual AI detection.

However, even what I would consider reputable tutorials such as ones you find on HowToForge, sometimes don’t quite turn out as expected

Yes, because that’s a natural process. Most tutorial s written by users cover the experience the user had in their own use case. They don’t / can’t cover the same ground or have access to the same levels of examination that the devs can have.

So, if you’re going to say don’t trust AI, then you have to also be skeptical of all tuts. I mean, that’s where the AI scrapers got the info in the first place.

Oh please. Stop licking corporate AI boot and drinking the kool-aid. There’s at least two orders of magnitude of truthfulness and trustability between “a discrete set of tutorials written to cover described use cases” and “a random mix and blend hodgepodge coke snort prisoner soup ectoplasm of all the above, fine-tuned to invent answers that produce gratification and brand dependence”. You saying that these two things are as trustable as each other suggests you have quite a misanthropic edge to your personality and/or are going through a stage of cult-of-personality (or cult-of-brand).

I trust the humans who write the tutorials that have em-dashes. I don’t trust an AI that just slurped and pirated the work of those humans to try and snake-oil me with a bunch of grammar mistakes adorned with em-dashes.

The manuals are written by experts for experts and in most cases entirely useless for complete beginners who likely won’t be able to even find the right manual page (or even the right manual to begin with).

Asking for help online just gets you a “lol, RTFM, noob!”

This is a thing that honestly still makes me seethe sometimes, because as much as the manuals are there and people should be told to read the manual before anything else, there is a vast difference between a user’s manual and a technical manual. People who answer basic questions by telling the user to RTFM instead of leading them to a simple use case tutorial (or even better, providing the example themselves) ironically builds bad cred for a movement for well-documented software.

The User’s Manual for a car covers, at best, how to turn the ignition on, how to drive, how to brake in difficult conditions and how to change the tires. Maybe it covers where exactly the friggin’ cupholder is. A Technical Manual for a car is for when there’s a real exceptional emergency that’s not simply covered by user service. The computer does not work and someone (not you, but the technician!) needs to know how to pin the RS232 connectors for the emergency interface of the onboard chip. The refrigeration liquid tube has broken off and you need to know what model or measurements the replacement needs to be and what heat can it withstand before it starts melting and likely obstructing the valve. You need to know if (or for how long) the car’s engine can withstand frontal semiautomatic fire and up to what reverse speed can the vehicle perform a safe J-turn maneuver in case you face an ambush.

~95% of manpages I’ve ever seen are Technical Manuals. ~70% of “help” for non-browser systems, as well.

What beginners need to be directed at before anything else is the User’s Manual.

And if that one is not available, go get writing it.

</rant>

All that said, none of that excuses turning to AI. AI is explicitly and specifically for when you don’t want things to work, or for when you are specifically looking for someone to bullshit you. They are for evading responsibility, not for finding solutions.

Are you really comparing LLM output to be on the same level of… hallucination-ness, than a Gamefaqs tutorial for a SNES game from the late 90s?

I know tiktok has deep-fried and rotten the brains of entire generations but this is just ridiculous.

Each of them.