Is computational ability a kind of intelligence? If so then 20 year old calculators absolutely have a computational ability which is superhuman.
I'm not sure what my (or yours) point is, but like with all of AI it's a moving target - I still remember how image recognition was deep in researchy Artificial Intelligence territory. Nowadays it's such an obvious building block, nobody thinks of image classifiers as "intelligence".
There are dozens (or hundreds) of functional exploits already. The problem with php2shell exploits is that (as of now) there's no "one exploit pwns all", and researchers need to spend nontrivial amount of time on every (potentially) exploitable target.
So I don't think I agree - it's a fun challenge for the itsec people around here, and some people will definitely try. There's no real opportunity cost here. The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.
> The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.
Exactly. This server is exploitable, but not with an off-the-shelf PHP2Shell PoC someone found on GitHub. The PHP2Shell exploit would need adjustment to the specific application configuration, and to that end, you’ve come to the same conclusion I was implying.
The easiest way is to use PHP2Shell _with_ another unknown vulnerability in the stack, such as nginx etc…
The challenge is trivial to those who know better than to even try. You cannot succeed at it without giving away far more than you could ever possibly hope to gain.
Of course, there’s always the wildcard of someone throwing away the nginx 0-day just to be funny.
This is a self-fulfilling prophecy. If everyone reads "it's impossible to avoid gmail, just use gmail", then yeah, gmail prevails.
But it's plain false. YOU can decide against using gmail. I don't use gmail. I sometimes talk with people who use gmail, but more often than not, I don't. Stop being fatalistic.
>Except that reviewing has become just asking your agent what that piece of code does in english
How does this work for you?
Do you ask about specific functions ("what does this function do")? Then it sounds like more work than actually reading it.
Or do you ask about the whole PRs ("what does this PR implement")? Then how do you catch things like security vulnerabilities, bad design choices, unnecessary dependencies, wrong architecture, etc? Those are things that benefit the most from human understanding (nitpicking style was always the easy but unimportant part of code review)
Not about a specific function anymore, or maybe once in a while, when something looks off.
> what does this PR implement
Most of the times, the coding agent already has the summary, and asks me specific questions where it needs me.
it very rarely also happens that i catch it taking shortcuts instead of doing the "right" thing. this happens while i am taking a look at the summary of the work it just wrote.
most of the correction happens later on when i test the final output irl.
>Which raises the scarier question of why they tried this at all?
Well, to quote the post:
>Ofcom has targeted 200-ish American platforms with censorship orders; only four of those sites, all of which are my clients, refused, and only one is 4chan.
Why is that a way bigger problem? Windows will happily run unsigned binaries. Code signing just decreases the friction for users slightly, but is in no way required. TLS is definitely a way bigger problem.
> You already need compromised systems to install malware, signed or not. Not a real problem.
Is this true? Ads pointing to a malicious Notepad++ is already an existing thing. Now their malicious version will pass signing checks. Users will happily install these without the system itself being compromised.
Organizations that are serious about security should have a whitelist of binaries that can run on their computers. Enforcing code signing isn’t good enough.
I don't get what you mean. If you save a credit card number in your browser (or a password, or a cookie) it's available, by default, to any other program running as your user. So a random calculator can easily steal your credit card, passwords, cookies, ssh keys, keepass database, gpg private key, and more.
I don't think this is the crux of the matter. Programming newbies are not scared of C/C++ because of std::unique_ptr. They are scared of three-star programmers, of intrusive lists, of clever packed data structures - in short, of pointer arithmetic. Java, Python and JavaScript don't allow that, so it's hard to compare them (that's why we distinguish between "pointer" and "reference", even though in practice they are exactly the same thing under the hood, of course).
>My father (...) tries to use his iPad as a PC (...) He's mostly on the iPad + keyboard because it's a nicely managed device update-wise and "what I can install"-wise, virus-wise. (...) But I recent told him: Just give up
Since he apparently wants a PC, isn't the logical conclusion the opposite? "Just give up. Buy a Windows/Linux laptop, you are too dependent on Apple, there is always something with the Apple solutions."
We made the call to go Apple years and years ago when he was always fighting viruses and virus scanners on Windows. His Macbook was still (hardware-wise) perfectly functional, but does not receive security updates anymore, so he went iPad. Indeed there are more problems than expected. I expected even less IT support from me was needed. Instead he now complains about the lack of control (which I am certainly ok with btw, the complaining I mean.)
The current plan is to put Ubuntu on the Macbook, not sure what to do with the iPad but make it less "primary computer" will be one of the policies to implement indeed. Maybe he will be happy with an external disk and f-spot, and his music nicely sorted into files. Then some generic backup solution to a Synology NAS or something...
Macbooks are great devices, but Linux is a great "fire-and-forget" OS for situations tech-illiterate loved ones. I've done it many times, with much succes and satisfaction (on both ends) without barely any aftercare. All you really need to do is teach them to install those updates and install a major upgrade every few years (or not, Ubuntu will run fine for a decade).
I beg to differ, I tried that approach a few years back with my folks, only to discover on my next visit a few months later that they went down to a local PC store and got Windows re-installed.
They never managed to get it working for their liking, it wasn't able to run the stuff their friends used to talk about or share via CD/DVD/USB sticks, and they did not wanted to bother me with "dumb" questions.
So I rather that they have Windows, go down to the local PC store when something isn't working as it should.
I do the same with acquaintances whom I sometimes sell secondhand gear, I don't want to do any support so they get Windows. For my father it's different, I can do support, plus he really appreciates and is willing to make sacrifices for, the privacy angle.
I can confirm. That is basically what I did for my father-in-law. The laptop is quite ancient by now (more than 10 years old) but still good enough for running current version of Ubuntu.
> Linux is a great "fire-and-forget" OS for situations tech-illiterate loved ones.
Only if the device is truly 'forgotten'. As in, it is an appliance that's going to do that task forever and ever. Be it web browsing or what have you.
If requirements change, it becomes a problem. If they have to do work on them and interact with companies, you may need either Windows or Linux. Thankfully online Office365 removed a big use-case. But there are others. It is very likely that whatever package you need will be available on Windows or OSX.
Linux is the opposite of fire-and-forget. Eventually a papercut always turns up that will require the terminal.
macOS also has (well, had) extreme UI stability. You could transport someone from 2003 used to Mac OS X 10.0 two decades into the future and they would be able to use macOS Ventura (and all previous versions) purely by muscle memory. Good luck doing that with Windows and Linux with their constant UI churn.
Interestingly enough, by iOS-ifying macOS, they've made it much easier to shift someone using an iPhone from Windows to macOS, because they already recognize many of the UI and UX paradigms.
Linux is not fire and forget for people who use technology without really understanding it, but for people who don't use technology and just need to check their mails and connect to government website to pay their taxes, it is the best.
Once it's configured for these kind of people, it's really fire and forget, and it was already that in 2016.
> Linux is the opposite of fire-and-forget. Eventually a papercut always turns up that will require the terminal.
When I say it's been fire-and-forget, I mean that for at least two decades.
If papercuts turn up, you are running the wrong distro or secretly a power user that naturally causes problems for themselves every now and then. This won't happen with normal users on a long term stable distro.
My daughter has Kinoite set up for her boyfriend's grandparents. It's immutable, so there's not much damage they can do without admin access, and she made it look much like Windows. They were already doing everything with Firefox as it was, so it wasn't a huge transition for them.
She did go back to fix things because the grandma managed to delete the printer, and she said that the downloads folder was full of exe files with sketchy names.
I'm with you on the macOS stability in the past. The thing that gets me is that Windows somehow gets a pass in this regard, but there have been some pretty big changes over the years.
Yes, they are always changing, I know Linux since 1996, use it as part of my work, last time I used a system like Ubuntu was last year, where it failed to work with a GIGABYTE BRIX Mini-PC UEFI firmware when starting from internal SSD, which I eventually gave up after several weeks trying various workarounds.
My mother wanted a device to just access internet banking. Gave her a netbook (remember those?). Only successful Linux use-case for non techies I've succeeded at.
This is why I don't do tech support for family. I just say "I work with servers, I don't know anything about [phones|iPads|laptops]." And indeed, I try to keep my own phone and laptop utterly bone stock or "as configured by employer."
Same philosophy as doctors who don't provide medical care for their family.
I can't fathom using Windows voluntarily these days. Even for gaming, Bazzite is janky but it's serviceable, and anything is better than Windows. It's almost shocking how much worse things are than Windows 10, which itself was a major victory in Microsoft's war against its own users.
I'm not sure what my (or yours) point is, but like with all of AI it's a moving target - I still remember how image recognition was deep in researchy Artificial Intelligence territory. Nowadays it's such an obvious building block, nobody thinks of image classifiers as "intelligence".
reply