@j3j5@hachyderm.io
@j3j5@hachyderm.io avatar

j3j5

@j3j5@hachyderm.io

#Backend engineer, #PHP & #Laravel tinkerer, #BotMaker

I like #openData #science #urbanism #bikes and other weird things.

ES 🌎 https://mastodon.uy/@j3j5

#GoodBots #BotsGüenos

This profile is from a federated server and may be incomplete. Browse more on the original instance.

j3j5, to php
@j3j5@hachyderm.io avatar

Does anybody on the fedi Laravel community knows Aaron Francis? It's really sad that his (awesome) fast-paginate package seems abandoned like this, maybe just a statement acknowledging he can't/doesn't want to maintain it anymore can make the community fork it to keep it maintained. This L11 support PR has been opened and unanswered for 2 months already.

https://github.com/hammerstonedev/fast-paginate/pull/58

j3j5, (edited )
@j3j5@hachyderm.io avatar

@stefanzweifel yeah, I don't want to put any pressure on him, at all, honestly, I didn't even comment on the PR just to avoid that, that's why I asked if anybody knows him because a friendly nudge is always better than an email from a stranger (imo). Can't think of a way to word that email that doesn't sound beggy, it's just a pity because it's a great package.

protonprivacy, to random
@protonprivacy@mastodon.social avatar

What do you tell the “nothing to hide” crowd to convince them to value their privacy more?

See what @davidbombal and our founder & CEO Andy Yen have to say here: https://www.youtube.com/watch?v=acWkkLaEsrU

j3j5, (edited )
@j3j5@hachyderm.io avatar

@protonprivacy @davidbombal I love this quote @bijram shared for that:

https://graz.social/@bijram/112025032653191748

Latest extreme real-life example, Israel murdering people for being in the same WhatsApp group than other people.

andrewfeeney, to php
@andrewfeeney@phpc.social avatar

and folks, what do you make of this?

https://youtu.be/kQdRT2odUIk

j3j5,
@j3j5@hachyderm.io avatar

@andrewfeeney this was my conclusion yesterday after checking around, basically, upgrade glibc everywhere!

https://hachyderm.io/@j3j5/112311386903090357

j3j5,
@j3j5@hachyderm.io avatar
j3j5, (edited ) to Laravel
@j3j5@hachyderm.io avatar

Question for my #laravel fellas:

Do you think Bus::dispatch()and dispatch() behave exactly the same? Should they?

Boosts appreciated, obviously :)

j3j5,
@j3j5@hachyderm.io avatar

We're getting close to finishing so I'll expand. While fixing a bug on the rector-laravel package, I find out that you can queue closures using dispatch (as per the docs) but you can't when using Bus::dispatch(). I thought this was a bug but I got the issue closed (probably for not being assertive enough, haha). What do you think?

https://github.com/laravel/framework/issues/51150

#Laravel #PHP

j3j5,
@j3j5@hachyderm.io avatar

@michael lol, I know 🙃 worst part is that it's got way better with the years, it used to be much worse in the past 🤷

j3j5, (edited )
@j3j5@hachyderm.io avatar

@michael yeah, not my first rodeo and I keep reporting making PRs because I still benefit from them. I can understand from the other side, a repo like that isn't easy to manage, but that's why I try to make the issues and PRs as clear as possible. I think in this case Dries didn't read past the "not 100% sure if it's a bug" 🤷

eb, to random
@eb@social.coop avatar

In 2023, The Onion filed it's first SCOTUS briefing: https://www.supremecourt.gov/DocketPDF/22/22-293/242292/20221003125252896_35295545_1-22.10.03%20-%20Novak-Parma%20-%20Onion%20Amicus%20Brief.pdf

It was widely regarded as the 'greatest briefing of all time', for it's use of parody to defend parody (they called the judiciary "Latin dorks").

The case in question regarded a man who mocked his local PD through a satirical FB page. The PD looted his home. He sued. The 6th court ruled that the PD couldn't have known about his right to free speech.

SCOTUS said "Petition DENIED". The bad law stands.

j3j5,
@j3j5@hachyderm.io avatar

@decibyte @eb I think you're mistaking it with the famous Pharma Police

j3j5, to php
@j3j5@hachyderm.io avatar

tl;dr: upgrade glibc on your servers!

Summing it up, there's a vulnerability (CVE-2024-2961) on glibc that, apparently, can be used to get RCE on servers running PHP.
It's recommended that you update glibc to a patched version.

https://security-tracker.debian.org/tracker/CVE-2024-2961
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2024-2961

There's an upcoming talk on May 10 where the researcher will explain how it was used to hack PHP servers.

https://www.offensivecon.org/speakers/2024/charles-fol.html

ramsey, (edited ) to random
@ramsey@phpc.social avatar

How do you pronounce “glibc”? (as in the GNU C Library)

Edit: I consider “gee” as pronounced with a soft G, so you might also write it as “jee.”

j3j5,
@j3j5@hachyderm.io avatar

@ramsey is this about the CVE? Do we know already if there are specific mitigations for PHP apps?

j3j5,
@j3j5@hachyderm.io avatar

@ramsey ok, thanks, because I could only find people talking about the upcoming talk but nothing on actual mitigations (except update glibc), but nothing PHP specific.

"gee lib see" for me ✋

j3j5,
@j3j5@hachyderm.io avatar
j3j5,
@j3j5@hachyderm.io avatar
j3j5,
@j3j5@hachyderm.io avatar

@ramsey ok, so I guess that updating glibc only isn't enough for now, I'd need to either compile from source or wait for a recompiled version from my distro or repo, am I understanding correctly?

j3j5,
@j3j5@hachyderm.io avatar

@ramsey also, sorry for assuming you were talking about this but I just finished reading about it and saw you asking about glibc, on my mind IT HAD to be related

j3j5,
@j3j5@hachyderm.io avatar

@derickr @ramsey thanks! that's what I understood from the other replies from Ondřej as well.

gabboman, to OH

bee careful if you use php

https://www.youtube.com/watch?v=kQdRT2odUIk

#OH-FUCK-IT-APPLIES-TO-ONE-OF-MY-SERVERS

j3j5,
@j3j5@hachyderm.io avatar

@gabboman Is there any written info about this? I've found this ( https://www.gamingdeputy.com/exploiting-vulnerabilities-in-glibc-through-php-scripts/ and the links to the distros pages) but is there anything else besides updating glibc to mitigate apps? I don't have the mental bandwidth to hear a guy talking for 6min about it :(

j3j5,
@j3j5@hachyderm.io avatar

@gabboman yeah, I've read the PoC is scheduled for May in a conference, hopefully there's something else re. mitigation. Thanks anyway!

scottslowe, to linux
@scottslowe@fosstodon.org avatar

One of my sons—who is an avid PC gamer—is letting me use a previous-generation gaming rig he built to see if I want to buy it for use as my primary #Linux workstation. It’s a pretty decent box (Intel Core i7-12700K CPU, NVIDIA GPU, M.2 NVMe, 32GB of RAM).

I’m divided WRT which distribution & DE to install. I used #Fedora w/ #GNOME for quite a while, but I’ve also recently been using #ArchLinux w/ #KDE. Is #Ubuntu easier to get NVIDIA drivers working? (I honestly don’t know.)

Thoughts?

j3j5,
@j3j5@hachyderm.io avatar

@scottslowe I don't have experience with NVIDIA, but honestly, Arch has the best documentation on their wiki and great support on their forums.
I'd check the Arch Wiki and forums to see if your GPU is specifically mentioned because their documentation and forums are the best nowadays (imho).

j3j5, to random
@j3j5@hachyderm.io avatar

Security Tip: Be Careful Of Transliteration 🤯

https://securinglaravel.com/p/security-tip-be-careful-of-transliteration

Adam_Cadmon1, to random
@Adam_Cadmon1@mastodon.online avatar

Off! Is still my go to outdoor anti-mosquito spray. I hate those f*ckers. I wish I could genocide them.

Why don't we focus this insatiable need to kill many things in a direction that is beneficial?

j3j5,
@j3j5@hachyderm.io avatar

@Adam_Cadmon1 @rafa_font was writing some time ago about different techniques for getting rid of the mfs

https://mastodon.online/
https://mastodon.online/
https://mastodon.online/

j3j5, to random
@j3j5@hachyderm.io avatar

My attention span today is like 5min 😵‍💫

valorin, to Laravel
@valorin@phpc.social avatar

Do you use Encrypted Environment files in Laravel?

I think they are great for some special use cases, but given the prevalence of API keys and credentials found in repos, is it worth it to use them all the time?

There was a bit of a debate about this last time I posted it, so I'm curious to see how we're all feeling about them now. Or maybe I'm just being a old security grump? 🧐

https://securinglaravel.com/p/security-tip-encrypting-environment
#Laravel

j3j5,
@j3j5@hachyderm.io avatar

@valorin I don't use them on any of my projects but I do see how they can be useful for a shared local .env

Prod credentials on the repo on the other hand? No way José!

  • All
  • Subscribed
  • Moderated
  • Favorites
  • megavids
  • thenastyranch
  • rosin
  • GTA5RPClips
  • osvaldo12
  • love
  • Youngstown
  • slotface
  • khanakhh
  • everett
  • kavyap
  • mdbf
  • DreamBathrooms
  • ngwrru68w68
  • provamag3
  • magazineikmin
  • InstantRegret
  • normalnudes
  • tacticalgear
  • cubers
  • ethstaker
  • modclub
  • cisconetworking
  • Durango
  • anitta
  • Leos
  • tester
  • JUstTest
  • All magazines