TimWolla

11 ms·

1.
by TimWolla 10mo ago
The examples in TFA are terrible and I don't get why it was necessary to jump the gun by submitting that article instead of actually waiting for the release and the official release page with more carefully designed examples. Given tha
2.
by TimWolla 11mo ago
That image is over one year old: https://github.com/linuxcontainers/debian-slim/pkgs/containe... Google Container Registry provides a pull-through mirror, though, just prefix `mirror.gcr.io` and use `library`
3.
by TimWolla 1y ago
Indeed. It might even result in out of range values due to implicit rounding (`3.5 + (4.5 - 3.5) * (the largest float smaller than 1)` results in 4.5, which is unexpected). I'm a contributor to the PHP programming language and a mainta
4.
by TimWolla 2y ago
For PHP 8.3, we upgraded production during the RC phase, but were prepared to revert back to an older one by not relying on the new functionality. Docker makes this easy. As long as you do not use the new functionality, I'd claim that
5.
by TimWolla 2y ago
> It seems to be better to err on the side of 'people dont know if they want a PRNG or a CSPRNG' and switch the default to the latter with an explicit choice for the former for people that know what they need :) That’s exactly
6.
by TimWolla 2y ago
No: route: 5.44.240.0/21 descr: Zoner Oy origin: AS201692 mnt-by: MNT-ZONER created: 2014-09-03T08:09:00Z last-modified: 2014-09-03T08:09:00Z source: RIPE
7.
by TimWolla 3y ago
> I think I recall chatting with you on here or email, I can't remember which. Could possibly also have been in the issue tracker, which I did help bootstrapping and doing maintenance for quite a while after initially setting it up.
8.
by TimWolla 3y ago
FYI: Serving static files is easier and more flexible in modern versions of HAProxy via the `http-request return` action [1]. No need to abuse error pages and no need to embed the header within the error file any longer :-) You even have so
9.
Nginx Security Advisory(mailman.nginx.org)
144 points by TimWolla 3y ago|25 comments
10.
HAProxy 2.9(haproxy.com)
5 points by TimWolla 3y ago|1 comments
11.
PHP 8.3(php.net)
12 points by TimWolla 3y ago|0 comments
12.
by TimWolla 3y ago
I'm using nom to parse a simple access control DSL in https://github.com/wbbaddons/Tims-PackageServer/blob/master/... . You can see how it looks in the tests of the linked file. The DSL supports comp
13.
by TimWolla 3y ago
I don't believe this is necessarily true. Unless I'm misunderstand you, each of the possible variants of spelling out 32 hexadecimal characters could theoretically SHA-256 into the spelled-out hash + 1 (looping around at ff…ff).
14.
HAProxy 2.8.0(mail-archive.com)
7 points by TimWolla 3y ago|0 comments
15.
by TimWolla 3y ago
I suspect you'd lose that money. Many of the recent GitHub outages were caused by database issues. Examples: https://github.blog/2023-05-03-github-availability-report-ap... . In fact last march they specifically mention
16.
by TimWolla 4y ago
Indeed. While I do maintain two of them, that maintenance is effectively equivalent to being an open source maintainer or open source contributor. I do not have any non-public knowledge about the Docker Official Images program. My interacti
17.
by TimWolla 4y ago
The images you mention (alpine, node, golang) are all so-called “Docker Official Images”. Those are all the ones without a slash as the namespace separator in them: https://hub.docker.com/search?q=&type=image&image
18.
by TimWolla 4y ago
Note: The hash in the SO question is not vulnerable, because it is too long. The issue exists specifically for hashes that both contain a `$` and are too short. The “too short” is necessary for the trailing NUL byte of the input to be copie
19.
by TimWolla 4y ago
I assume s/bit/not/. The checking function is “does the given password with the stored parameters hash to the same value as the stored hash”. Hash functions are deterministic. So returning the original hash for a valid passwo
20.
by TimWolla 4y ago
Disclosure: I am not the author of the initial bug, but I investigated the issue together with another developer. I'm the author of the linked advisory and I've authored the commit that fixed the issue. As the advisory states I do
21.
by TimWolla 4y ago
> but missed one of the three ways crypt can signal failure (returning the input unmodified) Returning the input unmodified is not failure, but success. That's how you check that a password is valid without having a specialized API.
22.
by TimWolla 4y ago
I've interpreted the "put out" in the initial comment as in "put out a fire" (i.e. mitigate), instead of "send out".
23.
by TimWolla 4y ago
71M requests per second gives you about 14ns per request. WolframAlpha says that's about 4 times the latency of a L2 cache access and 0.8 times the latency of a Mutex lock / unlock: https://www.wolframalpha.com/inp
24.
by TimWolla 4y ago
Personally I sync the emails in my Gmail account to my server at Hetzner using imapsync [1] every once in a while. The data on that server is backed up off-site at rsync.net using Borg. I'm intentionally not using Hetzner's storag
25.
Dangling Domain Abuse(connortumbleson.com)
1 points by TimWolla 4y ago|0 comments
26.
by TimWolla 4y ago
Only this specific curly braces syntax, which is less powerful than the still-supported '{$foo}' variant: https://wiki.php.net/rfc/deprecate_dollar_brace_string_inter...
27.
PHP 8.2(php.net)
263 points by TimWolla 4y ago|282 comments
28.
by TimWolla 4y ago
I do the same for my personal machine. It's acting as the router/gateway in front of several Docker containers (both HTTP and also other protocols, such as SMTP or IRC). Disclosure: I'm a community contributor to HAProxy.
29.
Impact and Transparency Report 2022 – PHP Foundation(opencollective.com)
1 points by TimWolla 4y ago|0 comments
30.
by TimWolla 4y ago
OpenSSL 3 is in Ubuntu 22.04 LTS [1]. I expect that alone to be bad enough. [1] https://discourse.ubuntu.com/t/jammy-jellyfish-release-notes...

More ›