0x457

I wish I knew this before I setup mirroring of my personal forge to github haha.

Are there plans to add http(s) support to knot? I was planning on hosting my own knot at home, but didn't want to expose my home IP (I use cloudflared for other services that need to be exposed)

I agree and understand that, but I'm talking about purely technical reasons to use. IMO majority of alpine/musl usage is cargo cult. At my work, I'm yet to hear reason other than "its smaller" and "what is that? I just copy pasted it from X repo."

I won't deny that there is a use for portable binaries that don't depend on specific version of glibc, but its such a niche.

This exploit depends on the deployment. With PHP-FPM, an OOM during request startup terminates the child, so the corrupted state wouldn’t survive for subsequent requests to exploit. The challenge used PHP’s built-in server, where the worker was reused.

Doesn't mean that there isn't another exploit chain that can be used though. Challenge also had 4 workers total, so pining one worker wasn't that hard.

My Qwen3.8-27B was able to do it.

> people who needed a relatively full-featured build environment against musl

Yeah, I called this out as the main appeal of alpine. IMO no one should be using musl, but its another story.

> or people who had a test/deploy/debug cycle on environments that necessarily had no layer cache (ephemeral VMs, one-shot kubernetes clusters, OpenWRT routers that lost the layer cache on reboot). Or people with network-constrained traffic from registries or mirrors thereof.

Debian slim is ~30 MB compressed, and distroless/static is ~2 MiB. Small images aren’t unique to Alpine. With a fast local mirror, the extra download is negligible.

> Or people in environments that took container security findings (perhaps too) seriously and were tired of triaging endless reports for random dependencies in "FROM ubuntu" containers, and wanted a default required-by-policy base image that didn't come with the world.

1) Nobody’s forcing you to use a full Ubuntu image.

2) Alpine images still get plenty of security findings, often in the same dependencies your application needs regardless of the base image.

3) Nix is the best container builder anyway.

Well, `FROM scratch` implies that if there is something that works with linux syscalls (i.e. Linuxulator) then it generally runs. Unless, like you said, it needs special filesystems.

Alpine selling point was that it's small, which was selling people only for people that either don't understand docker layers or can't make Dockerfile correctly.

Alpine’s connection to static linking is mainly that it provides a convenient musl build environment. A fully static binary can run in `FROM scratch`.

Well, I got M4 iMac because I wanted a screen on my workbench with minimum cables and must be VESA mounted. I also needed a mac to build iOS apps. iMac was perfect fit.

I was trying to steal those, but when I setup my local version, I things a little different: php-fpm and glibc because I thought this how everyone would run php with nginx. PHP-FPM recycled OOM workers, so there were no corrupted state to exploit and then when I switched to "php -s", glibc with ASLR made it not very practical to exploit.

Changed my lab to use the same alpine + php = tada working exploit.

Point I'm making: vinyl is a lossy format and not just lossy, it degrades with plays even if your turntable is super-duper calibrated. It even degrades just by sitting in a sleave if environmental conditions aren't close to perfect.

Vinyl is far from open source CD due to limitations of phisical format and the fact that good vinyl contains specifically mastered for vinyl with those limitations taken into account.

You can still easily buy Bluray player and open source your discs with ARM (not CPU/SoCs, different one)

Older PDFs support PostScript XObjects: literal embedded PostScript code. Not sure it counts tho, because IIRC it was never executed by PDF viewer itself. It was "gives this to printer when printing"

Clicking sound unlocked some memories.