NorwegianDude

HN load isn't exactly a high load for a server. The automated traffic was most likely much higher, but not high, as the server used the super slow single threaded php dev http server, so high traffic was not possible, everyone had to wait their turn.

The steal my Bitcoin challenge was nothing like a realistic common PHP setup. It was a extremely unrealistic and stupid setup, using the built in php dev server. It's even explicitly stated that it should never be exposed to the internet.

If it needs to hit the same worker to get it to work, that is a whole other problem, and that was not a part of the steal my bitcoin challenge. And what if pm.max_requests is set to 1? Is it then 100 % safe, as it respawns for each requests, making any statement for an universal exploit completely BS, or is a single requests exploit possible?

This was presented as a normal setup of PHP, but in reality was something completely different. Nobody runs PHP like this. This used the dev server in PHP and proxied requests from nginx to the php http dev server. Literally the first thing in the php docs about the dev server is:

"Warning This web server is designed to aid application development. It may also be useful for testing purposes or for application demonstrations that are run in controlled environments. It is not intended to be a full-featured web server. It should not be used on a public network."

It's also singel threaded and very slow, so that explains why the site was so damn unusable.

It's a shame, as a realistic setup would be much more informative.

To be fair, the person who created the challenge stated that is was a fairly standard setup, replicating something outside a lab, but in reality is was something completely different, and not anywhere near how PHP is usually used.

It used the development server in PHP, and did not even run requests with fpm or mod_php. Instead, it used the built in dev server of PHP, and just proxied requests from nginx to the php dev server.

Literally the first thing on top of the PHP docs about the dev server used here is this: "Warning This web server is designed to aid application development. It may also be useful for testing purposes or for application demonstrations that are run in controlled environments. It is not intended to be a full-featured web server. It should not be used on a public network."

That is not something people do, and it also explains why the site was down all the time, cause the dev server is super slow, as it's not meant for this in any way shape or form. A real setup would add a few zeros to the requests per second a server could handle.

So all in all, this was very pointless, as it was nothing like real php sites. A shame, cause a realistic setup woild be more interesting and relevant to answer the question of how hard is it really to gain RCE on a normal site.

What is the normal config? Could you publish the setup on GitHub or anything like that? I see some say that it is hardened, others saying it doesn't run PHP etc.

Would be fun to see what it's actually running. :)

They are not selling tokens at a loss, they have insane profit on tokens. It's the only think making them money instead of loosing money.

But at least he has $66B in BTC. /s

While I kinda agree, please do some testing and validation of frontend for websites too, cause LLMs are quite bad at it. It might look right, but usability and performance is often terrible. But that is often the case for pages made by humans to, so... Garbage in, garbage out, I guess.

To be fair, if LLMs were good at decisions, we would not need people.

It's a "sports car". At least that is what all the marketing says and has said since forever. Even the title on the website is "Electric sports car". But it's not really a sports car, it's a fantasy car that does not exist, and never will exist.

And the car would have 4 seats(now 2), over 1000 km range(now less than half), and be the fastest car period(now very far off). Then they say it will do 300 and something km/h, but also say it will do Mach 0.5. They are completely clueless, as usual.

Bigger and still worse than existing free Chinese models that are smaller? Open weight models are nice, but at this point it seems western models are very far behind Chinese ones, despite Chinese companies publishing a lot of their findings. I hope we get more open models and more providers, as being stuck with a model from China or US with no competition is risky.

Google does do a great job with Gemma models. It's one of the few language models actually good at language. OpenAI's top closed models can't even write norwegian correctly.

As you say, the driver skill is very different between F1 and GT3. If traction control was allowed in F1, the teams would not settle for something like in GT3, it would become an arms race. In the end we might end up with racing determined by who has the best control algorightms, and not who has the best dirver/chassis.

Codex/ChatGPT Pro 20x isn't really a thing now, they have disabled it a week or two ago.

OpenAI didn't mess up. The model would have been 100 % pointless and obsolete without the large price cuts it got, because of the cheap Chinese models.

The open models are getting closer and closer, and because they're open, people are not forced to pay the silly markup that is often over 1000x the cost to serve the model.