WJW

For "research" purposes, no doubt.

So they do it to attract talent then, and not out of charity?

Yes, but it also has many conditionals, for example:

- The faster package may have been available for a shorter amount of time and so downloads have not had the time to catch up yet.

- Many people may not be aware of the faster package, but they would switch if they knew.

- Maybe people are aware of the faster package, but there are switching costs that prevent them from adopting it right now that are greater than the costs incurred from the slower package.

I might be in Cornwall in a bit, so I might take you up on that :)

But yeah, it happens. I could share some stories of me (being responsible for) bricking multiple ~200k circuit boards in a row, if that makes it better. In the end nobody really cared and the world kept on turning. Good decisions might come from experience, but experience comes from bad decisions. It's how it is.

So how does the exploit actually work? The best I can find is that they manage to use the corrupted generic decoder state to write a single pointer and associated PHP type information anywhere in memory, then immediately claim "this is RCE". Is that enough? From my (admittedly limited) understanding of such things, after writing code to the target memory you also need to be able to start actually running it. Or do they overwrite the PHP code (which is somewhere in memory) and then let the interpreter do its thing?

From the related article on calif.io:

> We therefore control where PHP places a pointer and its associated type information. This is application-dependent RCE under both Apache mod_php and PHP-FPM.

Both articles describe how you can end up with freed memory that still has pointers into it. I can understand that this should never be possible, but it seems to me that both articles skip the very important step of how to actually turn this into RCE?

From my (admittedly limited) understanding of these things you would not only need to write arbitrary memory, but also need to be able to jump to the relevant address to execute such things. Or do they overwrite the PHP (byte)code with their own and then just let the interpreter do its thing?

Because websites with news, continuously updated advice, job openings, etc aren't all that static? This type of site hugely benefits from having a easily understandable CMS that you can teach to more or less everyone in 2 days or less. I suffered through a few of those back in my time in the military, where an instructor would teach a class of 20-30 how to build new pages in the CMS

Now are there more powerful tools out there that result in more scalable websites? Sure. My personal sites are built around static site generators for that exact reason. But none of better tools are as easy to understand for non-programmers as wordpress or one of the other click-and-drag CMS tools.

Oh I absolutely agree they should take it offline until the fix is ready, I just mean that the NCSC itself is very much still operational even if their public website is temporarily offline. Like a computer with the monitor switched off.

Well, the public website of the NCSC is offline. Who knows what crazy proprietary stuff they have.

If they were going to implement it themselves it would be unnecessary to faff around with webassembly. They could just keep the native code implementation that they already have.

The problem is that XSLT has so few users that the browser writers don't want to waste any more time on it. Those few people who wrote their site around it will have to either rewrite it to use something else or add some third party webassembly implementation themselves.

Yes, because XSLT won't work in Chrome and Edge anymore.

No it really isn't. People have transmuted a few hundred milligrams of mercury into gold in the lab with multi-million dollar machines, but that doesn't make it economically viable in the slightest.

It would make sense if the AI companies were rationally valued, yes. But they're not, so it's not.

Refining takes big machines and a lot of energy. It's pretty much the opposite of free money, you need to invest a lot to unlock the revenue stream.

Forgive me for being a layman, but where do these new gluons "go"? It seems to me that pretty much all the energy in the bond between to particles is between those two particles.

But then when the energy becomes great enough and it snaps into a new pair of gluons, do those new gluons go anywhere or do they stay in between the original pair of particles. Do the original particles shoot off into the distance because the force holding them together got converted into some new particles?

Is there a link where I could read more? At these super small scales all my intuitions break down so I'd like something more mathematical to get a grasp on things :)