ferngodfather

This is great to say with the benefit of hindsight but nobody is changing the underlying language of their well established product for literally no reason.

And that is even with the assumption that other languages don't have issues - they do.

You just need to implement an SSH CA. You can roll your own. Vault has an enterprise one. StepCA is suitable for smaller orgs.

All the benefit of the core SSH protocol as it's just key signing. It's honestly underrated.

Wikipedia has blocked it for years. Glad everyone else is finally getting around to it.

> This of course means that these attempts would succeed for anyone that was whitelisting Cloudflare IPs but blocking others.

No, the ranges Cloudflare tells you to whitelist are only their proxy ranges. Workers and all the other junk comes from other ranges that won't be whitelisted.

Of course it's a different matter if you're just whitelisting their AS.

Yeah, fuck them all and Calif in particular

"it's not claude"

CVSS scores are a bad measure anyway

And yet it seems all their forewarning did was lead to the proof of concept being leaked many 'valuable' hours before.

I've said elsewhere I am sick to death of reading AI written "security disclosures". Even for genuine issues, it just saps my motivation to fix them.

That said, PHP team handled this poorly. How does letting everyone know so they can "prepare" help anyone at all. It just creates panic.

I could never get either working sadly.

flaresolverr even had an open issue or similar that acknowledges it's basically dead last I checked?

Because 1337 is behind Cloudflare meaning the Sonarr stack can't use it properly

I'm glad someone actually took the time. I've been running into this for weeks and it as thinking to myself isn't this a rather silly and old trick to be bringing back.

Mainly with new Mobland episodes.

I reported a fake software update advert on YouTube. The report was declined. I appealed, and that was also rejected.

They couldn't see anything wrong with a maliciously fake software update advert.

Yeah give me a vuln and I can make it anything between a 2 and 8 quite easily. I routinely see 10s that are "Critical 10.0 CVE (but only if you're using X language with X setting changed from default, and the attacker can MiTM your traffic)"

People on my FOSS project couldn't see the issue with their AI slopped documentation contributions.

On one hand I'm like, yeah fair enough it needed writing and something is better than nothing.

On the other I know nobody wants to read it now because it's just word vomit rather than how a human would write something they'd like another human to read.

I hate it so much.