jopicornell

Well, that's a "mitigation problem", it was part the official mitigation: set two flags on the php.ini and block multipart forms. You can see them in the ghsa. If that's what they recommended and it was part of the most recommended mitigations on the intrnet (I already did that 6 hours before release without even knowing if sources were right). I see also recommended to shutdown your server. This wasn't official and I'd liked to know if that was the right path.

I agree. That's what I hoped they'd have released between preannounce and version release. I think it's the minimum and doesn't hurt anyone.

The complete silence I refer is after the incidents and leaks. They stated in their preannouncement "We reserve the right to release earlier should details of either vulnerability become public". That sounded to me that if something is leaked, they'll release earlier or clarify. Neither was done and only after the release, clarified things.

But yes, the preannounce was the right move and the leaks were unfortunate, complicating things. But if cloudflare, bunny and other actors start mitigating in their WAF, I think something has gone wrong and, either you act by releasing earlier or calm the waters saying "the exploits are wrong" as per stated in their post, they thought it was the case.

I have a lot of sympathy for the PHP team as well, I hope it doesn't sound like it.

A lot of speculated info was right: the mitigations were mostly right, the video showing exploitation was real and the release of a fixed image was real.

I think if you do a pre-announce, and you say that you could release it earlier or release new information and you don't, and there are reasons to inform your users, then even if it's the middle of the night for you, you should.

As they stated, they are a small team and they have changed their structure, and they are learning and improving. I think if something like this happens, info is vital for us, the administrators of PHP servers

I think the PHP security team and the whole PHP team could have been more communicative and keep releasing information, adapting to the news, suspected exploits and mitigations.

If a video is released showcasing the exploit and following mitigation recommendation, PHP should clarify what it is and if the mitigations are recommended or not. From the pre-announcement: > We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.

If no info is released by them, no other party should have released anything. If info is released or leaked from partners or involved parties, you should notify and explain what's going on.

But no, complete silence from PHP news or any PHP community member.

I get that it was a complicated situation, and I think PHP is the "less wrong" party involved, but I think this constructive and external criticism could help in the future. It has been an interesting day (GMT+2 here) and a rollercoaster of monitoring and mitigating without any reliable source.

Well, I'm no cryptobro by any means, but I see the usability in cryptocurrencies. As always, when humans touch something well built and thought, it goes corrupt.

The basis? It is useful to overcome censorship, inflation and money transfers without relying on third parties (or relying on burocratic, traditionally greedy and ancient parties). It has some uses as a ledger, but this has not come that useful. Or, in my opinion, useful projects are overlooked and only greedyness is what drives the space.

Your sentiment is not wrong, but I see it as a reflection of human currency interaction. If I say "I don't think I ever heard anything good coming out of cash" could be true. Why would we hear something good about something that only its bad uses are news and worth mentioning. Same happens with crypto. I know it is a bit of a mental stretch to use this argument and it isn't 1:1, but cash is being used illegaly as well.

I see a trend that all privacy focused projects have this bad press always: - Cryptocoins (used only by scams) - GrapheneOS/privacy focused oses (used by fugitives and crimibals) - Tor (Used for dark web)

and while that's true, I keep thinking that the interests for banning privacy focused projects is what drives that bad sentiment and bad press. Not only that, I know betwen black and white there are grays and colours :D

Just my grain of salt

Monopoly is not a nice thing. Maybe it is convenient, but not nice.

People that gives money to artists are the ones going to concerts and buying music directly to artists. Spotify gives cents to artists, incetivizing awful behaviour (AI music, aggressive marketing, low effort art...).

Dialogs are a great way to lose information. They are often dismissed by users that want to do their job and are interrupted by modals. Users focused on their tasks blindly dismiss dialogs.

Read the above as a critique to your strong opinion and not an opinion of mine.

My opinion is that toasts are great for notifications that can be reviewed/checked later, like chat notifications or finished background tasks.

What should be avoided, just for the same reason as modals/dialogs, is an overuse, causing fatigue.

If a vehicle can't react to the emmergency break of the vehicle ahead, it's their fault. Change the kitty for a child and the complaint of the scooter is nonsense.

Same as my other comment, it seems like you are involved in the project. Stop responding like this is facebook or reddit. Here we offer our expertise with all good intentions. They haven't said it is a simple task, you are assuming that they said that.

If you can't take constructive criticism or even respond to opinions you disagree, then it is better to not respond at all, because it is bad PR.

I understand that maintaining a project like this is hard, that you need to be compensated and that open source corporate usage tends to be disgraceful. But that's not what they are telling you. They are just shating their opinion, which is part of your potential customer opinions.

Share the rationale behind paywalling common features. Give us, if you have to respond, why you hide the pro features off the homepage, etc. Instead of this kind of childish reaction that adds nothing

I have already seen a few of your responses to criticism coming up toxic like this. They don't need to fork it, but some of your potential customers could. They are explaining to you their opinions, and in HN, this is very valuable.

Most of us have some decision at companies, which are your real customers, and criticism like I've seen you respond boldly and badly, is the criticism I think you should review and take into account.

Personally, I like everything of the pro, except the features that you decided to exclude. Doesn't seem pro features, but features you ramdomly decided not to open source them, and that could be ok. But instead of doing it like this, maybe put a restrictive license so that companies with more than 5 people have to pay.

But I think you should focus on premium/pro features that are really a plus, like your debugger, the bundler, etc. And find features that aren't common and give a plus.

And it is an opinion which you may disagree with, but if you respond to me, don't do it like that, because to me, it is not professional and I'll tend to avoid doing business with people that respond like that

That makes LaLiga look as if they were the victims, but they are not. They don't want to notify Cloudflare nor have done it any time since they started blocking it. LaLiga says that this blockings affects "hundreds" of people, and that they a rightful by doing that. Truth is, they are abusing their power and the spanish legal system to do whatever they want, as usual.

Cloudflare is not ignoring LaLiga and they are open to collaborate, but LaLiga refuses to do so, and are battling legally over it.

It's not a sponsored content but a happy user sharing with its community.

> You want me to pay to search the internet?

Yes. Or you pay and get privacy and good results or you don't pay and they decide which results are better for their profits. That's not how it should work. Companies should build good software so that users use them, not because they have the monopoly and can do dark patterns that result in good profits for them at the expense of the user privacy. Google is not a good software company anymore, their products are abandoned and UX is in extreme decadence in favour of AI.

On the other hand, Kagi uses AI to provide good results and give the best UX to its users. You see? The other way around.

By itself

I care what one of the most famous philosophers and thinkers of our times says. He's not the most up to date, but calling him an idiot positions you politically and intellectually.