stackghost

Touch *balls*?

The idiots that wanted no takebacks are the same ones who lacked the critical thinking ability to foresee this exact situation.

So, your argument is “don’t have kids because your parents might develop health problems”?

Which software have you rewritten for speed?

Of course nothing will happen. The wealthy play under a different set of rules in America.

> Who is cultivating a "favorite language"?

I don’t know, but deflecting legitimate criticism of a language by calling it “language purism” seems pretty emotional to me.

>It is so difficult to feel scale with aircraft due to the fact that most of the images are of them flying and so there is no context. Seeing them in person can really help put them in perspective.

100% this. I got to ride in Vera, one of two airworthy Avro Lancasters, a few years ago, and I was shocked how small and cramped it was. The C-130 Hercules, far from the largest military transport today, feels luxurious and roomy by comparison. And that was the RAF's premier bomber, among the heaviest bomb loads.

And likewise, the comparison between a P-47 and a Bf 109 is not something you can really appreciate until you see them side by side. I would not have wanted to go to war in that cramped metal sarcophagus of a Messershmitt.

This has nothing to do with purism. I use python all the time, where it makes sense.

What I don't do is cultivate a "favorite language" and make it my whole identity, and then take criticism of that language as some sort of personal affront. Python objectively has some serious flaws. That shouldn't make anyone emotional, and I don't know why people get their backs up like this.

>Ok but a mediawiki page is obviously not comparable

The attack is against the underlying php install, and is application-agnostic, I was merely duplicating the trailofbits POC.

The dump truck that is C++ definitely goes just as fast if not faster than that Hellcat, though.

To me it seems more like C++ is the metal shop's old school 3-axis mill: effective and dangerous. Can do almost anything, including easily maim you unless you're continually vigilant.

Go seems like a CNC machine: just as effective, much less dangerous because it relies on digital safeguards and embedded controllers. You need to go to extreme lengths to make it do something it wasn't designed to do.

Python seems like lego. Shit simple to build things with, lets you start building immediately, fantastic for prototypes, but finished product is still just press-fit plastic bricks

I don't agree at all that it's a coke/pepsi situation. That analogy is for when two mostly-interchangeable choices develop tribal followings based largely on personal preference. Coke and Pepsi are both caramel carbonated soft drinks that are terrible for your health differing only slightly in flavour. Otherwise they're materially identical.

C# is strongly/statically typed, compiled, and quite fast (after the vm has started), whereas python is weakly/dynamically typed, interpreted, and generally slow as fuck. Those are two fundamentally different languages, how could it possibly be a coke/pepsi situation?

I think python is fantastic for certain use cases: gluing other tools together (like LAPACK or other ancient libraries), system automation, prototyping, exploitation (I think pretty much all of us were working on stealmybitcoin in python), and exploratory data analysis.

The problems arise when people try to write, say, gigantic GUI applications in python, or really anything with CPU-bound workloads. Part of being an engineer is using the right tool for the right job. Python is the wrong tool for lots of jobs. That shouldn't be a controversial statement.

The only professional I saw making that claim was the CEO of trailofbits who is a former NSA TAO member and doesn’t have anything to prove by talking a big game.

It wasn’t that difficult of an exploit, to be honest. I myself am not the leetest of the leet but I was most of the way there, having been set back by the downtime and my time zone. It’s definitely a fiddly, tricky exploit as most memory exploits are but I think the initial alarm was justified.

While waiting for the server to come back up, it took me about 3 hours with LLM assistance to write a php2shell RCE for nginx and mediawiki on the same version of php as TFA.

The biggest win, as others have also observe, was the demonstration that there aren’t swarms of automated pwnbots out there that will insta-root your server.

Considering the amount of downtime, I think that flag got got pretty quickly.

Astro is based on npm is it not? Given the state of that ecosystem and the rate at which new vulnerabilities are being discovered these days, I prefer to stay as far away from Node as I can.