Business partners could be a trade secret.

Interview 'team dynamic' is a trick question. Shit on past employer, they'll expect you to do the same to them. Answering with something like 'I'd be happy to discuss different team dynamics and hazards in hypothetical contexts, but I am not comfortable with discussing internal dynamics of specific previous employers.'

I am not the least bit confused. The same technique that might be used to remove "harmful" behavior can be used to alter any behavior. That's self-evident to anyone with even passing concept of how models work.

False. The depth depends on the effort made to analyze the model and test behavior. There is no limit here: abliteration can be as shallow or as deep as one has time and money to spend.

The world is definitely going to S.H.I.T.

How many links about the PHP vulnerability have you submitted?

*Citation needed

Not once today did I ever think about other peoples penises. You might want to do some deep self reflection. And while we're talking about skin color, Zoe looks pretty white to me. https://ancillary-proxy.atarimworker.io?url=https%3A%2F%2Fwww.linkedin.com%2Fposts...

Rust Rocket whistles innocently.

Because the average person doesn't know PHP from PBJ. Oh and fuck off with your DEI bullshit.

I like hack languages. But many years ago, my friend setup PHP on my server (LAMP style) and it got hacked and defaced, so I updated it and tried to set it up correctly while also making sure the applications people wanted would work. (just a little hobby server). Got hacked again two years later, even though I was mostly just following the distro's updates. I kind of felt it was a bit of chore to keep PHP secure, more work than I could commit to.

I ran AOLserver for a while (Tcl-based apps server) and it was really nice, but not much out-of-the-box I could put on there. These days with reverse proxies and nginx, there really is no reason to use mod_php style setups. And you can pretty easily isolate anything in a jail or container to keep the blast radius down (unusually). And I've had a lot more luck in terms of hardening things when the services are written in Go or Rust, plus they tend to run faster or use less resources than Python, Ruby, or PHP. NodeJS and Deno weirdly fast and light weight for what it is, at least for the relatively straight forward web apps that you once would do with LAMP. But the package distribution for Node is horrific to anyone security minded.

Is he too lazy?

It doesn't really matter who owns a "company". What really matters is who runs it. For example, are the original founders still running the "company", do the current owners have the common sense to let the original founders do their thing? If so, things may be fine. Similar if the original founders had handed things over to trusted internal successors who they trained and who maintained the original culture and quality.

If not so, then there is a genuine concern that the acquiring company is just selling an empty brand name and the products may be missing what originally made the brand great. Since the acquiring company is actually competing in the same market segment, this concern might be moderated. We'll see.

These are also many of the most looked at, most often fuzzed, SAST scanned, valgrind'd things in the world.

I really don't think it will be as bad as all that. We have not seen Apache, Nginx, etc pwnd like this, or OpenSSH, or Bind, or postfix ...

I could go on. I think the actual posture and condition of most of these project is far better than you apparently expect. (I guess we are going to see who is right).

What AI is finding is stuff the other scanners miss, which is stuff where there is a clear temporal component. We are going to see races, toc-tou, probably more stuff like these PHP issues which if I understand correctly is a use-after-free or something you could at least force into that taxonomy.

So there are going to be new bugs found, even seriously impactful appearing ones, but the reach-ability and chances of successful exploitation outside laboratory conditions is going be low... Do they work when it is a VM on you lab server you can hammer away at with 1000 threads yes; when there is a AWS ELB in-front or a waf that has any impact on request ordering or pipe-lining, good luck..

I am not saying people won't be spending more hours patching over the next year or so than they have been, they will but the sky probably also isn't falling

People say that but I think they say it without a lot of real understand of what the web was like when it was born, and second that PHP5(+) does not look much like PHP 4(-)

Before PHP there were CGI scripts/programs, which were Perl, sh, or C or if you were on Windows classic-asp. If you wanted maintainability your wrote in Perl (yeah I am being serious) and if you wanted performance or needed to do something complicated you wrote it in C. Remember we are talking 1995-97 here there isn't even a C++ standard yet! These were you main choices for 'web development'.

PHP let people do what demanded C in something that did not have to be compiled and did require understanding C style memory management. Here comes the big BUT though, all the really good, really useful library code out there was C. All those library authors did not talk to each other so everyone was different in terms of conventions, who allocates the the caller or the called, who frees, are we passing references or values for primitives, etc. All different and php did not attempt to hide any of that as it pulled in those libraries it wrapped them in its runtime and memory management without attempting make their use orthogonal and part of some consistent ecosystem.

It wasn't a 'hack' it just was not a complete abstraction.

That was 'fine' for people who came to PHP from writing C, and were using PHP because it let them make changes on the fly, saved writing a lot of boiler plate request life-cycle management stuff, etc. It all made sense, if you can at it not from C though it was confusing mine-filed of gotchas. It made web development possible for a whole lot of people who never got access to compiler. That was cool, but it also put a lot of power in the hands of people the way the Visual Basic "Declare" keyword did, and unsurprising they did hack-y things with it, cause themselves all sorts of problems..

Nope. I watched an interview with Tom Homan, current iCE director, who has served in ICE since the Obama admin. He stated that 70% of detainees have a criminal warrant or removal order from an immigration judge, a foreign criminal conviction, or deportable under a national security ruling (ie from Iran or other countries designated state sponsors of terrorism). Most other detainees do not fall into the preceding, are illegal aliens with no criminal background, but they were found with the preceding group. In other words sanctuary policies got them detained since the targeted criminals who happened to fall into state or city custody were released back into the community rather than handed over to ICE at the jail. So ICE had to go into the community to find the targeted. The non-targeted that they also find cannot be released. Current law, as passed by Congress, says ICE must detail them all. For no other reason than they are here illegally. As Obama did with about 2 million illegal aliens.

The Trump admin created a self deportation option where current immigration related fines are forgiven, free transportation is provided, and $3,000 is also provided. Plus one will remain eligible for future legal immigration into the US. That's seems a quite humanitarian way of handling things. Its also probably less expensive that having ICE go find people and deport them.

Nearly everyone, including the current administration, has empathy for the people who show up at ports of entry where they are interviewed, identify themselves, and have a medical screening. You know, like millions did at Ellis Island.

Good, they are opening up positions for vets who went to school on the GI Bill.