Hacker News: andix

New comment by andix in "Elon Musk Just Gave Europe a Reason to Replace American Technology"

andix — Sat, 24 Oct 2026 14:04:14 +0000

Let's just assume your claim is true, and it is impossible to build software in Europe.

European companies can still build software in different countries. Nothing stops them from building their software in an US subsidiary they fully control. A lot of good software developers are currently looking for a job.

New comment by andix in "Elon Musk Just Gave Europe a Reason to Replace American Technology"

andix — Sat, 24 Oct 2026 13:58:41 +0000

I'm not sure if those comments are even bots. The bots seem to only amplify those opinions and make them more visible. It's a vicious circle, once those opinions are everywhere, more and more people pick up on them and write new posts like that.

New comment by andix in "Today's PHP security release, and how we're strengthening security"

andix — Fri, 23 Oct 2026 15:41:22 +0000

Sure, but what if there is disagreement? Or some people are unreachable? There wasn't any time to schedule a meeting, hear all arguments, think about it, meet again for a vote, ...

I'm still not saying that it was right to break the embargo first, but it's not as simple as it might seem.

New comment by andix in "Docker is weird"

andix — Fri, 23 Oct 2026 15:10:47 +0000

Nothing stops you from doing that either.

Edit: or is something stopping you from doing it this way? It seems like people just don't like Dockerfiles, but instead of just doing it differently (which is possible, it's just a tar file and a manifest), they keep complaining.

New comment by andix in "Docker is weird"

andix — Fri, 23 Oct 2026 14:07:30 +0000

Dockerfiles are completely optional. It's just one way to build images.

You can absolutely build images with a bash script, here's an example (its vibe slop, but it works): https://github.com/andi0b/vibe-todo/blob/main/docker-build.s...

New comment by andix in "eMudhra to Exit Global SSL/TLS Certificate Business"

andix — Thu, 22 Oct 2026 14:32:08 +0000

Good point. I get why some stacks use their own trust stores and not the system trust store. But there should be some mechanism to revoke trust to some of the CAs, without applying patches or rebuilding. Even if its just a convention based /etc/certs/revoked-certs file.

New comment by andix in "Today's PHP security release, and how we're strengthening security"

andix — Wed, 21 Oct 2026 21:27:00 +0000

There were signs that others broke the embargo too. Public (this one video everyone is talking about), but maybe also non-public. There were some rumors going around which part of PHP was affected. That was enough for some people to figure out the vulnerability.

But it's also possible, that some attackers got non-public inside information.

If the embargo is already broken in a meaningful way, it suddenly becomes much less clear if it is still in place after all. Emphasis on >less clear<.

New comment by andix in "Mistral Large 4"

andix — Wed, 21 Oct 2026 19:51:23 +0000

Patriotism.

New comment by andix in "Mistral Large 4"

andix — Wed, 21 Oct 2026 19:50:11 +0000

I see Le Chaton Fat and press upvote, sure. But why? Wasn't it released already 2 weeks ago?

New comment by andix in "Patch the Planet: global response coordination as agents uncover vulnerabilities"

andix — Wed, 21 Oct 2026 19:25:52 +0000

Backporting the fix is much lower effort in total. It's just a few dozen minor PHP releases that are affected, but millions of websites still running on older PHP versions.

New comment by andix in "PHP 8.2.35"

andix — Wed, 21 Oct 2026 19:06:58 +0000

Yeah, took me long enough to learn that. I just trusted the "official" badge.

New comment by andix in "Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds"

andix — Wed, 21 Oct 2026 18:25:01 +0000

What I've heard about the DMCA, they will even throw you in jail if you crack the calculation in your head. Without telling anyone or writing it down. ;)

New comment by andix in "PHP 8.2.35"

andix — Wed, 21 Oct 2026 18:09:40 +0000

For now this is just one person posting about it. Can be real, can be a mistake, can be a hoax. But if it's real, then OpenAI once again fudged up really bad.

New comment by andix in "PHP 8.2.35"

andix — Wed, 21 Oct 2026 18:06:33 +0000

I'm wondering if it's not just better to use plain Debian base images.

  FROM debian:... 
  RUN apt install php ...

This will take longer on a cold build cache, and pins the PHP version to the current Debian version. But Debian once again proved very reliable to patch in time.

New comment by andix in "Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds"

andix — Wed, 21 Oct 2026 17:56:48 +0000

No idea what the DMCA says. It doesn't apply in most parts of the world, and also not where I live. So it's for sure legal somewhere.

New comment by andix in "Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds"

andix — Wed, 21 Oct 2026 17:51:09 +0000

Those 8 bit certs were out for over a year, in the public. So nobody tested them. At least no independent security researcher.

New comment by andix in "Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds"

andix — Wed, 21 Oct 2026 17:45:14 +0000

You can even install your own certs into the golden cage (also known as iPhones).

New comment by andix in "Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds"

andix — Wed, 21 Oct 2026 17:43:04 +0000

I'm wondering how many other private keys might be cropped to 32, 64 or 128 bit and much weaker than we think. Seems like nobody tested it yet. Otherwise the 8 bit would've been found within minutes.

New comment by andix in "PHP 8.2.35"

andix — Wed, 21 Oct 2026 17:17:48 +0000

The "official" PHP Docker images turned out to be a shit show tody. Seems like many maintainers fell for it and published updates that aren't really updates.

I'm currently waiting for a new docker image for another project, and their maintainer noticed the old PHP versions in the freshly built images and is still waiting or working on releasing a new container build.

New comment by andix in "PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 out"

andix — Wed, 21 Oct 2026 14:56:06 +0000

It doesn't allow sharing SMS, email or proprietary app based MFA.