Now I don't know what happened here. Maybe PHP foundation reached out to docker but got no help, maybe they simply forgot about docker as distributor of their software.

I'm quite certain that your exact sentiment is why the images weren't updated immediately: I'm afraid PHP foundation doesn't see docker images as a particularly important distribution system.

Because now a vulnerability in PHP affects practically 100% of the users. But with more diversity, it would affect only a part. And if one runtime proves insecure more often than another one, organizations have a choice to move to an interpreter that better fits their security needs.

For my rust applications, I use "cargo audit" which checks all dependencies against the CVEs. For my typescript and javascript applications, deno audit and/or yarn npm audit.

For the rest of the stack `debsecan` does exactly what you want on Ubuntu: report CVEs for installed software.

Several attributes make a safer ecosystem. An important one is diversity - technical diversity.

For an interpreted language, the runtime is important. Python has several runtimes, as does Ruby. Javascript also has several, from the few browsers, to node, deno and bun. PHP has for all practical purposes, only one. So if there's a security incident in PHP, it affects almost all users. But when e.g. JRuby has a vulnerability, it will affect only a fraction of the installed ruby applications.

For compiled languages, the tooling, libraries and runtimes is where diversity is important. With e.g. rust, the vast majority of CVEs come from libraries (crates). But since there often are several crates for a single concept, diversity helps mitigate here too.

Many modern hosts run php in fcgi mode, where your app is a process that listens on some http port. And where the webserver is "just" a proxy and ssl termination. Shutting down the process is enough.

But traditionally, php was a module loaded into apache. Where apache not only handled ssl, http etc, but also compiled and ran php for you. With that setup, adding an html file, will keep the php runtime and app online.

The only times I had to use third party packages for basic stuff, was when developing embedded software on limited hardware.

Do you mean that for async we need third party runtimes like tokyo? Or that types and utilities that many other languages ship by default in stdlib, like http aren't in rusts?

I'm sorry for the tone of my post. It was meant as honest surprise, but I clearly see now how it sounds baity and provoking.

Not only 10 years of no more security updates. But hosting static content is cheap, performant and sustainable. Bot literally (you can move the content anywhere, using any kind of server) and in energy sense.

While I understand it is not for everyone to write markdown files and run build commands, I strongly urge anyone with a WordPress or drupal site to give the various jamstacks, or static site builders and guis a test run.

And the work to clean up if you get compromised is massive.

I think it is ever more important to realize who is releasing models rather than what the models do and how they compare.

Because models iterate at breakneck speed, looking at today's benchmarks is only useful for someone using the models today. Whereas if one builds a product on top of it, or commits to one for a project or team, the company or organization behind it, is far more important. Will they exist in a few months? Do they need a business-model? Are they subsidizing usage with venture capital and how long can they keep this up?

Is reflection a company? University lab? NGO?

If you get access to a VM, it's not a "security vulnerability" if you then have access to that VM. This was the whole point, the product.

It's almost like returning a car after you bought it with the reason "When I open the door with my key, the door is open and anyone can get in".

The scripts that were generated included code to determine if joplin was running, and to launch it if not. It included a proxy server, that would listen on a localhost:xxxx and if a HTTP request came in, this proxy would auto-launch joplin and then forward the request/response. It then included quite some code to de/serialize json to/from datatypes.

Part of this "overengineering" came from a "skill" that claude found globally which I wrote for myself when working on a few python tools. The skill required strict typing, demanded refactoring, insisted on doing everything over http (and not local commands).

Basically, the agent could not perform its task over an MCP and should've stopped. But I suspect either tuning or some system-prompt made claude go on instead. It decided to use python, and then found my "requirements for when writing python", followed that, and burned a lot of tokens to make one or two HTTP requests.

Some models are reproducible, in that the same prompt will generate the same output. Say that we could wire up such a model to generate some code.

In that case, we could create a prompt that generates, say, an entire codebase, or a large piece of text. The prompt (or really, the tokens) would then be the compressed version of the codebase or the text.

I am not talking about an "AI agent", but really a model that we call in a reproducible manner. Preferably one call, with one prompt. An agent could just run `git clone` to "decompress" a codebase, which conflates the idea of compression. If that were compression, then the "compressed version of the git kernel" would be a single line of text: `git clone https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...`. I am really talking about having an LLM re-generate text based on a prompt.

Does that make sense? I can imagine that this is highly impractical and inefficient. But would this count as "compression" at all?

Because the alternative, as proposed in the article, is that an agent researches an API/CLI/UI, builds software to interact with it, and then runs that. Every time again. Not only very inefficient, it's unpredictable, and often slow.

Just last week I had an MCP that was down (my mistake) and the agent "decided" that in order to finish my request, it needed to create a python script, refactor that, debug that, and then use that, so it could access my notes (Joplin) over the API and write it's weekly update markdown there. Somehow the thread produced a python tool with over 400 lines of code, five files. It, at some point, even considered putting all that in a git repo. And went on a side-quest to run docker containers.

With the MCP, this job typically takes between $0.05 (Mistral) or $0.90 (Claude Opus). It now cost me $17.00. It took nearly 30 minutes. To write a note in Joplin!

MCPs, or any de-facto standard/pre-known protocol, makes operating on external tools and resources cheaper, faster and above all more predictable.

If I send a single email "subject: poster" "make me a poster for our event, details below, we need 200 printed" that's also low effort. If I do this on fiverr, it's also "unwillingness or inability to spend resources"

> your product or brand.

I think you are conflating a wide audience with a narrow idea. We aren't talking about just the large coorporations, or the popular rockband. There are local bookclubs, a carbootsale, a group of hobby-foo-bars showing their foo-bars at the local pub next month. A concert by "amateurs". Someone looking for an appartment. A cat that got lost.

Do all of these need to show high-effort and/or willingness to spend resources?

I think it's actually a feature when people can recognize it as AI.

Why would someone want it to be unrecognizable as AI? What is the reason people want to hide AI usage ? (other than when "cheating" in studies or examns or such, obv)

But only for compute tasks. So, practically an alternative language to write compute shaders in.