It's not just the parent commenter. I'm sure somebody out there is going to remove their account password instead of editing their sshd_config in an attempt to "patch" this vulnerability, actually exacerbating the problem.

Don't trust Ubuntu's LTS promises, either. Most of the modern packages you care about are in universe, which almost never gets patched after the initial release.

I think they deliberately leave the free LTS version insecure in order to sell Pro licenses. But guess what, even Pro doesn't get timely patches.

Samsung skipped an entire range of numbers from Galaxy S 11 to 19.

Looks like tech companies don't like 9...

I hope they clean up some of that mess in PHP 9, but no, they're just going to add $shiny_new_feature and make the attack surface even larger. Like, why does the session handler even care about measuring upload progress?

Some people just follow a spec and don't stop to think what that spec is supposed to accomplish.

PHP does need to invest more in the built-in web server, though. Last time I checked, they still recommend against using it in production.

All other popular runtimes provide a standards-compliant HTTP daemon that any other HTTP daemon can proxy to, it's just the way things work nowadays. Insisting on FastCGI limits integration with more modern web servers and HTTP-speaking middleware.

They released some binaries, built for their own docker image based on their own Linux distro. Other people couldn't use Chainguard's "fix" to patch their own systems. The only people who seem to have benefited from the stunt are the hackers who used AI to reverse-engineer the binaries and write exploits.

That was a giant fuck-you to the rest of the PHP ecosystem, nothing more.

The launchpad server is throwing 503 errors all over the place, so that's probably the reason for the delay. Sury's own repo has the fixes all right.

"modern" = after the industrial revolution, which implies broad availability of farmed meat, leading to a gradual decline of hunting.

Yes, predation is a major factor in rabbit population control. And I'm counting British people as formidable rabbit killers, so I think we're in agreement there.

Unlike Australia, Britain had wolves and foxes for a long time. Not to mention the apex predator, Homo sapiens, who in late medieval and early modern Britain were probably much more eager to hunt and eat rabbits than modern Australians are.

We all know where this is headed. Sooner or later, they're going to drag copilot into it.

Even if the TCO for the clinic were exactly the same over X number of years, the manufacturer that sells subscriptions still comes out ahead because they're effectively in the financing business, too. Why tell a customer to go borrow money from somebody else when you can make them borrow from you?

Which is why they are valued at "only" 7.5B, while frontier labs with general-purpose LLMs have valuations in the order of trillions.

Horowitz et al. invest in probabilities, not certainty. If Typesafe doesn't make it, they'll have other horses in the race too.

My project exists for the concrete purpose of helping the community get things done, not for the abstract goal of making good software. (It actually isn't very good software, to be honest.)

If you're a real human being who needs help fixing a bug or implementing a feature, I will gladly take the time to help you. But if you're a bot that is just trying to tidy up my software in accordance with some ideal design pattern, unrelated to the specific needs of any human being, then you can just go help yourself.

Open source projects have had gatekeeping mechanisms for decades. Remember ESR's popular (albeit exaggerated) posts about how to fit in with hacker culture? It's the same thing. There's nothing wrong with it. New contributors must prove that they know how to be a good member of any community they're trying to enter. There's no abstract ideal of openness-to-all that we must somehow all strive for. Follow the needs of the actual community that you care about. Don't feel sorry for spammers, especially non-human spammers.

Besides, pants with button fly have the distinctive advantage that you will never get your most sensitive skin accidentally pinched between the zippers. :)