PHP: you get your burger
(midwest.social)
Programminghttps://www.bbc.co.uk/news/live/ckgel5xp2xv9t?post=asset%3Ac8185d02-3e14-4e83-9a99-6d3be2de04bd#post
the person getting the burger actually has a user agent which fetches the burger for them. Its a food delivery app and the browser is doordash/uber eats etc. Instead of packets its human beings who read a screen and understand obligations.
4
The cook should be represented as the database.
Back in the 80's, my brother "hacked" a pizza place because he knew how they wrote green olives and black olives on their ticket. He dated a girl who worked there for a stint.
I don't remember how it worked and he has since passed, but it was something with the order that he would list the toppings that would fuck up the cook, so the order always came out wrong and boom! Free pizza.
Step 5. you inject poison in your burger and send it back. Causing the cook to die and you take over as the owner of the restaurant
Dam, I guess I was a programmer at KFC, and I didn't even know it...
How it should work for 99% of websites.
https://motherfuckingwebsite.com/
CSS didn't do shit wrong:
http://bettermotherfuckingwebsite.com/
Can we get Samuel L. Jackson to read it for those with vision impairment?
Love this one. Only thing I don't get is why so many people can't stand high contrast. Or even go so far as to say white background hurts their eyes. Black on white is just fine, thank you very much. And if it is too harsh, then I suspect that actually either one's monitor is too bright, or - more likely - the environment they're in is too dim.
most people who have seen the old internet probably feel this rage
Ublock blocks this for some reason
EDIT turns out the reason is it appears to be infected with a botnet
That's weird. I did some digging and can't find its name, ip, or hosting company servrex.com on any block list. I checked HaGezi on github based on your post.
I used this https://github.com/hagezi/dns-blocklists#listlookup and searched https://motherfuckingwebsite.com/
If you search the closed github issues, you'll see more details for the url
Which list? I searched the Multi Ultimate Full list and it wasn't there.
https://github.com/hagezi/dns-blocklists/issues/11017
https://github.com/hagezi/dns-blocklists/issues/12026
Well that's even weirder. It is in a list labeled malicious/scammer/fishing.
It absolutely isn't any of those.
Someone else claimed it pulls resources from a botnet but if you view source, that isn't true.
Well, I didn't check its internals.
Not in Librewolf, at least. Ublock and Noscript enabled. Site still shows.
Adguard blocks it. Adguard usually is more trustworthy
You probably don't have these filter lists enabled: 📒 HaGeZi - Multi PRO mini 🔐 HaGeZi - Threat Intelligence Feeds - Mini
Wow! That's why I love analogies -- in most cases they don't make any sense especially if you are not a specialist in the theme.
Well, they do have some prose in the link that OP also posted, but yeah, it is a bit rough, especially if you're trying to understand the vulnerability..
holy fuck
70% of websites are running PHP?
are they sure?
Am I going to find a php binary in a node_modules directory
I kinda buy the 70% claim, mostly because lots of old CMS systems are built using PHP some of which are still extremely popular like wordpress.
over half of that 70% is just wordpress.
Wait till you learn about this new CGI thing, you'll be amazed about what it can do: https://en.wikipedia.org/wiki/Common_Gateway_Interface
I doubt it will cook burgers for you though 😕 😔 🍔🍴🤤
For some reason I am hungry all of a sudden...
Why is everybody talking about PHP lately? Am I out of the loop?
They fixed a bunch of vulnerabilities there which were known for years but neither hackers nor PHP developers cared much until recently.
Wait it was known!? They didn't just discover it and fixed it quickly?
It's not a quick or easy fix. The patch is a 10000 line nightmare. No really it's actually 10k. A lot of that is test code, but there are also significant changes to deep engine internals.
PHP did really really bad memory limit handling. Now it's only really bad.
Wow scary fix, I'm guessing we're going to be seeing a few new patches really soon fixing bugs created by this latest version
No, they chewed snots for years because there wasn't a trivial and straightforward fix and exploit looked too "theoretically possible". But some time ago(months? year?) some company showed them a working exploit, so they started to think how to actually fix the problem. All that time they kept all in secret so hackers wouldn't know. But the fix had leaked, letting hackers to figure out what was the vulnerability in the first place, so snot-chewing was replaced with running-and-screaming. By now everything is fixed for those who cared to update\recompile. Something like that.
Thanks, makes sense!
To add what the others said, yesterday morning there was news that every php version is vulnerable but the fixes were published very late in the day (or whenever depending on timezone) thus there was a 8+hours of unceartiny and fear for administrators. A lot of websites shut down due to that.
Most of my experience with PHP is from pen testing so most of my orders look something like <?$_GET[0]?>
