Well, since no one else feels like being the sober man at the table, I will.

The security exploits

AI-assisted cybersecurity researchers, while going through code that probably dated back to the 1990s, managed to find two instances in existing PHP code where a very specific condition would lead to an ability by attackers to execute code on a server. That is known as a RCE vulnerability. Two of those were found in existing PHP code. For historical context, PHP was created in 1994 as “personal home page tools” by Rasmus Lerdorf.

To put it in very simple terms, an attacker could put a web site (or, more likely, web host) in a condition where the PHP server framework would just quit unexpectedly. And a failure at that point means that there is a very small opportunity of time where an attacker could execute code arbitrarily on the underlying operating system. Now that code could do anything, including decrypting passwords held in memory and then using those credentials to gain access to external systems. Obviously not a situation you want to be in.

Now, PHP has changed greatly since 1994, which is, let’s remember, 32 years ago, and software testing has as well. However with the use of AI tools, researchers were able to point out exactly what the conditions of the exploit could be found.

Initially the new vulnerabilities were meant to be kept secret until October 22nd. However, someone leaked the story, on October 21st, which set off the tone of panic.

The problem had already been found and, patched, with new, safe versions being ready for use, by the time the information was made available to the public.

So that’s 90% of the problem solved already. The remaining 10% is deployment.

This is things can become complicated. Not for most sites which are regularly maintained, but for legacy sites, which are often left to languish without maintenance but keep working as web sites, “as long as it works”. PHP, as a development language, has created a lot of those sites, largely because it’s an easy and accessible languages for creating dynamic web sites.

Those sites can still represent a problem because the patch that resolves the RCE issues was issued only for the current versions of PHP, which are all decimal versions of PHP 8. As such any site running previous versions of PHP (7 and below) would still be vulnerable. And with AI-assisted coding tools it could be easy to create a way to trigger the conditions for the RCE and insert malicious code into those sites. Those servers need to be updated to PHP8, if they’re even maintained at all, or their owners risk being liable for damage or system intrusions that originate from their servers.

That being said, those sites are not of particular concern.

Why the “crisis” is overblown

While the RCE vulnerability is serious, it’s a problem that’s resolved at the system administration level. For a lot of sites that are served through a shared web host, the site owner does not have to do anything. In fact the owner will probably already have received a notification that the system has been patched to a safe version of PHP.

For people (like myself) who use their own host to serve PHP pages — I do it through a cloud provider, but it’s the same process for people serving from their own bare-metal servers — it’s a simple matter of updating PHP at the host level. In that case it involves a little more work on the site owner’s part, but the fixed PHP versions have been available since the afternoon of October 21st. That’s when I patched my host.

No other change is required, the web app does not have to be modified in any way. The change implemented by the patch works purely at the level of PHP’s internal workings and has no other effect.

That’s why I can’t understand companies that have taken their entire site offline for extended periods as a result of the vulnerability. Once the patch is applied, you restart the system and things work as they previously did. That’s all.

Alarmist tech journalism is the real problem here. Unless you run your own web server, there is no cause to be alarmed. If you do run your own web site, maintain your system. That’s all there is to it.

<p>The post MASS HYSTERIA! WEB VULNERABILITY! first appeared on The Clever Shark.</p>

Oddly enough yesterday I figured out how to get around that problem, more on that later. But earlier today, at 3:09am, I got a github message about it. It seems that someone did in fact look at my article, probably from seeing it posted on LinkedIn, and at least tried it out. Now this brings up the interesting question as to whether the Canadian federal government is outsourcing its IT work to India, because 3am is not considered “working hours” anywhere in Canada, but that’s a question for another day.

Here’s a screenshot of the message I got:

First of all, thanks for confirming it’s a bug. But it’s disappointingly lazy to say “well, it’s not my job” in response. It’s a bug that affects the usability of the site, it shouldn’t just get closed (which it did), and if it’s “not your job” it really should be passed along to the people whose job it is to fix it.

Secondly, it’s not even a difficult bug to figure out, and I know that because I figured it out by myself yesterday. And I’m not even getting paid to do this. Which is even more annoying, speaking as someone who’s been looking for a job in the IT field for 8 months now and will probably have to go work on the shop floor at Costco because the tech job market is absolute shite at the moment in Montreal (mind you, if you do have to work in a retail establishment, Costco is the gold standard there).

But, let’s get back to the matter at hand.

It’s the “candidate registration” page that’s broken. It simply will not work if you didn’t sign in to the CRA careers site before you get to it. If you go to the CRA Careers site you will see this near the top of the page:

Click on the “Sign in or register” link, sign in through your authentication partner (or CRA ID), and THEN click on the “candidate registration” link, and you will be able to fill out your candidate profile. 

The easiest way to fix this would be to disable the fields in the “candidate registration” landing page if the user is not logged in, and inform the user that they must be logged in before continuing.

However, it appears that the web dev teams at the CRA operate in silos, where each team is responsible for small individual parts of the site while remaining blissfully unaware of what the other teams are doing. Those teams are probably offshore, working for different companies, and have no clear way of communicating with one another. I don’t know what happened to the “Canada First” and “Elbows up” attitude that the Prime Minister keeps talking about, but it doesn’t seem to apply to IT work done for the federal government. That’s a shame, because there are thousands of Canadian IT workers currently desperately looking for jobs, running through their EI, and eventually forced to apply for welfare at the provincial level. If I’d been in that same situation 20 years ago I would have just looked for employment in the USA, or somewhere else in the world, but that’s no longer an acceptable (in the case of the USA) or even possible option for a guy my age.

So, CRA, I’ve figured it out for you. Fix your damned web site!

<p>The post A follow-up on my bug report about the CRA careers site first appeared on The Clever Shark.</p>

Elon Musk Keeps Spreading a Very Specific Kind of Racism (Mother Jones)

<p>The post Elon Musk Keeps Spreading a Very Specific Kind of Racism first appeared on The Clever Shark.</p>

This is obvious *not* quite what’s taking place at Twitter right now.

@elonmusk‘s offer was so much over the realistic valuation of the company that the shareholders just saw $$$$ and went with it. However Twitter isn’t a traditional company. Twitter is a social network. Its technology stack is robust but it’s not particularly outstanding. It works, it doesn’t have a huge lot of features, but it can handle the traffic. Its real value is in the users and the connections it brings to the party. To remain at its baseline of “value” compared to before the takeover, it has to retain its userbase. If users leave, the site’s value is diminished. And this is something that @elonmusk
doesn’t grok.

While he doesn’t get it, users do get it. And their response to Musk’s “comedy of errors” tenure ever since he took over the site is to look elsewhere for a new social network to spend time on, because it’s become clear that Musk wants to take this site and turn it into his personal sandbox. I wouldn’t pay $44 billion for a sandbox, but then I don’t have the sort of detachment from reality that being the world’s richest man engenders.

However for a couple of weeks now we’ve had a look at what @elonmusk considers entertainment for himself, and we’re all pretty much horrified, from Nazi imagery to petty personal fighting to non-stop lying by Musk himself. And that’s why, sadly, now is the time to ditch this platform. Because remaining a part of it at this point is to risk immeasurable personal reputational damage. Think the repercussions in your life if it came out that you were a user of “stormfront” (or whatever KKK-affiliated web site exists out there). This is what Twitter will turn into in the hands of a spoilt man-child with highly questionable morals and a reputation as a con man who has no board to answer to and in time is growing more and more embittered that he can’t just buy a positive image for himself. Or friends.

And if that sounds like I’m describing Donald Trump, it’s not a coincidence; both Trump and Musk are trust fund babies whose lives are led by their malignant narcissism. 

So there’s an understandable urge to leave a platform that’s devolving into a giant cesspit of xenophobia in all its diseased forms, because users don’t want the taint of it.

It’s probably a bad idea to deactivate one’s account, however. All this will do is leave your handle open to a malignant actor taking it over and attempting impersonation. A much better approach is this: make sure you set multi-factor authentication on your account, and then log off. This way no one can use your handle, and you are protecting your reputation.

There are many alternate social networks out there that don’t belong to snake-oil-selling egomaniac billionaires, such as mastodon, counter.social and tribel. Check them out and give them your time and eyeballs instead of watching someone who should know better tank a platform to flatter his own malignant ego.

<p>The post Twitter: a post-takeover poison pill first appeared on The Clever Shark.</p>

Donald Trump basically had to completely ignore the service’s ToS and repeatedly violate it for years to get such treatment, and I did it just by making a simple joke while sitting at home. That’s how I am better than Donald Trump.

Of course there’s also the whole thing about me not being a misogynistic, racist con man with a history of defrauding charities, *very* close friendship with sexual predators and over 30 sexual assault allegations. But today I’m just concentrating on how I’m better at getting my Twitter account suspended.

<p>The post How I am Better than Donald Trump first appeared on The Clever Shark.</p>

Cryptocurrencies are created as part of something called a blockchain. And more than cryptocurrencies, it is the blockchain idea which is expected to have a huge impact on the computing world, at least for the next couple of years. As such it is a good idea to learn what a blockchain is, at both a basic and more advanced level.

The Basics

At its core, a blockchain is a distributed ledger. Those with an accounting background will immediately recognize what a ledger is — it is a record of transactions. A blockchain is distributed, which means that entries in the ledger are written by many parties, as opposed to by one centralized authority.

Like an ordinary paper ledger, blockchains are write-once. Once a block has been verified and added to the blockchain it cannot be erased or modified. This insures that transactions cannot be taken back.

The Nodes

All these “parties” are actually computers running a node for the blockchain’s network on the internet. This involves executing software which contributes to the blockchain network. Depending on the network involved there may be several types of nodes in a blockchain; this will be explored in depth later.

The Blocks

Nodes compile a number of transactions into a block. How large the blocks are, and how often they are verified, varies widely between blockchains. For example, the Bitcoin blockchain generates a block every 10 minutes. The Ethereum blockchain, in comparison, generates a block in less than 20 seconds, and Bitshares blocks are generated every 3 seconds at most. A number of factors affect block time; if you’re not intimidated by math check out this article for more information.

The Chain

Blockchains are so named because each new block is appended to the previous block, effectively forming a chain. In fact one can always look at certain information in the latest block of any given blockchain and trace the blockchain’s history all the way back to its very first block.

Hashing

Since blocks are appended to the blockchain by several different nodes, there needs to be a way to ensure that only the block with the right data can be added at any given time. Otherwise there would be no way of ensuring the continuity of the blockchain from the genesis block to the most current one.

This is where hashing comes in. Hashing is a cryptographical technique that is used to generate a unique code that can be used to identify a set of data, rather like a fingerprint. The hash is generated from the transactions contained in the block and recorded as data in the block, which also includes the hash from the previous block. This is one of the mechanisms used to verify any new blocks. If the previous-block hash does not match the previous block’s recorded hash, then the current block is invalid and cannot be added to the chain.

The actual library used to generate the hashes depends on the blockchain. SHA256 is a popular one and is used by Bitcoin. Other libraries include scrypt, X11, Cryptonight and ETHash.

Hashing produces a completely different string if there is any change whatsoever to the original hashed content. The SHA256 library can produce a very large number of distinct values (3.4028237e+38) so arriving at the same value from two different pieces of content is extremely unlikely. By comparison, the chances of winning the Powerball lottery in the USA is 1 in 2.92e8. One could win this lottery 4 times and that would still be less likely than generating the same hash from 2 different sources. Thus the use of hash values makes blockchains virtually tamper-proof.

This was a very basic overview of blockchains. We’ve barely scratched the surface. In my next few articles I will be providing more in-depth coverage on subjects such as concensus algorithms, blockchain node types, the relationship between blockchains and cryptocurrencies, and how the blockchain can be used by businesses to streamline processes and reduce processing costs.

<p>The post What is a blockchain? first appeared on The Clever Shark.</p>

At this point I can only shake my head a little. The whole thing has gone from being silly and aggravating to suddenly making no fucking sense at all.

Here’s what Paypal had to say about the whole thing:

“Due to data protection reasons we are unable to give you the specific reason as to why a payment has been investigated.”

“I am sorry to tell you that the transaction you mentioned had been reversed for risk concern. If you still want the item, you can resend payment to this seller.”

Seriously, why anyone would trust their money to Paypal is beyond me.

<p>The post The continuing crisis… first appeared on The Clever Shark.</p>

This is bloody ridiculous. At first they wanted a proof of address, and I provided one. Not good enough. Today I actually talk to a human being (whom, it turns out, is about as useless as the rest of the resolution process, sorry to say). He wants me to upload a photo ID. I do so. I hear nothing for a while.

And now Paypal is telling me that my computer may have a virus and they want to see proof of an antivirus scan being run. Never mind that I have MSE scan every night. And frankly this is starting to sound funnily like those scams where someone calls you up from India claiming to work for “Windows” and telling you that your computer is “broadcasting error messages”. This does not fill me with confidence coming from a company that already has my credit card information. So I’m running a full scan with MBAM (Malwarebytes Anti-Malware, the top offering out there AFAIK). And yet I would gladly bet a sizeable amount that Paypal will simply then change their tune again (as they have at every step so far) and demand yet something else.

It’s in-fucking-sane. Oh, and also now I must change my password and security questions. As I have been requested to do (and have done) two days ago and again yesterday. They claim that someone has had unauthorized access to my account but all purchases charged have very much been made by myself. They have essentially invented a problem where before there was none. I really cannot fathom why they persist in this.

I’m sure there will be more to this story…

<p>The post The continuing Paypal saga first appeared on The Clever Shark.</p>

Paypal is lying. Paypal is not telling the truth. Paypal is dishonest.

I have to agree to cancel those two transactions. But when I do I explain to the seller what’s happened, I tell them that Paypal is lying to them, but that since (in the case of at least one merchant) they offer no alternative way to pay, then I must agree to cancel because I have no idea when those idiots are gonna be done creating the completely unjustified mess they’ve made, let alone clean it up.

Still, what the fuck? Did an ex of mine get hired by Paypal or something?

<p>The post Paypal lies to its merchants! first appeared on The Clever Shark.</p>

So apologies to the following: Nicole Leibman, Discount Golf, irina cristobal, Rare Posters Dba Art Wise and AwesomeTreats. Paypal has decided to hijack the money in mid-payment. That’s what you get for making the mistake of trusting them.

<p>The post A note to everyone at Paypal first appeared on The Clever Shark.</p>