Samuel Levy

Samuel Levy

@imsamlevy.bsky.social

PHP, Laravel, Livewire, Tailwind, and Opinions!

78 followers32 following83 posts

View full thread
View full thread

Samuel Levy reposted

Quick poll for a security friend. If you are a dev: Do you know what threat modeling is? Do you do it? Why or why not? If so what does that look like for you?

Samuel Levy reposted

1. LLM-generated code tries to run code from online software packages. Which is normal but 2. The packages don’t exist. Which would normally cause an error but 3. Nefarious people have made malware under the package names that LLMs make up most often. So 4. Now the LLM code points to malware.

David D. Levine@daviddlevine.com

LLMs hallucinating nonexistent software packages with plausible names leads to a new malware vulnerability: "slopsquatting."

Samuel Levy reposted

CFP for this year's event, held in Brisbane on November 13-14, is now open! Talks are 30min, and we welcome speakers from home and abroad presenting on Laravel and the wider ecosystem. Submit as many times as you'd like! Successful speakers will be contacted by May 30th

I'm pretty sure that they call the second one "pairing", and yeah. It's a totally legitimate way to not have to do a formal PR review afterwards. Outside of any automated CI checks, PR reviews are mostly just a form of asynchronous pairing with more passive aggressive nit-picking.

There are two acceptable PR review processes: 1. we went through all the checks, thorough review, and approval processes 2. there were a couple smart people in the room and we said "fuck it"

+++ style="margin-left: 40px" --- style="margin-left: 40px" +++ style="margin-left: 60px" --- style="margin-left: 60px" +++ style="margin-left: 50px" --- style="margin-left: 50px" +++ style="margin-left: 53px" ... 4 deployments just to micro-adjust an image on YOUR screen.

Fun fact: bcrypt does NOT only hash the first 72 chars of a password. It TRUNCATES the input to a maximum of 72 bytes. Which could mean as few as 18 characters, depending on the character encoding. The actual spec says to truncate to 56 bytes, but none of the implementations do that.

Stephen Rees-Carter@valorin.bsky.social

Password length limits are often a sign of a legacy backend or insecure hashing, but did you know bcrypt only hashes the first 72 chars? It raises the question, should we be limiting password lengths when using bcrypt? 🤔

Samuel Levy reposted

I could use your help gathering some data for my upcoming Laracon EU talk. If you ever had a slow Laravel application/slow request/slow command/etc. - what was the reason for it? Would be great to get as many replies as possible. Please share for reach 🙂

You are up to date.