@valorin@phpc.social
@valorin@phpc.social avatar

valorin

@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.๐Ÿ•ต๏ธ
I hack stuff on stage for fun. ๐Ÿ˜ˆ
I used to be found at: https://infosec.exchange/@valorin
#searchable

This profile is from a federated server and may be incomplete. Browse more on the original instance.

valorin, to Laravel
@valorin@phpc.social avatar

It's incredibly common to find hardcoded domains used for identifying admins, however this also makes it trivial to escalate privileges to admin! ๐Ÿ˜ˆ

https://securinglaravel.com/security-tip-privilege-escalation-through-domain-wildcards/

valorin, to random
@valorin@phpc.social avatar

Fair warning my Laravel & security friends:

Now that The Rings of Power promo is starting back up, I'll probably start talking about that on here too because I loved S1, and am very excited for S2. (I'll avoid spoilers though.)

If you'd just like to follow just my Laravel and Security work, I'd suggest signing up for my weekly security tips on http://securinglaravel.com. ๐Ÿ™‚

valorin,
@valorin@phpc.social avatar

@derickr
No dates yet, but the teaser trailer is due out in ~14 hours: https://www.amazon.com/salp/theringsofpowerseason2firstlook

valorin,
@valorin@phpc.social avatar

@ramsey @derickr

Nope! ๐Ÿ˜

They are in a 2 year cadence for the seasons, it seems, and Amazon seems to do an all-or-nothing approach to promotion.

I'm pretty sure it's been renewed for S3 already, and possibly even further.

valorin,
@valorin@phpc.social avatar

@derickr @ramsey
I think it was always the plan. The Wheel of Time is also following a 2 year release cycle, alternating with Rings of Power.

valorin,
@valorin@phpc.social avatar

@ramsey @derickr
Oh I agree, they really should've offered the rights for the Silmarillion. Especially now that WB wants to milk their film rights for as much money as possible.

I take comfort in the fact that the Estate are involved in ROP and ROP can ask the Estate for (and have been given) permission to use specific elements from the Silmarillion.

valorin,
@valorin@phpc.social avatar

@ramsey @derickr
There is a short mention in https://www.tolkiensociety.org/blog/2022/08/does-it-matter-what-tolkien-would-have-thought-of-the-rings-of-power/

In short, the Tolkien Estate put the TV rights up for sale and Amazon won, and Simon Tolkien (JRR's grandson) is a consultant on the show. I also believe the Estate provided Elvish translators and other resources.

I don't know if Amazon got the rights before or after the show runners pitched their idea though.

I don't think the Estate have any control over the film rights, but I could be wrong on that one.

valorin, to Laravel
@valorin@phpc.social avatar

Securing Laravel has now officially moved to Ghost from Substack! ๐ŸŽ‰

I'll be sending out the first Security Tip written on Ghost later today, but first, it's time for a migration discount!

For the next 2 weeks, you can get 25% off a new Securing Laravel subscription! ๐ŸŽ‚

https://securinglaravel.com/ghost-migration-discount/

valorin, to random
@valorin@phpc.social avatar

It's finally happening: Securing Laravel is moving off Substack onto Ghost this week! ๐ŸŽ‰

Just asked Substack to disconnect my Stripe account, and once that's done I can connect Ghost and get them to import subscribers.

Still some content to fix up, but billing is the big one!

valorin,
@valorin@phpc.social avatar

The migration from Substack to Ghost has started!

Annoyingly, Substack had to disconnect Stripe, so until everything is in Ghost, everyone will appear as a "free subscriber"... ๐Ÿ˜’

It should be resolved in 24-48 hours. ๐Ÿคž

valorin,
@valorin@phpc.social avatar

Subscriptions have been imported, and apart from some small issues (no Group subscription support), it looks good so far! ๐Ÿคž

I'm just waiting on the OK to switch over the domain! ๐Ÿค“

Annoyingly the Ghost API doesn't want to return all of my posts, so I'll need to do a lot of manual edits... but we're getting closer!

You can check it out at the temporary URL: https://securing-laravel.ghost.io/

valorin,
@valorin@phpc.social avatar

@outofcontrol
Yeah, it would have only pulled in active subscribers as part of the migration. So if you disabled everything, you wouldn't be included.

valorin,
@valorin@phpc.social avatar

Switched the domain over to Ghost, and now everything is 404'ing... ๐Ÿ˜ž

This is definitely not going according to plan!

valorin,
@valorin@phpc.social avatar

Ah, found the redirects.yaml file and fixed up the redirects! Everything should load correctly now. ๐Ÿ˜…

I'd love a way to see 404's though, so I can fix up any I've missed. ๐Ÿ˜‰

valorin,
@valorin@phpc.social avatar

For those following along at home, here's where I'm up to with the Securing Laravel move:

โœ…Post content
โœ…Billing
โœ…Domain
โœ…Redirects
โŒPost tags
โŒFootnotes
โŒPost formatting
โŒGroup subs
โŒAPI lexical post content
โŒStripe notifications

Mostly just tedious stuff left...

valorin,
@valorin@phpc.social avatar

The last big thing I need to fix before I can take a break and focus on other things is tags... but apparently Substack's post export doesn't include tags. ๐Ÿ˜ก

I guess I'll be manually restoring 76 tags.

valorin,
@valorin@phpc.social avatar

@outofcontrol
It's too late for an import file, but I did scrape the tag pages to retrieve the list of tagged posts, and then used their API to update the posts.

So now everything is tagged. ๐Ÿ˜

valorin, to random
@valorin@phpc.social avatar

My first full-time dev job was building a domain name registration system, so I'm very good at sniffing out domain scams.๐Ÿง

I received an suspicious looking email yesterday, so let's see how far I can string this along and what their goal is... ๐Ÿ˜ˆ
(I'll keep this thread updated)

image/png

valorin,
@valorin@phpc.social avatar

My belief that this is a scam was justified when this email arrived. (I'll call them SL and ZN.)

ZN wants to use 'securinglaravel', and SL has advised against it, but ZN is just going to ignore SL's advice! ๐Ÿ™ƒ

Clearly my next course of action was to rat out ZN to SL... ๐Ÿ˜‡

Given my intention is to string them along, it might have been a mistake to mention the trademark and put too much pressure on them too early? We shall see how they respond. ๐Ÿค”

image/png

valorin,
@valorin@phpc.social avatar

@outofcontrol

I've received many domain scams, usually renewal scams, but this is the first of this type.

I'm kinda excited to see how far I can push it. ๐Ÿ˜ˆ

valorin,
@valorin@phpc.social avatar

As expected, some form of payment is required to "avoid this conflict"...

Let's see what those prices are! ๐Ÿฟ
Any guesses what sort of prices they'll come back with?

(I've stopped redacting, as it's clearly a scam at this point.)

image/png

valorin,
@valorin@phpc.social avatar

I also decided to poke the bear and respond to ZN. ๐Ÿ˜ˆ

I'm curious to see what sort of fight they are interested in, and the other side of this scam.

valorin,
@valorin@phpc.social avatar

@sysop408

Good question! ๐Ÿค”

The first email from SL came from a different domain to the registry, but I've just noticed the latest is the actual domain. So I think it's a deceptive sales tactic scam rather than a third party scam.

I don't think ZN is real, their email was far too coordinated with SL, timing wise. Plus why reach out to me anyway, to tell me they are going to do it?

I'm curious to see how they respond though.

andrewfeeney, to php
@andrewfeeney@phpc.social avatar

and folks, what do you make of this?

https://youtu.be/kQdRT2odUIk

valorin,
@valorin@phpc.social avatar

@mergy @bobmagicii @andrewfeeney

I'm curious about these manual steps. Is this something the distros can easily patch, or will manual steps be required?

valorin,
@valorin@phpc.social avatar

@bobmagicii @mergy @cabbey @andrewfeeney
Yeah, definitely. But in that case, you're making the choice to do manual upgrades. I'm thinking of folks who have servers they don't closely manage. A simple apt update is much easier than manual steps.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • โ€ข
  • Leos
  • rosin
  • InstantRegret
  • ethstaker
  • DreamBathrooms
  • mdbf
  • magazineikmin
  • thenastyranch
  • Youngstown
  • tacticalgear
  • slotface
  • Durango
  • khanakhh
  • kavyap
  • megavids
  • everett
  • vwfavf
  • normalnudes
  • osvaldo12
  • cubers
  • GTA5RPClips
  • cisconetworking
  • ngwrru68w68
  • anitta
  • provamag3
  • tester
  • modclub
  • JUstTest
  • All magazines