This is such a strange claim from someone trying to sound knowledgable in the field of cyber security (maybe they are, I have no idea who this person is). Even if the exploit would be difficult to use properly, it's not like there's a lack of groups out there trying.
Anyone serious about this would consider the fact that a working PoC was reported to the PHP security team. They confirmed the vulnerability and started making a lot of noise about the severity of it, by reporting 2 CVEs and pushing the patch to Linux distros ahead of the official patch release.
Trying to understand what the message of the post is all about, I flipped the whole thing around in my head - and the message is basically "you don't need to upgrade your servers". Which is something someone with a working exploit would say. Or it's just noise on the Internet.
That's clearly not the message, the author writes at the top:
> You should patch your servers anyway. There is a real vulnerability here, but exploiting it is significantly harder than people are making it out to be.
The take-home message is about human herding behavior being reinforced by LLM use:
> There's something important to be said here about how many people have Claude/GPT make design decisions for them, and how AI is the primary decision maker in the world right now. You've got this bizarre case of "Decision Schelling Points" where a method of solving a problem is extremely overrepresented, because it's what Claude does out of the box.
And when the prevailing wisdom loaded into Claude is making people do dumb shit, then you write a blog post complaining about it.
---
Having Claude re-inforce to people the severity - who do not have the security background to make a call - is a feature of herd behavior.
The risk is all that mattered.
The risk, unless the original reports have been lies, is very real.
Posting this AI complaint-blog because with hours of hindsight nobody released a seflreplicating variant, is the wrong lesson at the wrong time for the wrong reasons.
I guarantee you there well be a better time to post this complaint about AI-driven herd behavior. But it was not today about this.
fabiensanglard - thanks for all the wonderful posts about.. everything! While I started reading your blog when it was more focused on old games and C development, I still check it from time to time. I'm always blown away by the level of details you manage to dig up and present - no matter the subject.
From what I've seen it _seems_ the language's creator is not interested in corporate sponsorship. It's been some time since I was interested in Nim, so I don't have any direct references to this claim. A web search would probably provide several examples. It was one of the main reasons why I decided to focus on other languages.
I feel the same way - as I suspect a lot of people here do. Nim posts are always upvoted and usually people say nice things about the language in the comments.. but there are few who claim to actually -use- the language for more than a small private project, if even that.
The only way to really test out a programming language is by trying it out or reading how someone else approached a problem that you're interested in/know about.
There are over 2200 nimble packages now. Maybe not an eye-popping number, but there's still a good chance that somewhere in the json at https://github.com/nim-lang/packages you will find something interesting. There is also RosettaCode.org which has a lot of Nim example code.
This, of course, does not speak to the main point of this subthread about the founder but just to some "side ideas".
Thanks for all the work done over the years! I've donated to the project many times and it always feels good to support something I enjoy using every day.
> ...but it does look like Mozilla's product management has maintained its laser-like aim at its own feet.
Sadly, this feels very true. I used to donate money to Firefox back in the day, but since Mozilla seems to focus on anything but making Firefox a good -browser- - those days feel very distant.
I think Nim has a good homepage, with some bullet points explaining what the language is all about coupled with several code examples. I'm not saying Nim is better, but I visited the page the other day and thought it was neat.
I remember the first time I visited the DLang website. I clicked “What is D used for?” [0] and scrolled to the very first section, “1. Industry.” The opening example was “1. Games,” so naturally I went to read more…and found the first link, “AAA game,” was dead. It led straight to an error page on Xbox.
That was years ago. After reading your comment, I decided to check again. The same “AAA game” link is still first, and it’s still broken.
You can’t really call that “a good presentation of a language” when the very first real-world example links to nowhere—and nobody’s bothered to fix it for years.
I guess you're referring to the official link to quantumbreak.com. No one has probably noticed or pointed it out yet, I do not know where to raise it since I am not a member of the fourm. But the next sentence links to the presentation about the Game (Quantumbreak) and it's integration with Dlang.
You are not wrong, that should be fixed but no information about it is lost, I feel like you're a bit too harsh here.
Yeah, that's exactly the thing I'd hope to see on anything trying to sell me on using a new language. Tell me about what it does, and show me how it does it
The way it handles imports is weird. Default to importing everything from the module without qualification? I know you can choose to qualify everything, but that seems to go against the language's conventions.
Using fully qualified imports is a Python tradition.
Python doesn't have a notion of public/private symbols (no, "__" prefix does absolutely nothing). It also doesn't have a good type system, so it can't have function overloading.
This is why you're required to qualify almost all imports in Python, to avoid name clashes.
Nim doesn't have this problem and also "fixes" a lot of other shortcomings[1] of Python.[2]
It's not only a Python thing. Many modern languages require this as well. Go, Gleam, Rust, etc.
When you're reading Nim code and you see a symbol you don't know, how can you tell where it comes from? In Rust, it's either qualified or you have to explicitly import it. What do you do in Nim?
> Many modern languages require this as well. Go, Gleam, Rust
All the languages you listed do not support function overloading. Qualified imports and namespaces exist to avoid name clashes first, dependency tracking is just a bonus (and a chore).
Nim's import rules are part of its generalization of OOP's obj.foo()
syntax. That is, in Nim, you don't have to put "foo" in a specific
class, just set the first parameter of "foo" to the type of "obj",
and this only works if you don't have to qualify "foo" (similarly to OOP
languages...)
I don't see how Nim's import is necessary for that to happen. You can allow the user to specify items to import without the qualifier (like Python's `from lib import foo`), and the universal function call syntax would work, too.
That is allowed, with the exact same syntax as Python. But then you still lose the qualification so I don't see any benefits, it's just more boilerplate to constantly adjust, git conflicts to fight with, etc.
Trying to understand what the message of the post is all about, I flipped the whole thing around in my head - and the message is basically "you don't need to upgrade your servers". Which is something someone with a working exploit would say. Or it's just noise on the Internet.
reply