Post B4sOYf7FUIUwPAD35c by coolbean@brain.worm.pink
(DIR) More posts by coolbean@brain.worm.pink
(DIR) Post #B4sLtwFyec5tmikJH6 by rose@snac.pinkro.se
3 likes, 1 repeats
we need to educate the masses on the beauty of CGI websites and that not everything has to be PHP
(DIR) Post #B4sLv2d2Rswfpw3gf2 by fiore@brain.worm.pink
0 likes, 0 repeats
@rose fym cgi
(DIR) Post #B4sMGb7NPh2asuWmQq by rose@snac.pinkro.se
1 likes, 0 repeats
https://en.wikipedia.org/wiki/Common_Gateway_Interfacethey just let you execute random shit on http requests!https://fortunes.pinkro.se just executes fortune! its banger!!
(DIR) Post #B4sMH7FzvAx0Yuo7JQ by coolbean@brain.worm.pink
1 likes, 0 repeats
@fiore @rose its an uh uh uh https://en.wikipedia.org/wiki/Common_Gateway_Interface its this you can use it to let any program you want serve html and stuff. its the way fossild serves my repos
(DIR) Post #B4sMHS8GJ8EzJ0Ljfc by fiore@brain.worm.pink
0 likes, 0 repeats
@coolbean @rose i see .
(DIR) Post #B4sMIJjf0oeDYLFqoy by coolbean@brain.worm.pink
0 likes, 0 repeats
@rose @fiore it redirected me to 4get whats up with thatalso you host a 4get and i didnt know???
(DIR) Post #B4sMIJueLxRE6QOcwy by fiore@brain.worm.pink
0 likes, 0 repeats
@coolbean @rose same for me , the first time
(DIR) Post #B4sMIc3StvBWMyevBo by coolbean@brain.worm.pink
1 likes, 0 repeats
@rose @fiore ive been looking for a new instance since the bunny one stopped working
(DIR) Post #B4sMTgD5nAUkRURIR6 by rose@snac.pinkro.se
1 likes, 0 repeats
ye typo i meant to link to fortunes.pinkro.sealso yeah i host 4get, i never really advertised it because i dont wanna get rate limited, feel free to use it thoCC: @fiore@brain.worm.pink
(DIR) Post #B4sMXH0NRhpJQdCn4q by fiore@brain.worm.pink
0 likes, 0 repeats
@rose @coolbean hell yea
(DIR) Post #B4sMv6mJ7Ym2ezzQLQ by coolbean@brain.worm.pink
2 likes, 0 repeats
@rose @fiore fun fact: on openbsd cgi serving applications need to be statically compiled and placed in /var/www/bin because httpd is isolated to var/www
(DIR) Post #B4sMxfl42NFpjBdAyu by fiore@brain.worm.pink
1 likes, 0 repeats
@coolbean @rose btw guys im in munich ^^
(DIR) Post #B4sN2GlGOzkveKurMO by coolbean@brain.worm.pink
1 likes, 0 repeats
@fiore @rose yoooooo thats awesome
(DIR) Post #B4sN50RdWV4Duh2aMy by coolbean@brain.worm.pink
0 likes, 0 repeats
@fiore @rose already like halfway here already crossed the alps incredible what a powerhouse
(DIR) Post #B4sN50e2mMzYXAqUi0 by fiore@brain.worm.pink
0 likes, 0 repeats
@coolbean @rose this nightjet has been hellish
(DIR) Post #B4sN8oyQ7BWBUiC6Ea by coolbean@brain.worm.pink
1 likes, 0 repeats
@fiore @rose aw, not comfy?
(DIR) Post #B4sNA8BgADFjNI1Ke8 by fiore@brain.worm.pink
0 likes, 0 repeats
@coolbean @rose table seat ..
(DIR) Post #B4sNANkGJupRctJf8K by rose@snac.pinkro.se
2 likes, 0 repeats
common openbsd WCC: @fiore@brain.worm.pink
(DIR) Post #B4sNCID3s7yl2NhKPA by fiore@brain.worm.pink
0 likes, 0 repeats
@rose @coolbean rose why are you not a puffycel yet
(DIR) Post #B4sNFlO9qFbWP3Xj3A by coolbean@brain.worm.pink
1 likes, 0 repeats
@fiore @rose oh come on rose probably uses libressl on her gentoo desktop thats like halfway there
(DIR) Post #B4sNS1RHzZgheqqxRg by coolbean@brain.worm.pink
1 likes, 0 repeats
@fiore @rose i get wanting to fencesit on this matter openbsd lowk kinda sucks (performance is... not great and neither is battery life. i still love it but openbsd software is really best experienced on a different kernel lmao)
(DIR) Post #B4sNVn7t9JCwQRZlh2 by emneo@fosstodon.org
0 likes, 0 repeats
@rose CGI with C <3
(DIR) Post #B4sNVnMmFx7LAcXets by rose@snac.pinkro.se
0 likes, 0 repeats
thats what im saying!!and doing!!!! https://pinkro.se is a C program!!!
(DIR) Post #B4sNVnbfMb1junVY6i by snacks@netzsphaere.xyz
0 likes, 0 repeats
@rose @emneo i need to make a website so there's more than one working page in your webring
(DIR) Post #B4sNgeQxo7LoeUg0MS by rose@snac.pinkro.se
1 likes, 0 repeats
oh my god i didnt even notice that lmaoCC: @emneo@fosstodon.org
(DIR) Post #B4sO3hW0W7TKrx1i7M by rose@snac.pinkro.se
0 likes, 0 repeats
actually i dont because libressl doesnt always workim not puffycel and i will never be a puffycel because i like gentoo much much more and id use gentoo bsd if that ever were to exist againor gentoo hurd if that gets stable quickly enoughCC: @fiore@brain.worm.pink
(DIR) Post #B4sO3hgdsZylOw0Ch6 by fiore@brain.worm.pink
0 likes, 0 repeats
@rose @coolbean rose .. can i just delete the last line …..
(DIR) Post #B4sO5S8iecbrlHy9S4 by coolbean@brain.worm.pink
1 likes, 0 repeats
@rose @fiore i honestly forgot gentoo bsd existed but honestly yea thatd go hard as fuck lmaoreally my main thing with openbsd is just that networking tooling is really well designed and it handles wpa authentication properly unlike literally every other open source operating system which all rely on FUCKING WPA SUPPLICANT I HATE THAT FUCKING PIECE OF SHIT SOFTWARE OH MY GOD
(DIR) Post #B4sO6MKLkZBg1ZqEM4 by coolbean@brain.worm.pink
2 likes, 0 repeats
@rose @fiore i dont believe in gentoo hurd though. i dont want the gnu kernel. you know why we all know why l4 was right there and has been for decades write drivers for that the gnu project is a dump
(DIR) Post #B4sOYf7FUIUwPAD35c by coolbean@brain.worm.pink
2 likes, 0 repeats
@fiore @rose i wanna make an sel4 distro someday. thatd be the dream. just gotta get s6-rc to run and figure out how the fuck you make a multi user operating system and uh... i dont know how to make a unix would you believe thati will say im unsure about execline. ska makes some ok points in its favor but its just a pain to write scripts with it and id rather use a minimalist scheme implementation or smth
(DIR) Post #B4sP4VS4xC4nhP8YcK by rose@snac.pinkro.se
3 likes, 0 repeats
oh i've dealt with sel4 on embedded one timeits pretty cool, but i cant imagine it being used on a desktop systemCC: @coolbean@brain.worm.pink @fiore@brain.worm.pink
(DIR) Post #B4sP4VkrpL6adfvYu0 by coolbean@brain.worm.pink
1 likes, 0 repeats
@rose @fiore thats definitely the challenge lol. the drivers are straight up not present
(DIR) Post #B4sP4VvVBnc1Aeu3Tk by coolbean@brain.worm.pink
2 likes, 0 repeats
@rose @fiore but i want a microkernel and i dont want hurd
(DIR) Post #B4sP88YvzwFdrp4i2a by snacks@netzsphaere.xyz
0 likes, 0 repeats
@coolbean @fiore @rose maybe make it compatible with rump drivers?
(DIR) Post #B4sPHQHpTAolRZVBLc by rose@snac.pinkro.se
1 likes, 0 repeats
sure you can edit the post laterCC: @coolbean@brain.worm.pink
(DIR) Post #B4sPHmvzGY0pgUSYzo by coolbean@brain.worm.pink
1 likes, 0 repeats
@rose @fiore god i wish i was at roses house too thatd be a fun day
(DIR) Post #B4sPJsqqEn8kcB3I1Y by snacks@netzsphaere.xyz
0 likes, 0 repeats
@coolbean @fiore @rose i haven't looked into their apis but that doesn't seem unreasonable
(DIR) Post #B4sPJzIMHOiSbFyLkO by coolbean@brain.worm.pink
1 likes, 0 repeats
@fiore @rose also l4 is just a fucking awesome name for a kernel tbh
(DIR) Post #B4sPNFERU1bmtbh4gi by fiore@brain.worm.pink
0 likes, 0 repeats
@coolbean @rose not even gnu wants hurd
(DIR) Post #B4sPbvGhzO7xK9kjYm by coolbean@brain.worm.pink
1 likes, 0 repeats
@fiore @rose they were actually looking into porting hurd to l4 (instead of gnu mach) in the mid 2000s but then someone suggested the coyotos kernel instead and they looked into that but decided against it by which time l4 progress had stalledits a shame because honestly architecturally hurd is interesting actually i just dont like the gnu project
(DIR) Post #B4sQeNTICaXxKMNCxU by tisanae@brain.worm.pink
1 likes, 0 repeats
@coolbean @rose @fiore i wish i knew, openbsd doenst have drivers for any of the 6 wifi card i have :nynPensive:
(DIR) Post #B4sQeeB85N7R8x0RVY by coolbean@brain.worm.pink
1 likes, 0 repeats
@tisanae @fiore @rose LMFAOthats fucking dire
(DIR) Post #B4sQezeGGFtpjNnVKa by coolbean@brain.worm.pink
1 likes, 0 repeats
@tisanae @fiore @rose my x270 has working wifi
(DIR) Post #B4sQi6BCR0KWr8gWKO by fiore@brain.worm.pink
0 likes, 0 repeats
@coolbean @rose @tisanae guys is theo a weirdo chud or is he cool whats the verdict
(DIR) Post #B4sR0Gkvqnxis23xLs by tisanae@brain.worm.pink
1 likes, 0 repeats
@fiore @coolbean @rose i have a neutral stance on the matter :chaosSmoke:
(DIR) Post #B4sR0UeMC31Nxh5u2y by coolbean@brain.worm.pink
1 likes, 0 repeats
@fiore @rose @tisanae hes a cool chud
(DIR) Post #B4sRuFeD9tzfeKc6Gu by coolbean@brain.worm.pink
1 likes, 0 repeats
@fiore @rose @tisanae like the "lives in the sewers of new york" kind
(DIR) Post #B4sRux6Nb34kQ97heC by fiore@brain.worm.pink
0 likes, 0 repeats
@coolbean @rose @tisanae isnt he european
(DIR) Post #B4sT6wLuJE0lWcfNBY by rose@snac.pinkro.se
1 likes, 0 repeats
i have no idea who that isCC: @coolbean@brain.worm.pink @tisanae@brain.worm.pink
(DIR) Post #B4sT7HpOSn4k89ciYq by phnt@fluffytail.org
1 likes, 0 repeats
@rose @fiore @coolbean @tisanae OpenBSD bdfl, Theo De Raadt.
(DIR) Post #B4sT9wZTx3O74aRqAS by fiore@brain.worm.pink
0 likes, 0 repeats
@rose @coolbean @tisanae nerd extraordinaire , beans husband
(DIR) Post #B4sTQHDWxSjfjqy75k by coolbean@brain.worm.pink
1 likes, 0 repeats
@fiore @rose @tisanae no hes canadian, im saving my green card for someone that really needs it
(DIR) Post #B4sTVDgrUy1AFR2rIG by fiore@brain.worm.pink
0 likes, 0 repeats
@rose @coolbean @tisanae also the mind behind this masterpiece
(DIR) Post #B4sTfP4Q2in4RDv57I by coolbean@brain.worm.pink
1 likes, 0 repeats
@fiore @rose @tisanae hes my favorite chud he crawls up your sewer pipes, grabs you by the dick and drags you down into the sewers
(DIR) Post #B4sTjqa9hEZovHsoGO by fiore@brain.worm.pink
0 likes, 0 repeats
@coolbean @rose @tisanae linus aint got shit on him honestly . hes a chudlet compared to theo
(DIR) Post #B4sToD16E8Yhf2Z8kK by coolbean@brain.worm.pink
1 likes, 0 repeats
@fiore @rose @tisanae CHUDMOGGED
(DIR) Post #B4sU5ugV7mUi17NC52 by aeweyrose@dyke.solutions
2 likes, 1 repeats
@fiore @coolbean @tisanae @rose adjhttps://man.9front.org/1/fortune NAME fortune, theo, troll - sample lines from a file SYNOPSIS fortune [ file ] theo troll DESCRIPTION Fortune prints a one-line aphorism chosen at random. If a file is specified, the saying is taken from that file; oth- erwise it is selected from /sys/games/lib/fortunes. Troll is more specific than fortune; it specializes in inflammatory rhetoric. Theo is more specific than troll; it presents insults from OpenBSD founder Theo de Raadt.(and https://man.9front.org/1/nietzsche)
(DIR) Post #B4sVPCQ7VW4SToTHH6 by snacks@netzsphaere.xyz
1 likes, 0 repeats
@coolbean @fiore @rose genode already does this
(DIR) Post #B4sVPly1LSz6j5bLTU by coolbean@brain.worm.pink
2 likes, 0 repeats
@aeweyrose @fiore @tisanae @rose the fact theo and troll arent in the openbsd games set is legitimately infuriating. WE EARNED THIS GIVE IT TO ME
(DIR) Post #B4sVqBlw1caWHwXp32 by coolbean@brain.worm.pink
1 likes, 0 repeats
@aeweyrose @fiore @rose @tisanae at least we have fortune -o
(DIR) Post #B4sjaE8SrwtWLLMjFg by lunareclipse@snug.moe
0 likes, 0 repeats
@rose CGI sounds like it would be very easy to accidentally have RCE vulnerabilities with.Low-key want to try making something with it though.
(DIR) Post #B4sjaEP7s0DpB1A2Do by SRAZKVT@tech.lgbt
0 likes, 0 repeats
@lunareclipse @rose whether your webserver sends data to a launched program, or another daemon via a socket, or is embedded in your handler, nothing changescgi doesn't add custom code based on request, it just runs predetermined commands, which you should have written properly, and should have sanitised data properly
(DIR) Post #B4sjaEbt6YQjob8E76 by lunareclipse@snug.moe
0 likes, 0 repeats
@SRAZKVT @rose saying skill issue to people constantly misusing a system is a lot of the time a sign of a badly designed system
(DIR) Post #B4sjaEoeL6deSB6Q0O by SRAZKVT@tech.lgbt
0 likes, 0 repeats
@lunareclipse @rose right, let's overcomplicate the system uselessly so it's not possible to abuse it by writing a handler in fucking shell, great idea
(DIR) Post #B4sjaEzHhZ94zA4ua8 by SRAZKVT@tech.lgbt
0 likes, 0 repeats
@lunareclipse @rose we shouldn't restrict a system's ability to be extended simply because someone might use it wrong
(DIR) Post #B4sjaFAz04VFZRYFoe by Misofist@girlcock.club
0 likes, 0 repeats
@SRAZKVT @lunareclipse @rose I don't see anyone advocating for restricting people's ability to use CGI.Just saying that using a lower-level system might come with increased risks of footguns for people who don't completely know what they're doing.
(DIR) Post #B4sjaFLyLDIG7Wh1we by SRAZKVT@tech.lgbt
0 likes, 0 repeats
@Misofist @lunareclipse @rose i see "when a request comes in, this program gets started with these environment variables, and instantly start handling stuff" to be significantly more high level andeasier to work with than the fcgi "i need to daemonise, open a socket, and wait for events http server sends me, parsing them, then doing stuff".cgi, fcgi, embedded htp server, are all ways of handling requests, one system allowing insecure usage doesn't make it "badly designed" as luna put it
(DIR) Post #B4sjaFWbhfngeVfWWO by lunareclipse@snug.moe
0 likes, 0 repeats
@SRAZKVT @Misofist @rose my point is largely that using a framework/language where you're not at risk of accidentally eval'ing or running something unintended unless you deliberately run eval or idk don't use your SQL libraries' substitution feature, makes it much harder to fuck up in critical waysWith CGI as I understand it you have to think about:- what exactly are your web server settings, what will be allowed to be executed- path traversal issues- advanced sysadmin knowledge to mitigate the above (chroots, restricting permissions, namespacing, etc)- ensuring you don't accidentally put some file that shouldn't be there in the web server root directory- parsing/escaping whatever inputs you get correctly With more abstracted systems you will not have to worry about a lot of those things, just handling things correctly in your code, which can be reasonably simple when you use things like say Pydantic to validate the structure and contents of the received data
(DIR) Post #B4sjaFlUoJi5OgdPjE by navi@social.vlhl.dev
0 likes, 0 repeats
@lunareclipse @SRAZKVT @Misofist @rose all of those points are *still* a concern with PHP or any other method that parses input, i don't understand why cgi is being specialcased here?it's just, a thing you have to worry about if you're handling untrusted input in a webserver at all, and sure you can have a library that checks most if not all of those things for you... but said library could also just be made to work with cgi executables just the same(note that cgi doesn't have to be shell scripts, it can be anything that is executable)
(DIR) Post #B4sjaFxY5VLq04H2W0 by lanodan@queer.hacktivis.me
0 likes, 0 repeats
@navi @Misofist @rose @lunareclipse @SRAZKVT In fact most vulns Pleroma/Akkoma got were path traversal and related, and Elixir+Phoenix is pretty web focused.Kind of thing I'd worry more about CGI is ressource exhaustion, specially given how full of LLM-scrappers the web is. But it's not something where CGI is necessarily worse than say a resident webapp.
(DIR) Post #B4sklUdLyANaeQkWzA by SRAZKVT@tech.lgbt
0 likes, 0 repeats
@lanodan @Misofist @rose @lunareclipse @navi i think it's silly posix doesn't have a path normalisation function that doesn't also check if the path exists (at least last i checked you need to write it yourself)
(DIR) Post #B4sklUnHNGJr9DOSSO by lanodan@queer.hacktivis.me
0 likes, 0 repeats
@SRAZKVT @Misofist @rose @lunareclipse @navi I think it makes sense for the two to be separated, specially as "check if path exist" has to be something where you get a file descriptor to avoid TOCTOU issues afterwards.And reminds me that what I'd more want in modern languages is types for a path query (stuff like ../ goes there, maybe also globbing), a path (relative or absolute), and a filename.
(DIR) Post #B4smuisWZqSjLRNHPM by navi@social.vlhl.dev
1 likes, 0 repeats
@lanodan @rose @SRAZKVT i wish posix would add RESOLVE_IN_ROOT and RESOLVE_BENEATH (from linux's openat2) as flags to openat (i honestly i have no idea why linux *didn't* make them O_* flags and instead gave it an extra field in a new syscall)those would make so useful for a bunch of things, one of them making `../` path traversal impossible
(DIR) Post #B4sn5JFEDuPJ1p2fs8 by SRAZKVT@tech.lgbt
1 likes, 0 repeats
@navi @lanodan @rose ../ traversal should be explicitly requested but that boat is now long gone so there's no fixing that unless you throw away everything and redesign everything
(DIR) Post #B4snOQ25D4zxaD0POy by lanodan@queer.hacktivis.me
0 likes, 0 repeats
@navi @rose @SRAZKVT Interestingly I feel like I've seen that one before in a POSIX meeting (so in the last 12+ months) but might be misremembering as I can't find it in the bugtracker.Might be worth it to look at what other implementations have, maybe they did it with an O_* flag which would likely be easier to standardize.
(DIR) Post #B4vVlwEuPrsiQkwxDU by lunareclipse@snug.moe
0 likes, 0 repeats
@SRAZKVT @Misofist @rose CGI is simple, that is cool and simple systems often have great educational valueInternet is extremely complex nowadays so sometimes it's worth it to use more complex tools to offload handling the complex problems
(DIR) Post #B4vVlwdivbjNfiYltY by SRAZKVT@tech.lgbt
0 likes, 0 repeats
@lunareclipse @Misofist @rose here's a secret: you build the framework and abstractions on top of cgi, or fcgi, or embedded http serverall php frameworks run on top of fcgi, cgit and bugzilla are both on cgi, and have their own extra abstractions, though bugzilla also has the perl cgi module in betweencgi itself is just a way to dispatch request information
(DIR) Post #B4vVlwo0JNxEBbMyv2 by natty@astolfo.social
0 likes, 0 repeats
@SRAZKVT@tech.lgbt @lunareclipse@snug.moe @Misofist@girlcock.club @rose@snac.pinkro.se That's like saying JavaScript frameworks run on NGINX :neofox_woozy:
(DIR) Post #B4vWhiSDpMtOTKjAH2 by SRAZKVT@tech.lgbt
0 likes, 0 repeats
@natty @Misofist @rose @lunareclipse uhyes ? that's the goal, using a well known and well tested and generic server, like apache, or lighttpd, or tipidee, or tittypee, or, any other ? whichever fits your needs ?that's the goal, cgi is a common interface for writing gateways (hence the name CGI)
(DIR) Post #B4vWhiuE9FIHsBpWvQ by navi@social.vlhl.dev
0 likes, 0 repeats
@SRAZKVT @natty @Misofist @rose @lunareclipse "javascript has frameworks that work via http" is valid to say"$language has $framework that works via the cgi" same thing
(DIR) Post #B4vWhjF8tU1Yv3cEWe by natty@astolfo.social
0 likes, 0 repeats
@navi@social.vlhl.dev @SRAZKVT@tech.lgbt @Misofist@girlcock.club @rose@snac.pinkro.se @lunareclipse@snug.moe but they are in no way an abstraction over CGI
(DIR) Post #B4vWhlOmsavZbY8xpw by SRAZKVT@tech.lgbt
0 likes, 0 repeats
@natty @Misofist @rose @lunareclipse i don't know why you're acting like that's a bad thing
(DIR) Post #B4vXn2cUNbDsPtdIm0 by navi@social.vlhl.dev
0 likes, 0 repeats
@natty @Misofist @rose @lunareclipse @SRAZKVT what?cgi works by giving the process environment variables, inputting data on stdin, and reading the response from stdoutthere's a few cgi libraries that basically just do http/html stuff and print it, so, i don't understand your statement
(DIR) Post #B4vXn2qJYCHX6m6LK4 by natty@astolfo.social
0 likes, 0 repeats
@navi@social.vlhl.dev @Misofist@girlcock.club @rose@snac.pinkro.se @lunareclipse@snug.moe @SRAZKVT@tech.lgbt ExactlyMy code should (and will) run the same regardless of being used via WSGI, FastCGI, or executed as a script directly. Web developers haven't been expected to write against a specific service gateway for the last roughly 20 years. Be it tiny personal sites or megacorps
(DIR) Post #B4vZKskPgsC5bB2X56 by navi@social.vlhl.dev
0 likes, 0 repeats
@natty @rose @SRAZKVT if the thing can be executed as a script, then nothing stops it from also handling cgithere's no issue here inherently to cgi, except that people that like cgi are usually the people that don't like over reaching frameworks
(DIR) Post #B4vZKt1meI5YT3AP9k by natty@astolfo.social
0 likes, 0 repeats
@navi@social.vlhl.dev @rose@snac.pinkro.se @SRAZKVT@tech.lgbt I wouldn't call the principle of least privilege overreaching