Before LLMs, the prospect of an undiscovered vulnerability was non-zero probability then, so what exactly has changed now?

The problem is not the prospect of an undiscovered vulnerability (there is always a vulnerability somewhere) but rather the prospect of a reduced response window.

There's a wide gap of difference between "non-zero probability" (0.0076%) and "non-zero probability" (82.01734%).

So a multipart form "zip bomb"? Sounds like the kind of thing that would do... well, that. But also, by that point you don't even need a WAF to block it, IIRC multipart forms can be disabled or their memory limit clamped on php.ini.

(Not that I'd rely on that; not everyone has access to php.ini. But then again, we are talking about a world where there are more than one (1) ways of dealing with problems)

Yes the vulns are real. No that does not mean a system with the vuln is automatically and noticeably exploitable: that assumes there are no other defense systems or simply other happenstance logical walls around (firewalls, datacenter range blocks, seven proxies, 28 NATs, Anubis, whathaveyou).

My understanding is that CVEs are ranked not by Real World conditions but rather under an "idealized threat condition" that imagines your machine is essentially connected with a straight wire to the root DNS serves of the internet, given a public IPv4 address, and the off switch is dislodged or somehow made unavailable.

Remember, Israel is USA’s 51st state,

My understanding is it's the reverse, USA is a vassal Israel state.

Hey, never said I was laughing out of happiness... 😭

laughs in keeping an old archive site still in PHP5

Principle of Least Responsibility?

So much wasted space comes from the round "branding"... Just because everyone else is doing something wrong does not mean you have to do it wrong too!

Governments already have the data. In a certain way you already trusted them by getting your passport

Bold way of saying I "trust". I never chose to be born in a given country, they have not obtained an informed, actionable consent on my end for that association, nor have I agreeded to have my activities bound by specifically their imagined permits regarding where this or that land ends. And once again: this does not solve for those who have their own State as one of their primary aggressors.

And now, Windows Defender available for Linux!

your smartphone is checking

No, no and no. I'm using lemmy on a desktop computer because typing on a phone is a PITA. Requiring a phone, or any other physical second factor authentication, is additionally antithetical to the "let's use less resources" point of the fediverse.

governments provide the lists

No, no and no. We already don't trust corporations, why would we trust governments? Who among here is free of sin to cast the first stone? The US? (And woe betide having to authenticate with your own government that is already repressing you)

your smartphone only sends

No no and no. No need for smartphone.

What the hell is all this crap? Who are you really working for? Make your disclosures.

Multiple identities is a completely orthogonal problem to bots and trolls. Your lack of understanding of the privacy and security concerns in this is rather troubling if you also furthermore go around saying that you are making an implementation. Is this vibecoded? Have you mathematically proven that the ID information can not be possibly reversed? Can the user selfhost the authentication backend or is the instance in control of it? (or worse, a third-party)