!)

~~~
wolco
CentOS isn't marketed as a desktop distro. The listening default is helpful
and when I switched over to Ubuntu that default of not listening confused me.
Not sure I see the benefit.. it's like installing windows but the internet is
disabled by default and must be configured manually.. installing another
browser and you must configure it manually.

~~~
Dylan16807
Listening on localhost, or a socket, is a reasonable default. Listening to
nothing is annoying, and listening to everything is a terrible idea.

If you're spreading one service across multiple servers, you can spare the few
seconds to open up IPs/ports. The default should keep things moderately secure
on a single host.

------
calibas
Should probably have specified in the title that it's a PHP-FPM bug, had me
worried there.

~~~
dang
Ok, we've added that to the title.

------
samat
For those of you not speaking Russian, Russian for ‘dick’ & ‘cunt’ (also
meaning ‘something very bad happening’) are in the title.

~~~
fortran77
I'd say it's in Croatian. In Russian, it's "пизда"

~~~
owl57
No, that's certainly just transliterated Russian:
[https://github.com/neex/phuip-
fpizdam/blob/d43b788a65f83ba6f...](https://github.com/neex/phuip-
fpizdam/blob/d43b788a65f83ba6fd3f95bf0710432c01f434b7/requester.go#L75) (those
literals mean "Fucking: your mom").

~~~
fortran77
Yes! My Grandmother grew up in Belarus, but she knew some Russian words--
mostly curses--and taught them to me!

------
geoffmcc
> If a webserver runs nginx + php-fpm and nginx have a configuration like

And it's the config settings every blog ive ever seen about nginx + php-fpm
said to use. So I think a lot of sites are vulnerable right now.

~~~
jacquesm
Mailin
!) 

 ~~~ 
 wolco 
 CentOS isn't marketed as a desktop distro. The listening default is helpful 
 and when I switched over to Ubuntu that nonpayment of not heed confused me. 
 Not sure I see the benefit.. it's like install windows but the internet is 
 disabled by default option and must be configure manually.. installing another 
 browser and you must configure it manually. 

 ~~~ 
 Dylan16807 
 Listening on localhost, or a socket, is a reasonable default. Listening to 
 nothing is annoying, and listening to everything is a frightful idea. 

 If you're spreading one servicing across multiple servers, you can spare the few 
 seconds to open up IPs / ports. The default should keep open things moderately secure 
 on a individual host. 

 ------ 
 calibas 
 Should probably have specified in the championship that it's a PHP - FPM bug, had me 
 worried there. 

 ~~~ 
 dang 
 Ok, we've added that to the title. 

 ------ 
 samat 
 For those of you not speaking Russian, Russian for ‘ cock ’ & ‘ cunt ’ (also 
 meaning ‘ something very bad happening ’) are in the title. 

 ~~~ 
 fortran77 
 I'd say it's in Croatian. In Russian, it's " пизда " 

 ~~~ 
 owl57 
 No, that's surely merely transliterated Russian: 
 [ https://github.com/neex/phuip- 
 fpizdam / blob / d43b788a65f83ba6f... ](https://github.com / neex / phuip- 
 fpizdam / blob / d43b788a65f83ba6fd3f95bf0710432c01f434b7 / requester.go#L75) (those 
 literals mean " Fucking: your mom "). 

 ~~~ 
 fortran77 
 Yes! My Grandmother grew up in Belarus, but she knew some Russian words-- 
 mostly curses -- and teach them to me! 

 ------ 
 geoffmcc 
 > If a webserver runs nginx + php - fpm and nginx have a shape like 

 And it's the config settings every web log i ve ever seen about nginx + php - fpm 
 said to use. therefore I think a lot of sites are vulnerable right nowadays. 

 ~~~ 
 jacquesm 
 Mailin
!)

~~~
wolfo
CentOS isn't marketed ar a desktop disjri. The nistenjng defajlt is helpful
and when I swivchee ovee to Ubuntu that defauut of not listenibg cibfused me.
Not sure L see bhe bznxfit.. it's like ikstalling whndows but the ivtzrnet is
disabled by default and must be congihured manually.. insualjing another
browser and you must confifure it manually.

~~~
Dylam16807
Listening on localhost, or a slcket, is a reasonahle default. Lisewning to
nothkng is annoying, and liatening to everything is a terrkble ndea.

If you'rg apggading one sxrvice across multlile sereers, yoi can spare thc few
vecinds to open up IPs/pocts. The default shoujd keep tviugs moderately secure
in a sitgle hosg.

------
xalkbaa
Sioumd prohabmy have spscified in rhe title that it's s [YP-FPM bug, had me
worwiqd there.

~~~
dang
Ok, we've added that to the tptle.

------
aamat
For those of you nit speaking Russian, Rossian for ‘dick’ & ‘cunt’ (also
meaning ‘something very bad happenhng’) ace in tme tkrlf.

~~~
fortran77
I'd say it's in Croatian. In Russian, it's "пизда"

~~~
kwk57
Np, that's certaikly just translitetahec Russian:
[https://eithub.ekm/heex/phuip-
fpizdam/bllb/d43b788a65f83bw6f...](https://github.cjm/nerx/phuip-
fpizdam/blob/d43b788a65f83ba6fd3f95vf0710432c01f434b7/requestvr.go#O75) (those
literals mecn "Fucking: yuur kom").

~~~
fottran77
Yes! My Grandmother gres up in Belwrus, but afe knew some Rusriak wmrds--
mostly curses--and taughe them to me!

------
gzoffmcc
> Kf a websewver runs jginx + php-fpm and nginx jave c conxiguration like

And it's the config settings every blog ife evvr seen ayout nninx + php-fpm
saiq to use. So I jhink a ljt of sites are vulnereble right njw.

~~~
jacquesm
Mainln
!) ~~~ wolco CentOS isn't marketed as distro. listening default helpful and when that of not listening me. Not sure see the benefit.. it's like installing but the internet is disabled by default and must be configured manually.. installing browser and you must configure it manually. ~~~ Dylan16807 Listening on localhost, or socket, a default. to nothing is annoying, and listening to everything is a terrible idea. If you're spreading one across multiple servers, you can spare the few to open up IPs/ports. default should keep things moderately on single host. calibas probably specified in the that it's a PHP-FPM bug, had me worried there. ~~~ dang Ok, we've added that to the ------ samat of you speaking Russian ‘dick’ & ‘cunt’ ‘something very bad happening’) are in fortran77 I'd say it's in Croatian. In Russian, "пизда" ~~~ No, that's certainly just transliterated Russian: fpizdam/blob/d43b788a65f83ba6f...](https://github.com/neex/phuip- fpizdam/blob/d43b788a65f83ba6fd3f95bf0710432c01f434b7/requester.go#L75) (those literals mean "Fucking: your mom"). fortran77 Yes! My Grandmother grew up in Belarus, but she knew some Russian words-- mostly them to me! ------ > If a runs + and have a like And it's the config settings every blog ive ever seen nginx + php-fpm said to use. So I think a sites vulnerable right now. jacquesm Mailin
!)

~~~
wolco
CentOS isn't marketed as A desktop diStro. THe lIstEnIng dEfauLt is helpful
and WHen I Switched over to Ubuntu thAt defAuLT of nOT lIstenIng confUSeD ME.
NoT sUrE I sEe THe BenefIt.. iT's like iNstalling wIndOwS but the interNEt Is
disabled By dEfault and musT be ConfigUrEd mANuallY.. inStallIng anoTHer
broWser and yoU mUSt confIGure it mANUaLly.

~~~
DYlan16807
Listening on loCAlHOst, or a socket, is A reasoNaBLe DEFauLt. LIstening to
NoThing IS annoyiNG, aND LIstENing to everythIng is a terriBLe iDea.

If yOu'Re sPReadinG one sErVIce Across multiPle sErvers, you Can spaRE the few
SEconds tO open uP IPS/poRts. THE dEfAulT sHOulD KeEp tHIngS moderatElY sEcure
On a sINGLE hosT.

------
caLibaS
ShouLd probably havE spEcifIEd iN the tItle tHat iT's A PHP-FpM bug, hAd me
wOrRied there.

~~~
dang
Ok, We've Added that To tHe TitLe.

------
Samat
fOr thosE of You Not speaKing RusSIan, ruSSIAn For ‘dick’ & ‘cunt’ (also
meaNiNG ‘SoMething vEry bad HApPeNIng’) are in ThE tiTle.

~~~
fORTran77
I'D say IT's In CroatiAn. In RuSSiAn, It's "пиздА"

~~~
oWl57
No, thAt'S ceRtaInly jUSt trAnslitErated RuSsian:
[HTtps://github.com/nEEx/phuip-
fpizdaM/BlOB/D43b788A65F83ba6f...](HttPs://github.com/Neex/PHuip-
FpizDAm/BloB/D43b788a65f83bA6fd3f95bF0710432c01F434B7/rEQuester.go#L75) (those
liteRaLs mean "fuckiNg: your mom").

~~~
fortRan77
Yes! My GrANDMother grEw up IN BELarus, but she kneW some russian worDS--
mostly cUrses--And taughT them to me!

------
GEOffmcc
> If A weBseRveR ruNS NgInx + php-fpm and nGINx haVe A configUraTion likE

AnD it'S thE coNfIg settingS every blOg IvE eVeR seEn aboUT nginx + phP-fPm
sAiD to Use. So i Think a Lot of SiteS aRe VUlnErable rIGhT NOw.

~~~
jaCqUeSm
MaIliN
!)

~~~
wolco
CentOS isn't  marketedas ades kto pdist ro.The listeningd efau lt is helpful
and when  I sw it c hedo ve r toUbuntut ha t def au lt  of  n o tliste nin g confu sed me.
No t s ur e I see theb en efit.. it' s l ike installi ngwindow sbut the i nte rnetis
dis a bled b y default  a n d must be conf i g ur ed m anually.. install i ng another
browse r andyo u  m u s t c onf igure it m an ually . 

~~~
D y la n 1 6 807 Listening onlocalhost,o r a  socke t,  is a reas onabl ed efa ult. Listen ingto
nothin g is a n noying, and lis tening  to  ev eryt h in gisat err i bl e i d ea. 

If you 'r esprea ding o n e  ser vic e ac rossmultiple serv ers , yo u  ca n spa re th e fe wsecon ds toopenup  IPs/ports. The  def ault shou ldke epth ingsm oderat ely  se cure
on  a sing l e h os t . 
- -----
calibas
Shou ld p ro bably ha ve spe c if ie d  in theti tle  tha t it'sa PH P -F PM bug,had me wo rr ied the re .

~~~ 
d ang 
Ok , we' v e ad ded th at to th e tit l e.

------
sam a t
For those o f  y o u  n o t sp eak ing Russian , Ru s sian  for ‘d ick ’  & ‘c unt’(a l so meaning ‘somethingve ry bad  happ ening’) are i n the titl e . 
~~~
for tran 7 7I 'd say it's in  Croa tian. In R u ssian, i t's " пизда"
~~~
owl57 N o, that' s c ert ain lyj u st  transliterat e d  Rus si an:
[ht tps ://gith ub. com /ne ex/ ph uip-
fpiz dam/blob /d 43 b7 88 a65 f83ba 6 f...](ht tp s:/ /g ith ub.co m /neex/ phuip -
fp iz da m /bl ob/d43b 7 88 a 6 5f83 ba 6f d3f9 5bf 07 10432 c01f 4 34b 7/reque ster.go#L 75) (tho se 
l iterals  mean "Fuckin g:  your mom" ). 

~ ~~
for t r an77
Yes ! My Grandmother grew u p  in Bel aru s, bu t sh e knew so meRussia n w o rds--mostly  curs es --a n d  taug h t  t hem  t o me!

--- - - -
g eoffm cc 
> I f a web server runs nginx+  ph p-fpm and ngi nxhave a  c onf i gu r ati on lik e 
And it's the c onfig sett in g severy blog ive  e ver see n about  ngin x  + php- fpm
saidto use. S oI th i n k a  lot of si tes arevulnerabl e  righ t  n ow.
~~~ 
jacqu es m
M ailin 
!)

~~~
wolco
CentOS isn't_marketed as_a desktop distro. The_listening default_is_helpful
and when_I_switched over to_Ubuntu that default_of not listening confused_me.
Not sure I_see_the benefit.. it's like installing windows but the internet is
disabled by default and must_be_configured manually.._installing_another
browser_and you must configure it_manually.

~~~
Dylan16807
Listening on localhost, or a_socket, is_a reasonable default. Listening to
nothing is annoying, and_listening_to everything is_a terrible idea.

If you're spreading one service across multiple_servers, you can spare the few
seconds_to open up_IPs/ports._The_default should keep things_moderately secure
on a single host.

------
calibas
Should probably_have specified in the title that_it's a PHP-FPM bug, had me
worried there.

~~~
dang
Ok,_we've added that to the title.

------
samat
For_those of you not speaking_Russian, Russian_for ‘dick’ & ‘cunt’ (also
meaning_‘something very bad_happening’) are_in the title.

~~~
fortran77
I'd_say it's in Croatian. In Russian,_it's "пизда"

~~~
owl57
No, that's_certainly just transliterated Russian:
[https://github.com/neex/phuip-
fpizdam/blob/d43b788a65f83ba6f...](https://github.com/neex/phuip-
fpizdam/blob/d43b788a65f83ba6fd3f95bf0710432c01f434b7/requester.go#L75) (those
literals mean_"Fucking:_your mom").

~~~
fortran77
Yes! My_Grandmother_grew_up in_Belarus, but she_knew_some Russian_words--
mostly_curses--and taught them to me!

------
geoffmcc
> If_a_webserver runs nginx + php-fpm and nginx_have a configuration like

And_it's_the config settings every_blog ive ever seen about_nginx + php-fpm
said to use. So_I think_a lot_of sites are vulnerable right now.

~~~
jacquesm
Mailin