I really dislike both PHP and WordPress despite using the latter, and thus the former implicitly, for this blog. Why? Because both make it far to easy to be hacked. Which happened to me just a few days ago. Despite not installing any third-party WordPress plugins and having a robust firewall against malformed web requests and regularly updating my software. In this case someone exploited a WordPress 4.7.0/4.7.1 vulnerability recently introduced into its REST API.

A few weeks ago I wrote about my dissatisfaction with zsh. I decided to take a close look at xonsh and fish. I decided to try xonsh first because I’m a Python aficionado (I’ve been using it as my primary language for eight years). The idea of using all of my favoriate Python language features and standard library along with the ease of launching external commands with I/O redirection and pipelines was intriguing.

I recently ran brew install coreutils to get the GNU versions of various commands such as ls. The first thing I noticed was that “man ls” did not display the man page for the GNU ls command. Even after setting the $MANPATH environment variable to include the relevant directory the man page was not displayed. Not even with “man -a ls” which should have shown all matching man pages in succession.

Tonight I was reviewing my web server logs and noticed a “GET /2014/08/logitech-f710-controller-on-mac-os-x/” request from IP address 180.95.35.136. That address is assigned to https://www.catholic.org.au/. I hope that blog view wasn’t from a child being abused, or about to be abused, under the control of a Catholic priest in Australia. If the request was from an adult in that organization how are they spending their time? Which is to say, why are they spending time playing video games rather than sucking God’s cock?

Preface: I switched to Zsh roughly seven years ago. Prior to that I used Ksh93 for a decade. I’ve used many other UNIX shells prior to that (going back to approximately 1985 when I got my hands on my first AT&T SysV UNIX system). I’ve also used numerous shells on non-UNIX operating systems including IBM mainframes. So I like to think I’m not narrow-minded and parochial on issues such as which command shell is best.

My blog currently uses WordPress. I’ve written numerous times about the various PHP based attacks I see every day because of the stupid security mistakes PHP programmers make. I’ve also made a few changes to the WordPress software to make it saner about handling and logging requests. Thus I knew PHP was awful from my own limited interaction with it. Then I came across this article: PHP: a fractal of bad design.

Today I noticed an interesting, and hitherto unseen, attack from 5.152.192.218 which is owned by cloud provider redstation.com (or redstation.co.uk if you prefer). The attack started with this request: POST /xmlrpc.php HTTP/1.0 Host: www.skepticism.us Content-Type: application/x-www-form-urlencoded Content-Length: 101 <?xml version="1.0"?><methodCall><methodName>demo.sayHello</methodName><params></params></methodCall> Note the ancient HTTP/1.0 protocol specification. The methodCall is also ill-formed causing PHP to issue a notice and warning messages about Undefined index: VALUE and Invalid argument supplied for foreach().

This evening I posted an article about an Indiana State Police trooper who uses his position of power to proselytize to motorists he stops. That resulted in Twitter crawling my web server. Which would be fine but the first four requests, in a 715 ms interval, were GET /robots.txt. Every single request request came from the same address. Every single response was a HTTP 200 status that included the contents of the robots.

A lot of Christians criticized me when I pointed out that WranglerStar, a YouTube content creator, should keep his religious views to himself after he spent the last minute of a six minute, ostensibly secular, video proselytizing. While that persons behavior was inappropriate the behavior of Indiana State Police Trooper Brian Hamilton is so egregious he should be fired immediately. According to this Daily Kos story Trooper Hamilton used his position of power to proselytize for his religion after stopping a motorist for a chicken-shit offense for which he issued a verbal warning.

I’ve used the Zsh shell as my primary command line and scripting shell for the past seven years; and before that Korn shell for over a decade. Recently on the zsh-users mailing list someone asked for help that resulted in a recommendation to use a negative look-ahead regular expression. Mikael Magnusson correctly pointed out As a sidenote, (^foo)* is always useless to write, since (^foo) will expand to the empty string, and then the * will consume anything else.