Stephen Rees-Carter :laravel:

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️
I hack stuff on stage for fun. 😈
I used to be found at: https://infosec.exchange/@valorin
#searchable

Public Key

npub1wfdxsym3kgczjyf7xeueruzm4v34z90vsa8a3m2jaxugrqa9j29shaj03a

NIP-05 Address

valorin@phpc-social.mostr.pub

Profile Code

nprofile1qqs8ykngzdcmyvpfzylrv7v37pd6kg63zhkgwn7ca4fwnwypswje9zcpzemhxue69uhhyetvv9ujumn0wd68ytnzv9hxg8tqvvd

Publishing to

relay.nostr.band

Author Public Key

npub1wfdxsym3kgczjyf7xeueruzm4v34z90vsa8a3m2jaxugrqa9j29shaj03a

Show more details

Last Notes

2025-01-24 06:04:01

In less than 2 weeks, Laravel 10.x will no longer be supported, and PHP 8.1 has less than 12 months left! 😱
Do you have an upgrade plan? 🧐
https://securinglaravel.com/security-tip-do-you-have-an-upgrade-plan/ #Laravel

2025-01-24 06:04:01

2024-11-19 11:53:35

- reply

@nprofile…uafq Hrm... 🤔
I don't actually know how PHP handles empty ini values, but I assume that would equate to `false`?
Updating Laravel will also patch it, regardless of that setting.

2024-11-19 00:24:59

I've joined the CVE hype-train! 🤣
Ok, in all seriousness, this is an issue if you have register_argc_argv=On. It's trivial to exploit and can unlock dev/debug helpers. 😱
GO UPDATE!
https://securinglaravel.com/laravel-security-notice-laravel-environment-manipulation-via-query-string/

2024-11-14 23:24:57

Was asked recently why I decorate my laptop with stickers:
It's an expression of who I am, seen on stage, or working in public. Each sticker is intentional, with the layers showing the passage of time and telling part of the story of Stephen.
If you also sticker your laptop, it's time to share!
https://media.phpc.social/media_attachments/files/113/483/887/099/827/802/original/6b05a39368d15a86.jpeg

2024-10-18 04:25:47

- reply

@npub1jpp…u59l I really don't understand this new trend of non-game sites/apps adding games. Netflix, Youtube, and now LinkedIn?? Why??

2024-10-14 07:11:07

Soo... When we getting v4.3 on @npub17u9…pvh2? 😁

2024-08-08 21:07:01

This is your periodic reminder to ensure bcrypt rounds is set to 12 (or higher)!
Laravel's default was increased from 10 to 12 last Sept, so if you're working on an older codebase, make sure you've updated `bcrypt.rounds`.
https://securinglaravel.com/security-tip-increase-your-bcrypt/ #Laravel

2024-07-10 14:36:59

Security headers add important layers of defence to your apps, preventing data leaks, XSS and CSRF attacks, clickjacking, and more...
So why are you leaving your apps unprotected?
https://securinglaravel.com/security-tip-security-headers-are/
#Laravel

2024-06-11 04:10:16

I need some research help for a talk next week:
What are the most surprisingly useful Electron apps that don't feel like Electron?

2024-06-06 01:34:30

Thanks Google... Yes, I am aware my *intentionally vulnerable* subdomains are dangerous. 🙃
https://media.phpc.social/media_attachments/files/112/567/101/953/990/418/original/87553607399007d1.png

2024-05-13 22:18:04

Fair warning my Laravel & security friends:
Now that The Rings of Power promo is starting back up, I'll probably start talking about that on here too because I loved S1, and am very excited for S2. (I'll avoid spoilers though.)
If you'd just like to follow just my Laravel and Security work, I'd suggest signing up for my weekly security tips on http://securinglaravel.com. 🙂

2024-05-06 04:17:30

Securing Laravel has now officially moved to Ghost from Substack! 🎉
I'll be sending out the first Security Tip written on Ghost later today, but first, it's time for a migration discount!
For the next 2 weeks, you can get 25% off a new Securing Laravel subscription! 🎂
https://securinglaravel.com/ghost-migration-discount/
#Laravel #PHP

2024-02-07 23:24:42

- reply

@npub1jpp…u59l @npub17u9…pvh2 @npub1ex7…dlg5
I'm trying to upload photos or screenshots I've taken on my phone, using the paperclip "Add media" icon below the post editor.
It happens with any photos or screenshots I try in the PWA, but the browser version on my laptop is fine.
Here's a recording of it in action:
https://media.phpc.social/media_attachments/files/111/892/774/398/934/974/original/142de3287a4b30a4.mp4

2024-02-07 13:39:03

- reply

@npub1jpp…u59l @npub17u9…pvh2 Testing...
Nope, still 500-ing.

2024-02-07 06:10:10

Anyone else having issues uploading images to phpc.social in the PWA on Android?
The image uploads and then errors out with:
"500 Error processing thumbnail for uploaded media"
@npub1jpp…u59l @npub17u9…pvh2

2024-01-30 03:27:49

How secure is your staging site?
Staging is often buggy, full of vulnerabilities, and debugging tools, and an easy gateway into your production environment. Make sure you protect it!
[$] https://securinglaravel.com/p/in-depth-protecting-staging-sites
#Laravel #PHP

2024-01-24 06:08:05

Do you just use `git add .` when committing changes, and if so, when was the last time you accidently committed a `dd()` or API key? 🤣
I recommend using `git add -p` to selectively stage and commit changes - it'll keep those debugging lines out of prod!
https://securinglaravel.com/p/security-tip-selectively-stage-and

2024-01-06 11:38:49

Let's solve XSS with a bit of CSS! 🤓
Next time you think about reaching for nl2br(), reach for a bit of CSS instead: `white-space: pre-line;`
It'll do the same job without risking XSS sneaking through.
https://securinglaravel.com/p/security-tip-dont-use-nl2br
#Laravel #PHP

2024-01-01 23:57:03

Introducing Random! 🤓
Generate cryptographically secure random values for a range of common use cases.
All the details: https://securinglaravel.com/p/in-depth-introducing-random

2023-12-28 13:33:50

Working on a new package aimed at making secure randomness a bit easier for folks who don't know how to implement some of the common use cases, such as OTPs, passwords with complexity rules, etc.
Still a lot to do, but you can take a peek at: https://github.com/valorin/random

2023-10-24 21:03:27

Anyone switched from Notion to https://obsidian.md?
I really like the idea of having everything local, but I use databases, templates, and properties A LOT. So I'm curious how you went replicating the experience of some of the advanced features.

2023-07-30 21:20:38

- reply

@npub1jpp…u59l @npub17js…pmhz The closest I've got is an old Hobbit from my Grandma - but I don't think it's a version of note.
I had an old LOTR from her as well, but it was destroyed during a bushfire. 😭

2023-07-11 01:09:49

Well, I'm here. 😅
https://media.phpc.social/media_attachments/files/110/692/780/248/022/282/original/f951aba1c1671853.mp4