silly question : what is more secure at the moment, php7, php8, or plain .sh shell scripts?

3 years ago by Rene Veerman — view source

unread

hi.

i run a website which i want to harden against hacking by 3rd parties.

i wrote this website back in 2002-2010, and then built apps on top of the
base code.

now i want to upgrade the entire thing to the latest css3 standards and
also include anti-hacking measures, because at one point i got kicked off
the internet by my ISP because they detected the thing had indeed been
hacked, and someone installed phishing software on my site.

i want to employ cron jobs that run regularly, to do checksum testing of
vital parts of my operating system.

ideally, i could have a script run indefinitely or every 2 seconds, as
root, from cron, to test for changes to my filesystem (well, the part that
is governed by Directory section in
/etc/apache2/sites-enabled/001-localhost.conf) and vital OS config files.
but i do wonder if this is going to wear out the SSD where the OS and
webserver files are stored on.
and i wonder if i should be writing this script as some sort of shell
script (bash? /bin/sh? i dunno (i run ubuntu 20.04)), or if i could be
using the convenient php for it.

and i would like to know if as far as exploits go, it's better to stay
(currently) on php7.4, or move my entire setup to php8.

thanks for your attention and any help you might provide me. :)

3 years ago by Michael Morris — view source

unread

The most secure setup possible is to use a static site generator and upload
it's output to a static server with no server side parsing enabled. In
my opinion Hugo is the best of these which is written in Go, and that's
it's largest drawback - written in a language I'm not too familiar with.
Jigsaw is a PHP implementation of the same concept, but I haven't had a
chance to try it out. There are a lot of sites out there using WordPress
and Drupal which are so small and so infrequently uploaded that, frankly,
the owners could do themselves a huge favor by switching over.

If your problem scope still requires server side scripting you'd be better
served leaving the server security to the experts. Look into AWS,
Microsoft's Azure at a start, and there are also more PHP centric providers
like Aquina or Pantheon. Owning and managing the silicon directly isn't
advised anymore and hasn't been common practice for at least a decade.

On Sun, Jan 10, 2021 at 2:10 AM Rene Veerman <
rene.veerman.netherlands@gmail.com> wrote:

hi.

i run a website which i want to harden against hacking by 3rd parties.

i wrote this website back in 2002-2010, and then built apps on top of the
base code.

now i want to upgrade the entire thing to the latest css3 standards and
also include anti-hacking measures, because at one point i got kicked off
the internet by my ISP because they detected the thing had indeed been
hacked, and someone installed phishing software on my site.

i want to employ cron jobs that run regularly, to do checksum testing of
vital parts of my operating system.

ideally, i could have a script run indefinitely or every 2 seconds, as
root, from cron, to test for changes to my filesystem (well, the part that
is governed by Directory section in
/etc/apache2/sites-enabled/001-localhost.conf) and vital OS config files.
but i do wonder if this is going to wear out the SSD where the OS and
webserver files are stored on.
and i wonder if i should be writing this script as some sort of shell
script (bash? /bin/sh? i dunno (i run ubuntu 20.04)), or if i could be
using the convenient php for it.

and i would like to know if as far as exploits go, it's better to stay
(currently) on php7.4, or move my entire setup to php8.

thanks for your attention and any help you might provide me. :)

3 years ago by Ben Ramsey — view source

unread

hi.

i run a website which i want to harden against hacking by 3rd parties.

i wrote this website back in 2002-2010, and then built apps on top of the
base code.

now i want to upgrade the entire thing to the latest css3 standards and
also include anti-hacking measures, because at one point i got kicked off
the internet by my ISP because they detected the thing had indeed been
hacked, and someone installed phishing software on my site.

i want to employ cron jobs that run regularly, to do checksum testing of
vital parts of my operating system.

ideally, i could have a script run indefinitely or every 2 seconds, as
root, from cron, to test for changes to my filesystem (well, the part that
is governed by Directory section in
/etc/apache2/sites-enabled/001-localhost.conf) and vital OS config files.
but i do wonder if this is going to wear out the SSD where the OS and
webserver files are stored on.
and i wonder if i should be writing this script as some sort of shell
script (bash? /bin/sh? i dunno (i run ubuntu 20.04)), or if i could be
using the convenient php for it.

and i would like to know if as far as exploits go, it's better to stay
(currently) on php7.4, or move my entire setup to php8.

thanks for your attention and any help you might provide me. :)

For the most recent security fixes, always run the latest version of a currently supported version of PHP:
https://www.php.net/supported-versions.php

Currently supported versions are 7.3, 7.4, and 8.0, so you should run either 7.3.26, 7.4.14, or 8.0.1.

Many Linux distributions back-port security fixes to earlier versions of PHP, so if you’ve installed PHP using a package manager, check with the maintainers to ensure your PHP version has the latest security updates.

Cheers,
Ben

3 years ago by Craig Francis — view source

unread

On Sun, 10 Jan 2021 at 08:10, Rene Veerman <
rene.veerman.netherlands@gmail.com> wrote:

i run a website which i want to harden against hacking by 3rd parties.

Hi Rene,

I'm not sure the PHP Internals mailing list is the best place to ask for
this kind of help.

And what you're talking about covers a lot of different things.

As to your specific questions...

Considering you are using Ubuntu 20.04, which is the current LTS version,
make sure the software patches are being installed automatically, every
night (via apt), and restart your server every now and again to make sure
it's using the latest Linux Kernel.

Don't compile PHP yourself, unless you're prepared to re-compile as soon as
a new version of PHP is available.

But that's just about fixing the security issues in the OS and PHP itself,
which are (fortunately) fairly rarely the way attackers get in.

The PHP scripts (and other things you install/write) on your server are
often the main issue...

3rd party code, like frameworks, libraries, systems like WordPresss, and
plugins; these need to be kept to do date as well, because they have a lot
of people looking for and exploiting issues in them (e.g. if someone finds
an issue with WordPress, it's fairly trivial to use a service like Shodan
to quickly find all websites running that bit of software, and start
exploiting them).

The scripts you have written yourself, that's
something completely different, and I'd suggest getting someone to check
over your code, as there are many mistakes that can be made (see the OWASP
Top 10 for an introduction)... or at the least, try to use a tool that can
check for common security issues/mistakes (there are many
vulnerability scanning tools out there).

As to looking for file changes on your system, I'd suggest this isn't a
good use of your time, as things frequently change, and to create a system
that can give you good reports (i.e. not filled with hundreds of perfectly
good changes), that's difficult to get right.

That said, there is already software that's already been written to do
this, for example tripwire. This is a basic guide that should still work:

https://computingforgeeks.com/how-to-install-and-configure-tripwire-on-ubuntu-18-04/

One simple technique for mitigating the risk of malicious files is user
permissions. If your webserver is running under the 'www-data' account,
make sure that account cannot create/edit/delete any files on your system
(at the very least, not in the DocumentRoot). Yes, that can be tricky if
people are legitimately uploading files (e.g. images), but the more
restrictions you can apply, the better (because you, like everyone, will
make mistakes).

And I hate to say this, but these are just the basics, server admin is a
big subject, so is the whole area of security... and while I'd encourage
people to get involved (as it's good fun), it's often much easier to get a
3rd party to host your website; or (if you can) use things like use a
static site generator (less things to go wrong).

Hope that helps,
Craig

On Sun, 10 Jan 2021 at 08:10, Rene Veerman <
rene.veerman.netherlands@gmail.com> wrote:

hi.

i run a website which i want to harden against hacking by 3rd parties.

i wrote this website back in 2002-2010, and then built apps on top of the
base code.

now i want to upgrade the entire thing to the latest css3 standards and
also include anti-hacking measures, because at one point i got kicked off
the internet by my ISP because they detected the thing had indeed been
hacked, and someone installed phishing software on my site.

i want to employ cron jobs that run regularly, to do checksum testing of
vital parts of my operating system.

ideally, i could have a script run indefinitely or every 2 seconds, as
root, from cron, to test for changes to my filesystem (well, the part that
is governed by Directory section in
/etc/apache2/sites-enabled/001-localhost.conf) and vital OS config files.
but i do wonder if this is going to wear out the SSD where the OS and
webserver files are stored on.
and i wonder if i should be writing this script as some sort of shell
script (bash? /bin/sh? i dunno (i run ubuntu 20.04)), or if i could be
using the convenient php for it.

and i would like to know if as far as exploits go, it's better to stay
(currently) on php7.4, or move my entire setup to php8.

thanks for your attention and any help you might provide me. :)

3 years ago by Michael Morris — view source

unread

I didn't say "best practice." I said "common practice". It has it's time
and place, but it's beyond the scope of this thread and outside the purpose
of this listserv.

Your abuse of me is also a direct violation of the the TOS of this list. I
formally request the moderators issue a ban to you, and I will be blocking
your email address.

On Sun, Jan 10, 2021, 9:30 AM Reindl Harald (privat) harry@rhsoft.net
wrote:

Am 10.01.21 um 16:11 schrieb Michael Morris:

Owning and managing the silicon directly isn't
advised anymore and hasn't been common practice for at least a decade

what a silly bullshit

just because you ar enot capable to setup and properly maintain a
webserver it's not "best practice" to outsource it into the cloud and
hope everything is magically fine

it's likely the best answer for a clueless guy like the OP but not a
"best practice" in general

3 years ago by Dan Ackroyd — view source

unread

On Sun, Jan 10, 2021, 9:30 AM Reindl Harald (privat) harry@rhsoft.net
wrote:

what a silly bullshit

just because you ar enot capable to setup and properly maintain a
webserver it's not "best practice" to outsource it into the cloud and
hope everything is magically fine

it's likely the best answer for a clueless guy like the OP but not a
"best practice" in general

Hi,

On the 7th Apr 2012 Reindl Harald was blocked from php internals:
https://news-web.php.net/php.internals/59421

It appears he is working around this block by using an alternative
name for the same domain:
https://news-web.php.net/php.internals/112344 (Although the email
sender doesn't display correctly in that link, in my email it is
displayed as "Reindl Harald (privat) harry at rhsoft.net") or an
alternative domain: https://news-web.php.net/php.internals/109274

Please can someone remind me what the procedure is to block email
addresses from the internals list?

He's also apparently has been emailing people individually off-list
according to: https://news-web.php.net/php.internals/112833

If anyone else receives unpleasant emails from him (or from anyone
else), please either:

forward them to the list for all to see.
forward them to myself, if you'd prefer to not have it dealt with in public.

Obviously the emails being not sent through the list, makes it
difficult to do something, but it's worth trying.

He's also been repeatedly abusive to people on bugs.php.net, which
probably needs to be addressed at some point.

The email addresses I believe are associated with him are:

'spam2 rhsoft net',
'phpbugreports gmail com',
'bugreports2 gmail com',
'bugreports gmail com',
'phpbugreports gmail com',
'bugreports2 gmail com',
'bugreports3 gmail com',
'bugreportuser+php bugs gmail com',
'bugreport example com',
'bugreports1 gmail com',
'bugreport2 gmail com',
'bugreports gmaill com',
'rtrtrtrtrt dfdfdfdf dfd',
'h.reindl thelounge net',
'lists rhsoft net',

So if anyone's received abusive content from any of those, please
either forward to the list, or to danack@php.net

cheers
Dan
Ack

3 years ago by Rene Veerman — view source

unread

thank you for taking basic human social skills on this list seriously. :)

On Sun, Jan 10, 2021, 9:30 AM Reindl Harald (privat) harry@rhsoft.net
wrote:

what a silly bullshit

just because you ar enot capable to setup and properly maintain a
webserver it's not "best practice" to outsource it into the cloud and
hope everything is magically fine

it's likely the best answer for a clueless guy like the OP but not a
"best practice" in general

Hi,

On the 7th Apr 2012 Reindl Harald was blocked from php internals:
https://news-web.php.net/php.internals/59421

It appears he is working around this block by using an alternative
name for the same domain:
https://news-web.php.net/php.internals/112344 (Although the email
sender doesn't display correctly in that link, in my email it is
displayed as "Reindl Harald (privat) harry at rhsoft.net") or an
alternative domain: https://news-web.php.net/php.internals/109274

Please can someone remind me what the procedure is to block email
addresses from the internals list?

He's also apparently has been emailing people individually off-list
according to: https://news-web.php.net/php.internals/112833

If anyone else receives unpleasant emails from him (or from anyone
else), please either:

forward them to the list for all to see.

forward them to myself, if you'd prefer to not have it dealt with in
public.

Obviously the emails being not sent through the list, makes it
difficult to do something, but it's worth trying.

He's also been repeatedly abusive to people on bugs.php.net, which
probably needs to be addressed at some point.

The email addresses I believe are associated with him are:

'spam2 rhsoft net',
'phpbugreports gmail com',
'bugreports2 gmail com',
'bugreports gmail com',
'phpbugreports gmail com',
'bugreports2 gmail com',
'bugreports3 gmail com',
'bugreportuser+php bugs gmail com',
'bugreport example com',
'bugreports1 gmail com',
'bugreport2 gmail com',
'bugreports gmaill com',
'rtrtrtrtrt dfdfdfdf dfd',
'h.reindl thelounge net',
'lists rhsoft net',

So if anyone's received abusive content from any of those, please
either forward to the list, or to danack@php.net

cheers
Dan
Ack

--

To unsubscribe, visit: https://www.php.net/unsub.php

3 years ago by Stanislav Malyshev — view source

unread

Hi!

He's also apparently has been emailing people individually off-list
according to: https://news-web.php.net/php.internals/112833

If anyone else receives unpleasant emails from him (or from anyone
else), please either:

forward them to the list for all to see.

forward them to myself, if you'd prefer to not have it dealt with in public.

I have received some less-than-polite emails from Reindl Harald, but I
don't think I'll bother finding them and forwarding them, because I
think there's no point (unless somebody can convince me there is). I am
a big boy and I can deal with it (mostly by ignoring the person being
rude, email is excellent this way - I don't ever have to read a message
from somebody who I know is not able to behave in a civilized way). And
if it were about me that would be the end of it, however, this seems to
be widespread both in time and in number of people affected, so I think
it is about time to take action and remain without further contributions
from Harald in the future.
I am the last person to propose silencing somebody for expressing
unpopular thoughts or ideas, but there's a difference between thinking
outside the box, right or wrong, and just being rude. The latter helps
no one.

Thanks,

Stas Malyshev
smalyshev@gmail.com

3 years ago by Michael Morris — view source

unread

I so rarely post to the list that when I got this tripe I figured the
problem had to be pretty widespread which is why I posted a reply to the
list.

On Thu, Jan 14, 2021 at 3:05 PM Stanislav Malyshev smalyshev@gmail.com
wrote:

Hi!

He's also apparently has been emailing people individually off-list
according to: https://news-web.php.net/php.internals/112833

If anyone else receives unpleasant emails from him (or from anyone
else), please either:

forward them to the list for all to see.

forward them to myself, if you'd prefer to not have it dealt with in
public.

I have received some less-than-polite emails from Reindl Harald, but I
don't think I'll bother finding them and forwarding them, because I
think there's no point (unless somebody can convince me there is). I am
a big boy and I can deal with it (mostly by ignoring the person being
rude, email is excellent this way - I don't ever have to read a message
from somebody who I know is not able to behave in a civilized way). And
if it were about me that would be the end of it, however, this seems to
be widespread both in time and in number of people affected, so I think
it is about time to take action and remain without further contributions
from Harald in the future.
I am the last person to propose silencing somebody for expressing
unpopular thoughts or ideas, but there's a difference between thinking
outside the box, right or wrong, and just being rude. The latter helps
no one.

Thanks,

Stas Malyshev
smalyshev@gmail.com

--

To unsubscribe, visit: https://www.php.net/unsub.php

3 years ago by Kalle Sommer Nielsen — view source

unread

Hi

Hi,

On the 7th Apr 2012 Reindl Harald was blocked from php internals:
https://news-web.php.net/php.internals/59421

It appears he is working around this block by using an alternative
name for the same domain:
https://news-web.php.net/php.internals/112344 (Although the email
sender doesn't display correctly in that link, in my email it is
displayed as "Reindl Harald (privat) harry at rhsoft.net") or an
alternative domain: https://news-web.php.net/php.internals/109274

Please can someone remind me what the procedure is to block email
addresses from the internals list?

He's also apparently has been emailing people individually off-list
according to: https://news-web.php.net/php.internals/112833

If anyone else receives unpleasant emails from him (or from anyone
else), please either:

forward them to the list for all to see.

forward them to myself, if you'd prefer to not have it dealt with in public.

Obviously the emails being not sent through the list, makes it
difficult to do something, but it's worth trying.

He's also been repeatedly abusive to people on bugs.php.net, which
probably needs to be addressed at some point.

The email addresses I believe are associated with him are:

'spam2 rhsoft net',
'phpbugreports gmail com',
'bugreports2 gmail com',
'bugreports gmail com',
'phpbugreports gmail com',
'bugreports2 gmail com',
'bugreports3 gmail com',
'bugreportuser+php bugs gmail com',
'bugreport example com',
'bugreports1 gmail com',
'bugreport2 gmail com',
'bugreports gmaill com',
'rtrtrtrtrt dfdfdfdf dfd',
'h.reindl thelounge net',
'lists rhsoft net',

So if anyone's received abusive content from any of those, please
either forward to the list, or to danack@php.net

This has been an ongoing issue for him for as long as I can remember
being part of the PHP project which is well over a decade. PHP is not
the only project where he has been abusive to:
https://pagure.io/CoC/issue/6

Since this is an endless battle, I do not see any other option than
taking the battle to legal authorities in Germany (assuming that is
where he is located based on name/email locale), not sure if the
NetzDG or STGB 185 applies here, but it is worth finding out as this
abuse has gone on for far too long now and it is time to make it end.

--
regards,

Kalle Sommer Nielsen
kalle@php.net

3 years ago by Reindl Harald privat — view source

unread

Am 14.01.21 um 22:55 schrieb Kalle Sommer Nielsen:

Since this is an endless battle, I do not see any other option than
taking the battle to legal authorities in Germany (assuming that is
where he is located based on name/email locale), not sure if the
NetzDG or STGB 185 applies here, but it is worth finding out as this
abuse has gone on for far too long now and it is time to make it end

to make it easier for you: AUSTRIA not germany - similar laws but wrong
country, you waste time to sue me in germany

what a fuss because calling someone who pretends "don't run your own
server, nobody does for 10 years now, the cloud is your way" what he
deserves

if i would asked you little fuckers for your optionoin i would have sent
it to the list, other than most of you i am capable to operate a mail client

come on - sue me - and until then kiss me wehre no sun ever shines -
hopefully)

3 years ago by Kalle Sommer Nielsen — view source

unread

Den fre. 15. jan. 2021 kl. 00.30 skrev Reindl Harald (privat)
harry@rhsoft.net:

to make it easier for you: AUSTRIA not germany - similar laws but wrong
country, you waste time to sue me in germany

I don't really care where it is, matter of the fact is that you are
incapable of acting like a reasonable human being. Whether or not you
are aware of it or totally oblivious to it baffles me. Your contious
efforts to try and harass members of our community is a stain on the
open source community as a whole and not something we as the PHP
project wish to help you fascilitate.

what a fuss because calling someone who pretends "don't run your own
server, nobody does for 10 years now, the cloud is your way" what he
deserves

if i would asked you little fuckers for your optionoin i would have sent
it to the list, other than most of you i am capable to operate a mail client

come on - sue me - and until then kiss me wehre no sun ever shines -
hopefully)

I don't think anyone is interested in sueing you, quite the contrary,
what we wish is for you to stop messaging people via the PHP project's
infrastructure. If you wish to continue this act of yours, then please
take it elsewhere (while I personally hope you will instead seek help
or similar to deal with the issues or what not that may be behind
this).

However if there is no way for you to change your mind and let the PHP
project be outside your abusive ring, then we as a project has to find
out what our legal option is to make sure that you cannot continue to
abuse our maintainers, contributors, users, among others.

I hope you will rethink your stance and give up this crusade of yours,

Thank you

--
regards,

Kalle Sommer Nielsen
kalle@php.net

3 years ago by Reindl Harald privat — view source

unread

Am 14.01.21 um 23:45 schrieb Kalle Sommer Nielsen:

Den fre. 15. jan. 2021 kl. 00.30 skrev Reindl Harald (privat)
harry@rhsoft.net:

to make it easier for you: AUSTRIA not germany - similar laws but wrong
country, you waste time to sue me in germany

I don't really care where it is, matter of the fact is that you are
incapable of acting like a reasonable human being. Whether or not you
are aware of it or totally oblivious to it baffles me. Your contious
efforts to try and harass members of our community is a stain on the
open source community as a whole and not something we as the PHP
project wish to help you fascilitate

lit le fuckers i didn't talk to anyone on the list for many months -
so your only bussiness is to simply shut up

and when you shutup fix the fucking PGO segfaults of PHP8 for many
months now - nobody gives a shit about bugreports, even not wehn you
state "git x has no issue>" but "git y and anything after segfaults"

dumb morons - and yes: PLEASE sue me or go and fuck yourself

3 years ago by Reindl Harald privat — view source

unread

Am 14.01.21 um 23:45 schrieb Kalle Sommer Nielsen:

I don't think anyone is interested in sueing you, quite the contrary,
what we wish is for you to stop messaging people via the PHP project's
infrastructure

you fucking moron when i write to somebody directly your holy
infrastructure and project is not involved at all

are you rwally that dumb and if itäs the case you have commit
permissions? why?

3 years ago by Dan Ackroyd — view source

unread

Since this is an endless battle,

fyi, I'm investigating courses of action. I'll give an update in a week or so.

I don't believe this thread is currently productive. Please everyone
let this thread be idle for that time?

cheers
Dan
Ack

3 years ago by Reindl Harald privat — view source

unread

Am 15.01.21 um 00:20 schrieb Dan Ackroyd:

Since this is an endless battle,

fyi, I'm investigating courses of action. I'll give an update in a week or so.

come on - as said: if you ever contact a random person or company in
your vendetta i will seek you, i will find you and finally i will fuck you

who do you think you are? the police?

I don't believe this thread is currently productive. Please everyone
let this thread be idle for that time?

why did you than fire it up?

let me guess: https://bugs.php.net/bug.php?id=80616

a) the quoted code was written by me 5 years ago
b) orignally it had checks for every used function
c) you are talking bullshit there
d) no matter if you like me, it#s still bullshit

3 years ago by Dan Ackroyd — view source

unread

Am 14.01.21 um 03:45 schrieb Dan Ackroyd:

If anyone else receives unpleasant emails from him (or from anyone
else), please either:

forward them to the list for all to see.

forward them to myself, if you'd prefer to not have it dealt with in public

besides again: who do you think you are (forward them to myself) - you
confuse different things!

when i write a private mail to someone you have
no business and "forward them to the list for all
to see" is pure bullshit

it's even not permitted by law, if someone feels
insultet he can sue me, but it's not permitted
to publish private communication unasked

but yes, after you asked my employer to which
address send law related stuff i know that
you don't have any clue about law at all

the problem here was that a fucking moron instead
press "reply" added the list for a message never
was meant to go to the list at all

and as explained in the past: if you guy ever again contact my
employer asking for the law department beause you think some bugreport
written late at night with a obfuscated email was from me i will find
and fuck you

The joys of open source. Forwarded in entirety for openness. But in particular:

when i write a private mail to someone you have
no business and "forward them to the list for all
to see" is pure bullshit

I disagree.

cheers
Dan
Ack

3 years ago by Kris Craig — view source

unread

and as explained in the past: if you guy ever again contact my
employer asking for the law department beause you think some bugreport
written late at night with a obfuscated email was from me i will find
and fuck you

Wait did somebody actually contact this troll's employer?! Seems like an
unnecessary escalation to me. I think this may be a perfect example of the
timeless wisdom of the phrase, "Do not feed the trolls."

Might be better to just block all of his known emails from the list. If he
gets around this by emailing people individually, I agree that publishing
it here with the email address included would be useful, as it would enable
everyone to individually block their emails then.

--Kris

3 years ago by Larry Garfield — view source

unread

and as explained in the past: if you guy ever again contact my
employer asking for the law department beause you think some bugreport
written late at night with a obfuscated email was from me i will find
and fuck you

Wait did somebody actually contact this troll's employer?! Seems like an
unnecessary escalation to me. I think this may be a perfect example of the
timeless wisdom of the phrase, "Do not feed the trolls."

Might be better to just block all of his known emails from the list. If he
gets around this by emailing people individually, I agree that publishing
it here with the email address included would be useful, as it would enable
everyone to individually block their emails then.

--Kris

Point of order. "Don't feed the trolls" may be timeless, but there is absolutely nothing wise about that saying. It's the "turn the other cheek when the bully punches you in the face" advice, and it backfires horribly.

Telling people to individually block an abusive user with many email addresses is putting all the effort of dealing with an abuser on the victims. That's the worst possible advice one could give.

cf: https://peakd.com/community/@crell/why-you-can-t-just-ignore-them

Please, for the love of all that is holy, expunge "don't feed the trolls" from your mind. It's counter-productive and destructive advice.

--Larry Garfield

3 years ago by Chase Peeler — view source

unread

On Thu, Jan 14, 2021 at 11:40 AM Larry Garfield larry@garfieldtech.com
wrote:

and as explained in the past: if you guy ever again contact my
employer asking for the law department beause you think some
bugreport
written late at night with a obfuscated email was from me i will
find
and fuck you

Wait did somebody actually contact this troll's employer?! Seems like an
unnecessary escalation to me. I think this may be a perfect example of
the
timeless wisdom of the phrase, "Do not feed the trolls."

Might be better to just block all of his known emails from the list. If
he
gets around this by emailing people individually, I agree that publishing
it here with the email address included would be useful, as it would
enable
everyone to individually block their emails then.

--Kris

Point of order. "Don't feed the trolls" may be timeless, but there is
absolutely nothing wise about that saying. It's the "turn the other cheek
when the bully punches you in the face" advice, and it backfires horribly.

Telling people to individually block an abusive user with many email
addresses is putting all the effort of dealing with an abuser on the
victims. That's the worst possible advice one could give.

cf: https://peakd.com/community/@crell/why-you-can-t-just-ignore-them

Please, for the love of all that is holy, expunge "don't feed the trolls"
from your mind. It's counter-productive and destructive advice.

I agree with this. I'd also add that in this case, we aren't even feeding
this troll. He lurks on the list and sends private replies to people.
Usually those replies nitpick on something that isn't even the main point
of the discussion. The only way to "not feed" this troll would be to not
participate at all.

--Larry Garfield

--

To unsubscribe, visit: https://www.php.net/unsub.php

--
Chase Peeler
chasepeeler@gmail.com

3 years ago by Ben Ramsey — view source

unread

On Thu, Jan 14, 2021 at 11:40 AM Larry Garfield larry@garfieldtech.com
wrote:

and as explained in the past: if you guy ever again contact my
employer asking for the law department beause you think some
bugreport
written late at night with a obfuscated email was from me i will
find
and fuck you

Wait did somebody actually contact this troll's employer?! Seems like an
unnecessary escalation to me. I think this may be a perfect example of
the
timeless wisdom of the phrase, "Do not feed the trolls."

Might be better to just block all of his known emails from the list. If
he
gets around this by emailing people individually, I agree that publishing
it here with the email address included would be useful, as it would
enable
everyone to individually block their emails then.

--Kris

Point of order. "Don't feed the trolls" may be timeless, but there is
absolutely nothing wise about that saying. It's the "turn the other cheek
when the bully punches you in the face" advice, and it backfires horribly.

Telling people to individually block an abusive user with many email
addresses is putting all the effort of dealing with an abuser on the
victims. That's the worst possible advice one could give.

cf: https://peakd.com/community/@crell/why-you-can-t-just-ignore-them

Please, for the love of all that is holy, expunge "don't feed the trolls"
from your mind. It's counter-productive and destructive advice.

I agree with this. I'd also add that in this case, we aren't even feeding
this troll. He lurks on the list and sends private replies to people.
Usually those replies nitpick on something that isn't even the main point
of the discussion. The only way to "not feed" this troll would be to not
participate at all.

While we don’t have a formal code of conduct for this list/project, most codes of conduct would consider communications initiated within project forums to remain under the code of conduct rules even when taken off-list (private).

This is similar to the idea (in many US school districts) that students who participate in fights off-campus can be punished under school rules because the disagreements originated on campus. And workplace harassment can lead to employment termination, even if the harassment took place after hours and somewhere other than the office.

So, in my opinion, any private responses to official mailing list posts should be covered under any community expectations and behavior rules we want to enforce.

Cheers,
Ben

3 years ago by xfsgpr@hotmail.com — view source

unread

Wait did somebody actually contact this troll's employer?!

And his/her ISP. these days ISPs are taking these things very seriously
indeed.

--
With over 1.2 billion devices now running Windows 10, customer
satisfaction is higher than any previous version of windows.

3 years ago by Reindl Harald privat — view source

unread

Am 15.01.21 um 00:04 schrieb :
"With over 1.2 billion devices now running Windows 10, customer
satisfaction is higher than any previous version of windows"

OK, your head is full of shit - what is "windows"?

3 years ago by Levi Morrison via internals — view source

unread

Am 14.01.21 um 03:45 schrieb Dan Ackroyd:

If anyone else receives unpleasant emails from him (or from anyone
else), please either:

forward them to the list for all to see.

forward them to myself, if you'd prefer to not have it dealt with in public

besides again: who do you think you are (forward them to myself) - you
confuse different things!

when i write a private mail to someone you have
no business and "forward them to the list for all
to see" is pure bullshit

it's even not permitted by law, if someone feels
insultet he can sue me, but it's not permitted
to publish private communication unasked

Note that while this probably varies by location, it is not well
established. You are better off contacting Dan in private, not
forwarding the email.

The person in question is clearly subverting their ban, and is abusive
in private and public communication (bugs.php.net is absolutely
public). I think taking legal action is appropriate, as they haven't
stopped simply because they've been banned.

3 years ago by Chase Peeler — view source

unread

On Thu, Jan 14, 2021 at 9:47 AM Levi Morrison via internals <
internals@lists.php.net> wrote:

Am 14.01.21 um 03:45 schrieb Dan Ackroyd:

If anyone else receives unpleasant emails from him (or from anyone
else), please either:

forward them to the list for all to see.

forward them to myself, if you'd prefer to not have it dealt with
in public

besides again: who do you think you are (forward them to myself) - you
confuse different things!

when i write a private mail to someone you have
no business and "forward them to the list for all
to see" is pure bullshit

it's even not permitted by law, if someone feels
insultet he can sue me, but it's not permitted
to publish private communication unasked

Note that while this probably varies by location, it is not well
established. You are better off contacting Dan in private, not
forwarding the email.

Not a lawyer, but I would think any laws around sharing of private
communications would apply to forwarding it to any third party, whether
that's a distribution group or an individual.

The person in question is clearly subverting their ban, and is abusive
in private and public communication (bugs.php.net is absolutely
public). I think taking legal action is appropriate, as they haven't
stopped simply because they've been banned.

I think one of the "rules" of the group is that replies should not be made
off-list. Now, I think we all make them at times, and there are valid
reasons. However, given that rule, we all know that if we do, we risk that
private reply being brought back into the public forum.

While this person is definitely disruptive and we need to find some way to
deal with them once and for all, part of me actually finds their replies
humorous because they are just SO out there and unwarranted. They take
trolling to a whole new level in my opinion. If we want to avoid possible
legal issues, I think we could still send the replies to the list, after
removing any contact information that is included, and no one would have
any trouble figuring out who it is.

--

To unsubscribe, visit: https://www.php.net/unsub.php

--
Chase Peeler
chasepeeler@gmail.com

3 years ago by Levi Morrison via internals — view source

unread

Am 14.01.21 um 03:45 schrieb Dan Ackroyd:

If anyone else receives unpleasant emails from him (or from anyone
else), please either:

forward them to the list for all to see.

forward them to myself, if you'd prefer to not have it dealt with in public

besides again: who do you think you are (forward them to myself) - you
confuse different things!

when i write a private mail to someone you have
no business and "forward them to the list for all
to see" is pure bullshit

it's even not permitted by law, if someone feels
insultet he can sue me, but it's not permitted
to publish private communication unasked

Note that while this probably varies by location, it is not well
established. You are better off contacting Dan in private, not
forwarding the email.

Not a lawyer, but I would think any laws around sharing of private communications would apply to forwarding it to any third party, whether that's a distribution group or an individual.

Correct. Forwarding the communication should be avoided. If you are
abused off-list by this person, contact Dan in private. You can work
together to file a join suit or something, but forwarding the email is
risky.