Latest Blog Entries

• The Decline of Western Video Games & Movies

  The Critical Drinker is right here when he points out that the demise of Bioware is more than a classic case of “go woke, go broke”, although that is of course part of it. As he correctly analyses, the Western video game industry is falling apart for the same reason that Hollywood is: For decades now, both have prioritised technology — and the way a movie, TV show or game looks — over its story. They have failed to understand that not looks is what makes a fiction engaging, but the story. That doesn’t mean the story isn’t enhanced by looks, but everything inevitably falls apart if your story is bad in the first place. And of course, if you already have bad writing, it doesn’t help if you further foul it up with condescending political messaging nobody enjoys.

  Bioware was hit especially hard by this, because story was essential to their success. Their legendary games all set themselves apart by their story first and foremost. They knew this. But still they got swept up in the idea that better technology would make for a better game no matter what and they hired writers that didn’t prioritise what was fun for players, but what they wanted to proselytise about. And they paid the price. The same thing is happening all over the creative industries as we speak.

  ---

• The Whole Story Behind PHP2Shell

  At the end of 2006, PHP security expert Stefan Esser left the PHP Security Team¹. That was almost twenty years ago. Esser left because he said he “found it impossible to improve PHP security from within”. Any kind of critical discussion of PHP’s security model would cause one to be shunned by the other developers, he said. Instead of making the software better, people in the project would concentrate on semantics, calling him rude and then ignoring his fixes, Esser reported. He left the project in frustration.

  As it turns out, in 2004, Esser had found one of the underlying problems that would later cause the PHP2Shell debacle. In July of that year, he reported on a fix for it. But that, obviously, wasn’t the whole story. As it turns out, the security research company Esser works for now, Calif.io, kept at it and actually discovered the new vulnerabilities in August of this year — apparently shortly before their rival hackers from Wiz did. Here’s the full write-up on the Calif site. Yes, security vulnerabilities have comics now. 🫣

  How did we find this?

  No special harness, or access to models that weren’t generally available to everyone were used in the initial bug discovery. I focused on something I had a background in, knew its vulnerability history well, and held a theory that specific bugs lurk within the codebase. This shows that “know your target” is still as applicable as ever, even in the LLM dominated VR age. No model is simply capable of unearthing “all bugs” with simple prompts. At least for now.

  ---

• The Security Situation at PHP

  I’m really glad I stopped using PHP years ago. You really wouldn’t want to be caught running it right now. Not only because of PHP2Shell, that seems to be only the tip of the proverbial iceberg. This is from the PHP projects offical news release on that monumental security issue:

  In 2024, PHP underwent its first external security audit in years. The PHP Foundation secured funding from the Sovereign Tech Agency to organize this audit through OSTIF, and it was carried out by Quarkslab. While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem behind CVE-2026-109618. In 2024, a potential exploit for the OOM problem was theorized, but no concrete vectors were found and other concrete issues with clear impact overshadowed these concerns.

  Why doesn’t this project have regular external security audits? It runs 70% of the web, for fuck’s sake! And what do you mean you knew of this problem two years ago but couldn’t figure it out? What are the chances that other people did and just didn’t tell you? I am now almost completely convinced that these vulnerabilities must have been exploited as zero days for years. This is an absolute disaster for this project.

  To fix the OOM problem, the PHP security team developed several competing approaches, but each came with its own trade-offs: backward compatibility breaks, new denial-of-service potential, or requiring changes to many third-party extensions which seemed impossible to coordinate. The PHP security team, operating on consensus, struggled to choose between these and feared the repercussions of shipping the wrong choice. Combined with the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months. We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources. The security team has since started changing its processes, and that work continues, so that decisions can be made by majority and compromises are encouraged.

  Maybe give your security team more resources then? Nah, features have always been more important than security to these guys. Let’s face it. People … stop using PHP!

  

  Thanks to John Chandler, who alerted me to this post by the PHP people!

  ---

• Go Woke, Go Broke

  Bioware is gone. EA has shuttered the studio. This comes as no surprise. When you ignore who your core audience is, fill your studio with developers and executives who prioritise political messaging over delivering games that have engaging stories and are fun to play, this is what happens. It’s not like streamers and youtubers haven’t told you this would happen literally for years now. But you refused to listen.

  If you go from Dragon Age II, in my opinion one of the best video games ever made, to an abomination like Dragon Age: The Veilguard, what exactly do you expect? Mark Kern isn’t the only one who remembers. We all do. Gamers remember.

  This meme is pretty harsh, but it is equally true

  This is just one symptom of an industry, and their dependent lackeys among the press, who defiantly declared after Gamergate that “gamers are dead” and then quickly proceeded to huff some more of their own farts, before also blowing off their other foot with the shotgun. As much as I love the Bioware games of old — which I will continue to play and cherish, by the way — these people deserve what they had coming. Capitalism is so much on the retreat in business these days that you can get away with a lot, but it seems total and utter suicidal stupidity is still being punished. Which is good!

  ---

→ See all blog posts or subscribe to the blog's RSS feed