Around 2010, I used to work at an MSP, and once had a customer that ran a custom LAMP stack website for local radio UK stations web presence. It was a bit slow, running on a dedicated physical server, but every time it snowed, the website would 500 out - because of too many requests to the “School Closures” page. The site had no caching other than Apache’s internal cache, but PHP pages could not be cached because “reasons”, and the original developer was “not available”. I optimised their MySQL indexes, increased the number of Apache workers, and it improved the render time per page and number of concurrent connections. Stress testing looked good.

Anyway, some months later, 2AM one snowy morning, I was on call, and it went down again. This was when I discovered the school closures problem. After diagnosing, and then liaising with the customer to discuss the options, I was told “just make it work”. I ended up modifying the PHP script to add some “on spec” caching that saved the HTML to a temp file in ramdisk, and only re-ran the query-and-render code if the cached copy was more than 5 minutes old. It was hacky, but it did the trick, and I was finished by about 4 AM. This hack was later applied at their request to a number of trouble-points in the source tree, as and when things broke.

We recommended adding a Varnish cache, and found a more generalised caching library but they wouldn’t/couldn’t authorise engineering work for this - they were running on a shoestring - and they already had the tech break-fix contract with us, and decided it was sufficient to just spot fix things as they broke rather than fix the root cause.

I left that MSP in 2012, so I don’t know what happened after that, but as far as I know, the site could still be running… unlikely, but possible.

I have my blog address (which goes to my home server) in my Mastodon profile, and every time I post on Masto, my server gets a request from every Mastodon site that federates with my instance - i.e. hundreds of requests. It’s no problem for my server, because my blog is a static site, but for anything that dynamically generates every single page impression (like worpress or joomla), it could be a problem. Caching settings might help, I suppose.

Truth is, though, I get far more traffic from vulnerability scanners and AI crawlers that don’t honour robots.txt (or aren’t yet listed).

To be honest, if a website has no caching of their server-rendered parts, they are also doing something wrong! Very little sites really need to re-render a public page on every view.

@mcc google translate was working offline?

🤡 🥵 💅 ✨

@q @erincandescent @sodiboo @49016 i'm apparently *constantly* wading in hazmat, so the private scalar, obviously

@_elena I just had to read up on that confidence gap.
https://www.girlsschools.org/blog/blog-details/~board/blog/post/the-confidence-gap-myth-what-a-study-of-10000-students-revealed-about-girls-and-confidence

It's pretty shocking. Though I'm not sure whether/how biased this POV presented there is.

⚠️ #SW_ISAC_ADVISORY

Service providers operating PHP-based platforms please take note of PHP critical vulnerabilities, both rated CVSS v4.0 9.2

Major government and ecommerce services have shut down pending the patch. Exploits are already circulating.

Shut your service down now, and ensure it doesn't have Internet access on restart.

A patch is scheduled for Wednesday, 21 October 2026 at 14:00 UTC

0100 AEDT
2300 JST
1600 CST
1500 BST
1000 EST
0700 PST

https://cert.europa.eu/publications/security-advisories/2026-018/

Either publishing server should serve the metadata - although it would be prone to bad actors, so a refetch in the next 0-180 seconds would be appropriate. Or just add a random 0-60 second delay before fetching the data.

@khm Thanks, I'd been meaning to setup policies.json.

Unfortunately, https://github.com/mozilla/policy-templates/issues/709

New Jersey Division of Gaming Enforcement Announces September 2026 Total Gaming Revenue Results https://www.njoag.gov/new-jersey-division-of-gaming-enforcement-announces-september-2026-total-gaming-revenue-results/

@q@glauca.space @49016@catgirl.cloud @r@glauca.space @sodiboo@gaysex.cloud Continuing along to ML-KEM and ML-DSA...

...is your private key a seed value that is hashed to derive the actual private key...
...or the "expanded" (but not fully expanded for Reasons) private key...
...or both!

cryptographers are rightfully mad that the answer is "either or both" when the answer should have been "just the seed" or if we couldn't constrain ourselves to that because of HSMs, "just the seed or the expanded key"

But "both" is definitely the wrong answer. Because what if they're not the same key?!

Llwyn Onn