Just as food for thought, there has also been an idea in the opposite direction - decentralize voting even more

Maybe https://getcroc.com/ ?

I’m afraid it might be hard to have open source reviews without some amount of the thing you mention. But at least they seem to be aware of the problem (first point in that link)

I think the button was grayed out on Fennec but I haven’t had the time to dig in

EDIT: on mobile, one can use MapComplete with OSM account

No, this is a cross-post of https://piefed.zip/c/microblogs/p/1936360/you-can-now-write-and-read-open-reviews-on-any-website-with-our-new-browser-extension-for

That is my understanding too. But then when I was reading the article, there was a line somewhere that in order for the exploit to be successful, the server needs to be using eval

I guess nearly everybody has installed the patch by now

I admire your belief ;)

https://php2shell.censys.com/

ATM almost 80% of scanned services are still vulnerable. Considering that **About 54% of PHP services hide their version** and are not counted as affected or patched.it doesn’t look too good

Yes, but from the page I linked

One really amusing thing in common with most of these "PoC"s is that they lean on “LFI”, or local-file-inclusion, to make the vulnerability. In non-php terms, their exploit chain requires the server to already have a severe code-level vulnerability.

It’s not rare for PHP apps to be fucked in some sense, but requiring the server to have an existing vulnerability where users could cat /etc/password is an insane pre-requisite. If you need this, this does not make this a severe bug.

For sure that this is still a bug that should be patched. But I do remember “don’t eval on user sent stuff” rule. Or is this really prevalent in PHP ecosystem?

Judging by how the post feels, I is fitting here

Lemmy and history, no. On Lemmy you can see comments from Mastodon and posts (toot with a Lemmy community pinged inside. Which is rarely done but happens). But not the toots themselves
Piefed now allows to directly follow accounts (similar to Mastodon, Friendica, etc) and you can start getting the new toots after following an account https://piefed.zip/c/microblogs

Thing is, Fediverse is not a product

From server’s perspective the only difference between those is the user-agent. Traffic is the same

https://en.wikipedia.org/wiki/Slashdot_effect but people were going in, looking at the link, sometimes overwhelming the server