Meta tags:
KEYWORDS=derick, rethans, php, php5, xml, xhtml, xml-rpc, soap, blog, weblog;
AUTHOR=Derick Rethans;

Headings (most frequently used words):

shortlink, likes, comments, friday, night, dinner, the, hero, khao, bird, humans, in, llm, loop, life, line,

Text of the page (most frequently used words):
the (161), and (62), xdebug (35), was (31), that (30), with (29), utc (27), jun (25), this (19), have (18), not (18), for (17), would (17), test (16), but (16), were (16), osm (14), from (14), also (13), updated (12), through (11), some (11), issue (11), reports (10), php (9), problem (9), which (9), these (9), all (8), issues (8), use (7), can (7), already (7), code (7), when (7), you (7), been (7), 2026 (6), main (6), github (6), 15th (6), tests (6), only (6), llm (6), they (6), report (6), had (6), dishes (6), more (6), our (6), fish (6), hero (6), derick (5), rethans (5), restaurant (5), fixed (5), add (5), name (5), 16th (5), pub (5), found (5), access (5), security (5), june (5), hard (5), comments (5), has (5), https (5), what (5), humans (5), read (5), did (5), now (5), case (5), either (5), step (5), bug (5), patch (5), where (5), two (5), added (5), well (5), pork (5), curry (5), sauce (5), are (4), 12th (4), runkeeper (4), 14th (4), created (4), shop (4), 20th (4), made (4), tool (4), machine (4), most (4), didn (4), ide (4), time (4), cases (4), provided (4), correct (4), too (4), bugs (4), dbgp (4), files (4), although (4), second (4), instead (4), show (4), debugger (4), could (4), one (4), same (4), out (4), first (4), its (3), walked (3), entrances (3), command (3), request (3), other (3), actual (3), comment (3), attacker (3), runs (3), even (3), ilia (3), likes (3), article (3), short (3), url (3), available (3), drck (3), shortlink (3), think (3), trying (3), tools (3), doing (3), find (3), came (3), much (3), present (3), functionality (3), file (3), resulted (3), last (3), again (3), tested (3), wrong (3), reported (3), variable (3), using (3), suggested (3), three (3), locations (3), memory (3), option (3), very (3), fine (3), commands (3), easily (3), there (3), london (3), bst (3), khao (3), bird (3), mutton (3), chips (3), watermelon (3), salad (3), flavours (3), chose (3), mains (3), wife (3), starter (3), than (3), street (3), friday (3), dinner (3), lamb (3), contents (2), mastodon (2), run (2), merged (2), pull (2), cafe (2), confirmed (2), objects (2), here (2), benches (2), waste_baskets (2), 18th (2), line (2), errors (2), results (2), does (2), crashes (2), potential (2), itself (2), talking (2), thursday (2), filefabrik (2), valid (2), cevenio (2), don (2), get (2), myself (2), needs (2), addressed (2), their (2), patches (2), incomplete (2), always (2), addresssanitizer (2), used (2), lot (2), new (2), another (2), then (2), own (2), way (2), behaviour (2), fix (2), good (2), couldn (2), directly (2), fairly (2), trivial (2), showed (2), debugging (2), protocol (2), uses (2), luckily (2), any (2), problems (2), happen (2), trailing (2), hence (2), making (2), situations (2), trace (2), names (2), profiling (2), file_link_format (2), tracker (2), setting (2), both (2), still (2), third (2), opcodes (2), control (2), socket (2), 2421 (2), deals (2), large (2), skipif (2), else (2), skip (2), make (2), existing (2), follow (2), testing (2), framework (2), picked (2), limit (2), fuzzer (2), letters (2), sure (2), indeed (2), makes (2), four (2), whole (2), like (2), often (2), come (2), yet (2), jasmine (2), rice (2), hung (2), ley (2), shan (2), chicken (2), meatballs (2), spicy (2), menu (2), small (2), medium (2), larger (2), bottle (2), complemented (2), meal (2), served (2), crispy (2), tasty (2), tender (2), many (2), starters (2), thai (2), busy (2), vibe (2), neighbourhood (2), wines (2), com (2), united (2), kingdom (2), night (2), butterflied (2), mackerel (2), barnsley (2), chop (2), pie (2), bun (2), bone (2), sweet (2), roll (2), sourness (2), floor (2), home (2), site, copyright, 2002, rights, reserved, content, policy, 13th, hiked, 7km, 4h4m28s, tagging, bollard, location, 4km, 2h39m37s, wildlife, nature, photography, birdsoffediverse, birdphotography, birds, standing, edge, lake, arundel, wetlands, oystercatcher, parent, chick, strace, expectation, debuginfo, error, 1091, 6km, 1h30m43s, vacant, furniture, estate_agent, office, laundry, pid, able, connect, 1092, merge, branch, xdebug_3_5, 1km, 1h21m33s, trees, balancebeam, entrance, bicycle_parking, butcher, fast_food, ice_cream, 21st, veterinary, life, next, random, previous, human, webring, amazon, wishlist, thanks, consider, rest, bonus, calculated, statistical, key, point, cite, blog, 11th, interesting, downstream, effect, might, shift, how, maintainers, approach, triage, automated, become, routine, baseline, assumption, shifts, probably, need, verify, independently, anyway, changes, workflow, cost, ways, predict, until, living, wednesday, 10th, sean, coates, remi, fedora, redhat, mrmeshok, jer, clarke, garvin, hicking, emanuele, panz, álvaro, gonzález, ˈdraɪv, k8y, spending, work, right, hands, people, know, value, comes, interpreting, quick, writing, causes, reasoning, generated, generally, models, comprehensive, spent, getting, anything, unsuccessfully, worse, without, client, provides, including, reading, system, running, particularly, groundbreaking, fuzzing, less, resources, process, conclusion, surface, open, directory, fail, list, reinvented, works, 2431, write, reproduce, broken, further, developer, named, indicate, static, variables, class, following, isn, 2430, suite, valgrind, help, relied, result, ought, remove, keeping, handled, internal, triggered, configuration, mentioned, accompanying, covered, formatting, link, nor, addresses, incorrect, ends, lone, similar, trace_output_name, 2429, 2427, commit, exhibit, expected, outcome, documented, hadn, realised, argument, function, responsible, reassembling, superfluous, null, real, insofar, reason, cli, binary, generate, breaking, during, otherwise, prevent, bound, happening, ext_stmt, yes, start_with_request, enable, tracing, create, several, order, readable, collect_assignments, 2433, duplicate, focussed, underlying, set, shared, private, gist, volker, part, foundation, effort, ecosystem, team, fourth, parser, handle, empty, packets, correctly, proposed, symptoms, cause, 2424, require, __dir__, utils, inc, check_reqs, win, everywhere, php_os_family, windows, die, linux, symlink, semantics, figure, helpers, argues, shouldn, symlinks, creating, 2423, mostly, wholly, cumbersome, funnily, arbitrary, 64mb, 64kb, suffice, 256, bytes, complained, reads, network, 2422, believe, about, five, seconds, nothing, went, exiting, allocate, array, representing, lower, latin, alphabet, character, range, happily, accept, possible, overwrite, x00, sending, characters, communicate, long, recently, returned, contributor, alshanetsky, forwarding, took, care, flood, blue, reached, helpful, discussing, host, themselves, unnaturally, verbose, alarmist, terms, victim, minimal, sometimes, fixes, them, classified, having, impact, low, solely, rather, mix, assistant, focussing, related, different, sources, methodologies, few, weeks, working, release, tuesday, 9th, loop, bjornw, social, k91, novel, exciting, selected, things, however, wise, suggestion, picking, size, selection, spot, means, plenty, return, visit, reasonably, priced, viognier, fries, topped, braised, burmese, sour, cream, leaves, looked, course, traditional, form, delicious, pineapple, enjoy, juices, contemporary, restaurants, ready, ordered, meat, balls, wrapped, caul, fat, cola, glazed, barbecued, garlic, ginger, said, pungent, caramel, basil, situated, soho, sadly, traffic, around, foodie, perfect, sense, www, khaobird, brewer, w1f, 0sn, k9a, fishfinger, little, pricier, side, food, excellent, staff, friendly, competent, worthwhile, upgrade, white, ochoa, blanco, enjoyed, succulent, mint, server, carrots, special, cooked, tomato, she, thought, slightly, salty, bar, snack, finger, lovely, soft, fingers, hand, resembled, smaller, versions, tartare, salt, seasoned, pickled, cauliflower, green, bean, parts, nice, sharp, delightful, attracting, younger, crowd, ground, floors, above, table, top, dubbed, library, relaxed, hubbub, below, past, idlewild, moved, into, area, years, ago, via, trustcot, arms, maida, operates, under, snacks, british, theherow9, shirland, road, 2js, search, contact, projects, talks, archive,

Text of the page (random words):
home derick rethans home archive talks projects contact search friday night dinner the hero thursday june 18th 2026 18 50 bst 55 shirland road london w9 2js united kingdom https theherow9 com british snacks starters 6 15 mains 25 62 5 wines from 40 the hero has had many names in the past idlewild when i moved into the area 15 years ago via the trustcot arms and the hero of maida it now operates under the name the hero it s a delightful pub attracting a younger crowd on the ground floor with two more floors above doing dinner we had a table on the top floor dubbed the library which provided a more relaxed setting than the busy hubbub of the pub below both of us chose a bar snack as a starter my wife had a fish finger roll the roll was a lovely soft and sweet bun the fish fingers were hand made and resembled smaller versions of the fish in fish and chips the tartare sauce added some salt and sourness to it i had the pork pie as a starter the pork was well seasoned and the pickled cauliflower and green bean parts added some nice and sharp sourness four our mains i enjoyed a barnsley chop succulent lamb on the bone with a mint and lamb sauce it was server with sweet and tender carrots my wife had a whole butterflied mackerel on the bone from the special menu it was well cooked and served with a tomato sauce which she thought was slightly too salty a bottle of a white ochoa blanco complemented our meal well it s a little on the pricier side but the food at the hero was excellent and the staff friendly and competent a worthwhile upgrade to the neighbourhood fishfinger bun 1 4 pork pie 2 4 barnsley lamb chop 3 4 butterflied mackerel 4 4 shortlink this article has a short url available https drck me the hero k9a likes ️ derick rethans comments no comments yet add comment friday night dinner khao bird friday june 12th 2026 16 30 bst 24 brewer street london w1f 0sn united kingdom https www khaobird com thai small dishes 7 4 11 9 medium dishes 11 9 13 4 larger dishes 26 4 27 4 wines from 33 the restaurant is situated on a busy soho street with sadly still some traffic around it has more of a street foodie cafe vibe than a restaurant vibe which makes perfect sense in this neighbourhood as many contemporary restaurants now do the dishes come when they are ready we ordered as our starters some shan meat balls and a watermelon salad the meatballs were made with chicken and wrapped in caul fat they were cola glazed and barbecued with crispy garlic and ginger the flavours were very much new the same can be said for the watermelon salad which was pungent and spicy with a fish sauce caramel with thai basil for our mains my wife chose the mutton fries chips topped with a braised burmese mutton curry served with some sour cream and crispy leaves it looked more like a starter than a main course but it was oh so tasty i picked a more traditional main in the form of the hung ley pork curry this was a delicious and tender curry with fish sauce and pineapple flavours some jasmine rice made sure that i could enjoy all the tasty curry juices too a bottle of viognier complemented our meal well the flavours of the dishes at khao bird although spicy were novel and exciting we easily could have selected a lot of more things from the menu however we were wise not to follow the suggestion of picking two small one medium and two larger dishes that would have been too much we find this is often the case the size of our selection was spot on which means there is plenty to chose from on a return visit it s also reasonably priced shan chicken meatballs 1 5 watermelon salad 2 5 mutton chips 3 5 hung ley pork curry 4 5 jasmine rice 5 5 shortlink this article has a short url available https drck me khao bird k91 likes ️ bjornw mastodon social ️ derick rethans comments no comments yet add comment humans in the llm loop tuesday june 9th 2026 19 00 bst london uk in the last few weeks i have been working through some bug reports for xdebug that resulted in the xdebug 3 5 3 release these bug reports did not come solely from humans but rather from a mix of humans using llm assistant tools focussing on security related problems from two different sources and methodologies although all of these issues where indeed bugs that i now have fixed i don t think any of them can be classified even as having a low security impact but there was a whole host of other issues with these reports the reports themselves can be unnaturally verbose and also fairly alarmist using terms like victim and attacker the tests that were present in the reports were often minimal and sometimes incomplete and so were some of their suggested fixes the humans forwarding the reports took care not to flood the issue tracker with reports out of the blue and reached out to me first they ve also been helpful discussing the reported issues the first four cases were reported by ilia alshanetsky a long time and recently returned contributor to php the first report 2421 deals with sending wrong option characters with commands through the dbgp protocol that an ide and xdebug use to communicate xdebug would allocate an array for 27 of these representing the 26 lower case letters of the latin alphabet and the character what xdebug did not do is to make sure the option letters were indeed in the range a z and would happily accept or x00 this makes it possible to overwrite locations in memory the suggested patch was fine but the test that went with it was very hard to read it didn t use already exiting framework for testing the step debugger either i had to add my own i also believe that this issue could as easily have been found by a fuzzer which i added now as well the fuzzer found the same problem in about five seconds and luckily nothing else either the second issue 2422 complained that there was no limit in the debugger s code that reads commands from the network the patch was mostly fine but the test was wholly cumbersome again it didn t use the already existing testing framework either it also picked a funnily large arbitrary limit of 64mb for dbgp commands where 64kb would easily suffice in most cases 256 bytes would have been fine the third issue 2423 argues that xdebug shouldn t follow symlinks when creating profiling or trace files the patch was ok and trivial but the test was again very hard to read making it hard to figure out what it as trying to do it also did not make use of some existing helpers to skip tests it came up with skipif php if php_os_family windows die skip linux only symlink semantics instead of what is used everywhere else skipif php require __dir__ utils inc check_reqs win the fourth and last issue through ilia 2424 deals with xdebug s control socket functionality where its parser would not handle empty or large command packets correctly the llm proposed patch fixed the symptoms but not the actual cause of this issue the second set of reports were shared with me in a private gist by volker as part of the php foundation s ecosystem security team effort the first one was a duplicate of bug 2421 the test focussed on the control socket functionality instead of the step debugger but the underlying issue and fix were the same the second issue i added as bug 2433 when you enable xdebug collect_assignments with tracing xdebug needs to re create the variable name from several opcodes in order to show this name in a readable way but the issue is not a real time problem insofar this can only happen if you run php code on the command line through the r option and xdebug start_with_request is yes for some reason when php runs code through r the cli binary does not generate ext_stmt opcodes xdebug uses these for breaking during step debugging which would otherwise prevent the out of bound memory read from happening the llm tool also hadn t realised that the third argument to the function responsible for reassembling the variable name was always null and hence superfluous i addressed these both through the same commit and added a test which would not exhibit the problem in most situations either it is still good to have the expected outcome documented another report resulted in two issues in xdebug s tracker 2427 addresses an incorrect memory read if the xdebug file_link_format setting ends with a lone and 2429 a similar report but then for xdebug trace_output_name although the report mentioned three locations the accompanying test only covered one of three situations where this was a problem for trace file names but not formatting link files through xdebug file_link_format nor profiling files the patch it suggested was also wrong as it would remove the trailing instead of keeping it one of three locations where the trailing was not handled was internal only and hence couldn t be triggered by making configuration errors the test that came with this report did not help me trying to show the problem it relied on addresssanitizer to show any problems but i could not get that to happen all the tests through this tool also provided tests that tested that the bug was present and not what the correct result ought to be luckily using the xdebug test suite with the valgrind tool showed the problem a further report 2430 showed a problem if either an ide through the step debugging protocol or a developer directly would request the contents of a variable named the step debugger uses to indicate all the static variables for this class and following that up with a isn t valid the fix was good but i couldn t directly use the test case as it tested for the broken behaviour the test was fairly trivial to write as the reproduce case in the reported test case was correct and the last issue from the second list 2431 again reinvented its own way for doing dbgp tests and also tested that the behaviour was wrong instead of a test to show that it now works even with the code fixed the new correct test would also surface another issue as it would have resulted in xdebug to open a directory as it was a file and then fail conclusion although the llm tools did find bugs they were not particularly groundbreaking some of the bugs would also have been found by fuzzing and used a lot less resources in that process most of the crashes and potential security issues would only be a problem if an attacker didn t already have access to the machine that the code runs on itself or have an ide talking to xdebug already if you have access to the machine you can do worse without these bugs present if you have client access to xdebug through dbgp you would have all the functionality that php provides including reading all files on the file system and running code the generated test cases were generally hard to read or incomplete the patches that the models came up with were not always comprehensive or correct i also spent too much time getting addresssanitizer to do anything unsuccessfully i think i would have been as quick writing these patches and actual test cases myself when provided with the issues causes and the reasoning that was provided i don t think i ll be spending time trying to get these tools to work myself but in the right hands with people that know what they re doing they can find issues that needs to be addressed but the value comes from the humans interpreting their results shortlink this article has a short url available https drck me xdebug llm reports k8y likes ️ ˈdraɪv ️ álvaro gonzález ️ cevenio ️ derick rethans ️ emanuele panz ️ filefabrik ️ garvin hicking ️ ilia ️ jer clarke ️ mrmeshok ️ remi fedora redhat ️ sean coates comments cevenio wednesday june 10th 2026 02 15 utc the interesting downstream effect of this is that it might shift how maintainers even approach triage when automated reports become routine the baseline assumption shifts from this is probably valid to i need to verify this independently anyway which changes the workflow cost in ways that are hard to predict until you are living through it filefabrik thursday june 11th 2026 12 16 utc blog cite most of the crashes and potential security issues would only be a problem if an attacker didn t already have access to the machine that the code runs on itself or have an ide talking to xdebug already for me the key point is does it already have access to the machine or not i consider the rest of the errors found to be a bonus results calculated by a statistical tool thanks for xdebug add comment my amazon wishlist can be found here human made webring previous random next life line created a veterinary 52 04 n 6 10 e osm jun 21st 15 58 utc updated 2 waste_baskets 52 04 n 6 10 e osm jun 20th 18 43 utc updated a pub 52 04 n 6 11 e osm jun 20th 18 36 utc updated a pub confirmed an ice_cream 52 04 n 6 11 e osm jun 20th 18 36 utc updated a fast_food and a pub 52 04 n 6 11 e osm jun 20th 18 35 utc updated a butcher shop 51 53 n 0 23 w osm jun 18th 10 06 utc created 6 benches a main entrance and a bicycle_parking updated 2 main entrances 51 53 n 0 19 w osm jun 16th 13 27 utc created 4 trees a balancebeam and 3 other objects updated 5 benches and 2 waste_baskets 51 53 n 0 19 w osm jun 16th 13 09 utc i walked 7 1km in 1h21m33s runkeeper jun 16th 12 10 utc merge branch xdebug_3_5 github xdebug xdebug jun 16th 08 18 utc merged pull request 1092 github xdebug xdebug jun 16th 08 18 utc use actual pid here as we use that to be able to connect github xdebug xdebug jun 15th 23 32 utc created 2 main entrances updated a vacant shop a furniture shop and a cafe confirmed an estate_agent office a laundry shop and 4 other objects 51 53 n 0 18 w osm jun 15th 14 11 utc i walked 8 6km in 1h30m43s runkeeper jun 15th 13 00 utc merged pull request 1091 github xdebug xdebug jun 15th 09 58 utc php 8 6 fixed test expectation for debuginfo name in error github xdebug xdebug jun 15th 09 07 utc add strace to run xdebug tests php command github xdebug xdebug jun 15th 09 06 utc oystercatcher parent and chick standing on the edge of a lake in the arundel wetlands birds birdphotography birdsoffediverse photography nature wildlife mastodon jun 14th 16 41 utc updated 2 main entrances 51 53 n 0 19 w osm jun 14th 11 27 utc i walked 14 4km in 2h39m37s runkeeper jun 14th 11 20 utc fixed tagging and bollard location 51 51 n 0 14 w osm jun 14th 10 47 utc i hiked 8 7km in 4h4m28s runkeeper jun 13th 09 44 utc updated a restaurant 51 52 n 0 16 w osm jun 12th 19 01 utc updated a restaurant 51 52 n 0 16 w osm jun 12th 19 00 utc updated a restaurant 51 52 n 0 16 w osm jun 12th 18 59 utc this site and all of its contents are copyright 2002 2026 by derick rethans all rights reserved content policy