Mastodon Feed: Posts

Reblogged by isagalaev ("Ivan Sagalaev :flag_wbw:"):

wdormann@infosec.exchange ("Will Dormann") wrote:

Andres Freund singlehandedly averted a crisis for the entire Linux ecosystem and more.
He is a hero, and we should take a moment to think about where we'd all be if he were not the inquisitive chap that he is.
https://mastodon.social/@AndresFreundTec/112180406142695845

Reblogged by kornel ("Kornel"):

Wifiwits@infosec.exchange ("Matt Seymour") wrote:

Yet another insight from my personal biographer, poorlydrawnlines.com

Attachments:

• Cartoon in the first and second lane a man says “I want to do everything, but where do I start” in the third he’s lying in the floor of an empty room with the caption “does nothing” (remote)

Reblogged by keul@fosstodon.org ("Luca Fabbri"):

castarco@hachyderm.io ("Andreu Casablanca 🐀") wrote:

Some #git config values I always set in my #dev environments:

```
# For better rebasing experience
git config --global rerere.enabled true

git config --global rebase.updateRefs true

# For better diffs & conflict resolution
git config --global diff.algorithm histogram

git config --global merge.conflictstyle zdiff3
```

Reblogged by keul@fosstodon.org ("Luca Fabbri"):

jwildeboer@social.wildeboer.net ("Jan Wildeboer 😷:krulorange:") wrote:

Again the FOSS world has proven to be vigilant and proactive in finding bugs and backdoors, IMHO. The level of transparency is stellar, especially compared to proprietary software companies. What the FOSS world has accomplished in 24 hours after detection of the backdoor code in #xz deserves a moment of humbleness. Instead we have flamewars and armchair experts shouting that we must change everything NOW. Which would introduce even more risks. Progress is made iteratively. Learn , adapt, repeat.

Reblogged by jsonstein@masto.deoan.org ("Jeff Sonstein"):

Lightfighter@infosec.exchange wrote:

Aurora outdoor access improves with trail work, wheelchairs | Aurora | denvergazette.com
https://denvergazette.com/aurora/aurora-outdoor-accessibility-wheelchairs-high-line-canal/article_f182a418-ed23-11ee-a73e-9fc22f62b52a.html

Reblogged by jsonstein@masto.deoan.org ("Jeff Sonstein"):

tzimmer_history ("Thomas Zimmer") wrote:

“Project 2025” would transform America into a much nastier, much more dangerous, much more hostile place for anyone who dares to deviate from the white Christian patriarchal order. Those are the stakes.

Please consider subscribing:

https://thomaszimmer.substack.com/p/what-makes-project-2025-so-dangerous

Attachments:

• Screenshot of my latest “Democracy Americana” newsletter - the third and final part of a series about “Project 2025”: “What Makes ‘Project 2025’ So Dangerous: Will the Right be able to implement these radical plans? Is Trump on board? What happened to traditional conservatism? Let’s tackle some of the key questions surrounding ‘Project 2025’”

nadim@symbolic.software ("Nadim Kobeissi") wrote:

Full timeline of the xz backdoor.

This saga will raise the question: how can we reckon with the reality that some laissez-faire FOSS projects will one day become of massive national security import, while still being maintained by hobbyists/enthusiasts?

https://boehs.org/node/everything-i-know-about-the-xz-backdoor

Reblogged by nadim@symbolic.software ("Nadim Kobeissi"):

AndresFreundTec wrote:

I was doing some micro-benchmarking at the time, needed to quiesce the system to reduce noise. Saw sshd processes were using a surprising amount of CPU, despite immediately failing because of wrong usernames etc. Profiled sshd, showing lots of cpu time in liblzma, with perf unable to attribute it to a symbol. Got suspicious. Recalled that I had seen an odd valgrind complaint in automated testing of postgres, a few weeks earlier, after package updates.

Really required a lot of coincidences.

Reblogged by jsonstein@masto.deoan.org ("Jeff Sonstein"):

Lightfighter@infosec.exchange wrote:

Polar vortex is 'spinning backwards' above Arctic after major reversal event | Space
https://www.space.com/earth-polar-vortex-spinning-backwards-above-arctic-reversal-event

Reblogged by jsonstein@masto.deoan.org ("Jeff Sonstein"):

jbigham@hci.social ("Jeffrey P. Bigham 🔥🔥") wrote:

today, i got an email from Apple, telling me that a subscription I had purchased that I no longer want was going to automatically renew, with a clear link to cancel. STRANGELY, subscriptions purchased outside of Apple never let me know this or make it easy to cancel.

Reblogged by jsonstein@masto.deoan.org ("Jeff Sonstein"):

arstechnica ("Ars Technica") wrote:

The entire state of Illinois is going to be crawling with cicadas

And the land shall feast on their dead.

https://arstechnica.com/science/2024/03/the-entire-state-of-illinois-is-going-to-be-crawling-with-cicadas/?utm_brand=arstechnica&utm_social-type=owned&utm_source=mastodon&utm_medium=social

Attachments:

• 3809b97a790236ea.jpg

jsonstein@masto.deoan.org ("Jeff Sonstein") wrote:

https://apnews.com/article/tennessee-republican-tsu-university-f43a6f2f769c4a6a464c43c4ae0a22dc

jsonstein@masto.deoan.org ("Jeff Sonstein") wrote:

back from my usual Saturday AM shift walking doggos at the #ROC City Pound... the place is overflowing with sweet critters who need homes.

cstanhope@social.coop ("Your friendly 'net denizen") wrote:

(That emoji should be interpreted as the laughter that flows from a dark sense of humor.)

cstanhope@social.coop ("Your friendly 'net denizen") wrote:

Since I avoid the generative ML stuff and I was busy yesterday, it hadn't occurred to me until just now that these CoPilot and their ilk are being trained on code with backdoors included. 😆

Reblogged by cstanhope@social.coop ("Your friendly 'net denizen"):

requiem@hackers.town ("requiem 🏴") wrote:

If you (or someone you know, boosts appreciated!) have used CrowdSupply (or considered using it but didn’t) to sell a product I would love to hear about your experience.

I’m getting more serious about finding my “next thing” and I’d love to find a way to make that one of my own projects.

rmrenner ("The Old Gay Gristle Fest") wrote:

The most recent humble choice thing includes a -20% coupon for Dragon's Dogma 2. I'm not usually in a big hurry to play new AAA releases but I'm kinda tempted

Reblogged by slightlyoff@toot.cafe ("Alex Russell"):

lcamtuf@infosec.exchange ("lcamtuf :verified: :verified: :verified:") wrote:

OK, so here's my slightly more eloquent take on the xz thing, complete with a zinger closing paragraph:

https://lcamtuf.substack.com/p/technologist-vs-spy-the-xz-backdoor

collinsworth@hachyderm.io ("Josh Collinsworth") wrote:

Billy CRUDapp

...is this anything?

fromjason ("fromjason.xyz 🖤") wrote:

Working on my newsletter and I can't decide on a theme. I know it's a curation newsletter where I share links from around the web. But I'm debating if should do the #oldweb exclusivity or newer stuff. Or both?

What do you think?

collinsworth@hachyderm.io ("Josh Collinsworth") wrote:

You know that little chat pop-up we all hate? The one that always appears in the lower right corner of every website, with a hyper obnoxious prompt like, "chat now with an enterprise sales specialist!"? The one we all wish we'd just never see again and would happily install a browser extension just to block forever?

Yeah, that little AI sparkle button is WAY more obnoxious than that now.

Reblogged by collinsworth@hachyderm.io ("Josh Collinsworth"):

Alice@beige.party ("Alice McFlurry, BBW/WAP :bc:") wrote:

Sorry for any confusion that resulted from me updating my profile pic, but I had to ensure it matched my LinkedIn profile pic.

Reblogged by slightlyoff@toot.cafe ("Alex Russell"):

tri_becca90 ("Rebecca Rivers") wrote:

You know what I would love to watch a 4-hour documentary on YouTube about?

Trends in mobile ads.

There have been a bunch of different “phases” they have gone through.

Do you remember when Mobile ads started to try to get you to interact with the ads?

Or would include weird puzzles that weren’t actually in the game and then they had to shoehorn them in?

It would also be interesting to compare mobile ad trajectories to web ads.

jsonstein@masto.deoan.org ("Jeff Sonstein") wrote:

one plodding step at a time

Attachments:

• tech demo initial commit to github (remote)

collinsworth@hachyderm.io ("Josh Collinsworth") wrote:

Roasts should be a more normal thing than they are, because we all know someone who could really use a nice, firm, good-natured "what the actual fuck are your shit choices right now?"

rmrenner ("The Old Gay Gristle Fest") wrote:

Consoles from after the introduction of HDMI but before game companies got used to the idea of gameplay streaming are such a hassle to get video out of

rmrenner ("The Old Gay Gristle Fest") wrote:

Boo, I just discovered that my HDMI splitter can successfully remove HDCP protection from the PS3's output but not the Vita TV

Reblogged by cstanhope@social.coop ("Your friendly 'net denizen"):

eb@social.coop ("Evan Boehs") wrote:

https://boehs.org/node/everything-i-know-about-the-xz-backdoor

I have begun a post explaining this situation in a more detailed writeup. This is updating in realtime, and there is a lot still missing.

#security #xz #linux

Reblogged by keul@fosstodon.org ("Luca Fabbri"):

olly1240@livellosegreto.it wrote:

@ed @kenobit Ho un'importante segnalazione per tutti gli utenti debian/fedora, in generale tutti quelli che usano APT, RPM, e Linux. È stata trovata una backdoor in liblzma che coinvolge openssh e forse altri esegubili. Al momento ha un CVSS score di 10.0 (RedHat). Tutte le versioni dopo la 5.6.0 presentano il payload ma non l'exploit. https://www.openwall.com/lists/oss-security/2024/03/29/4
Il link contiene anche uno script per verificare la vulnerabilità

Reblogged by keul@fosstodon.org ("Luca Fabbri"):

guidostevens@kolektiva.social ("Guido Stevens") wrote:

Looks like the XZ vulnerability was introduced 5 weeks ago. That means it shouldn't be on any of my systems. Phew! 😅

Let's see how this story unfolds. #infosec

https://www.openwall.com/lists/oss-security/2024/03/29/4