jnxx

7 ms·

31.
by jnxx 3y ago
Yes, I think if a project has backdoors and its old maintainers are unable to review them, I am more critical than with normal projects. As said, compression is used everywhere and in embedded systems, it touches a lot of critical stuff. An
32.
by jnxx 3y ago
> Why would they even do that More layers of obfuscation. For example in order to be able to attribute the backdoor to a different party. It is of course also possible that Lasse Collins is a nice real person who just has not been able t
33.
by jnxx 3y ago
The thing is there are two possibilities: 1. An important project has an overburdened / burnt out maintainer, and that project is taken over by a persona who appears to help kindly, but is part of a campaign of a state actor. 2. A stat
34.
by jnxx 3y ago
If a project targets a high-profile, very security sensitive project like the linux kernel from the start, as the archived tukaani web site linked above shows, it is justified to ask questions. Also, the exploit shows a high effort, and a h
35.
by jnxx 3y ago
It is not just systemd which uses xz. For example, Debian's dpkg links xz-utils.
36.
by jnxx 3y ago
One scenario for malicious code in embedded devices would be a kind of killswitch which listens to a specific byte sequence and crashes when encountering it. For a state actor, having such an exploit would be gold.
37.
by jnxx 3y ago
If this is a conspiracy or a state-sponsored attack, they might have gone specifically for embedded devices and the linux kernel. Here archived from tukaani.org: https://web.archive.org/web/20110831134700/http:&#x2
38.
by jnxx 3y ago
The web of trust is a really nice idea, but it works badly against that kind of attacks. Just consider that in the real world, most living people (all eight billions) are linked by only six degrees of separation. It really works, for code
39.
by jnxx 3y ago
And, Joey Hess has counted at least 750 commits to xz from that handle. https://hachyderm.io/@joeyh/112180715824680521 This does not look trust-inspiring. If the code is complex, there could be many more exploits hidin
40.
by jnxx 3y ago
There is also a variety of new, parallelized implementations of compression algorithms which would be good to have a close look at. Bugs causing undefined behaviour in parallel code are notoriously hard to see, and the parallel versions (wh
41.
by jnxx 3y ago
The time stamp of a git commit depends on the system clock of the computer the commit was checked in. This cannot be checked by github & co (except that they could reject commits which have time stamps in the future).
42.
by jnxx 3y ago
> They want to attack this company or this group of individuals. But someone who backdoors such a core piece of open source infrastructure wants to cast a wide net to attack as many as possible. The stuxnet malware, which compromised Sie
43.
by jnxx 3y ago
I am thinking more in so-called rubberhose cryptoanalysis. https://xkcd.com/538/
44.
by jnxx 3y ago
> And in general, the build system of a large project is doing a lot of work and is considered pretty uninteresting and obscure. Random CMake macros or shell scripts would be just as likely to host bad code. Build systems can even have u
45.
The Fireplace Delusion (2012)(samharris.org)
3 points by jnxx 3y ago|0 comments
46.
by jnxx 3y ago
> What is "capabilities" supposed to mean? "Is this app allowed to read your contacts?"
47.
by jnxx 3y ago
What could be a different case is Clojure. But I am not sure, and the performance characteristics of Clojure make it well-suited for server-style concurrency, but not so much for high-performance parallelism.
48.
by jnxx 3y ago
> COBOL > MATLAB > MUMPS One of each uglier than the one before. But: Is there something we can learn from these examples? Are there good reasons for these languages being adopted? And are the Racket designers with their approach o
49.
by jnxx 3y ago
Isn't Rust really well suited as the main extension language of functional-preferring, strongly-dynamically-typed, interactive languages, such as Racket, Guile, OCaml, or F#?
50.
Edward A. Lee: The Problem with Threads (2006) [pdf](www2.eecs.berkeley.edu)
1 points by jnxx 3y ago|0 comments
51.
by jnxx 3y ago
I am thinking more and more it would be a pretty good idea to keep the place habitable where we are now. Besides other things, it is quite beautiful here.
52.
by jnxx 3y ago
> most definitions of life require that it be made of cells Is there a deeper reason for that?
53.
by jnxx 3y ago
How we would call such depends how you define and understand life. If one defines it very widely as a dynamic dissipative process in an open thermodynamic system which organizes matter and energy, reacts to its surroundings, can reproduce i
54.
by jnxx 3y ago
Maybe it would have a heartbeat period of 11 years?
55.
by jnxx 3y ago
> The main reason I use Linux is because it's the only platform that actually respects me as user. Exactly this. And one things proprietary software nowadays sucks big is being economical with my attention and not wasting it. Imagin
56.
by jnxx 3y ago
> While some Linux purists dislike containerized application installation programs such as Flatpak, Snap, and AppImage, developers love them. Why? They make it simple to write applications for Linux that don't need to be tuned just
57.
by jnxx 3y ago
I think it is always wise to constrain unneeded dependencies. And this counts even more in embedded systems. But on the other hand, programming artefacts, languages and their library systems compete in terms of features, which will usuall
58.
by jnxx 3y ago
> Genuinely interested: what do people think of their tons of third-party dependencies in Rust? Here are three things I think, and they have in fact nothing to do with Rust: 1. The easier it is to add dependencies, the more dependencies
59.
by jnxx 3y ago
Now, make it to generate a really good, comprehensive, concise book on how to write complex CMake configurations and you will be a hero ;-)
60.
by jnxx 3y ago
> Which tbh is a bad thing. Just because change a doesn't textually touch change b doesn't mean they don't interact. A good example for this is code which grabs several locks and different functions have to do that in the

More ›