kijin

36 ms·

511.
by kijin 3y ago
Git repos only vanish if they have no clones. For the purpose of accountability, the "official" repo is not more privileged than any other clone that retains the same history, and can be verifiably recreated from any clone if it i
512.
by kijin 3y ago
> Git history can be changed with a simple command and is unreliable. Not if other people have cloned your repo. That's the whole point of having a distributed VCS. Your repo is no longer the single source of truth because other rep
513.
by kijin 3y ago
You never have full control over a repository that can be cloned by others. Sure, you can rewrite the history, but anyone who has been pulling from your repo will notice the conflict. Whether you can trust the developer is beside the point.
514.
by kijin 3y ago
What makes maintainers of major distros still rely on questionable tarballs to build packages? It's not as if these essential programs don't have a public, authoritative git repository. Is it because of inertia, because we've
515.
by kijin 3y ago
Most of his well-known projects have public git repositories that you can clone, inspect, and contribute to.
516.
by kijin 3y ago
To clarify (1), we should not be exchanging tarballs, period. Regardless of whether it's different from what's in the source repository. It's 2024, not 1994. If something masquerading as open-source software is not committed
517.
by kijin 3y ago
> you will often not be able to change the time without adding latency, i.e., withholding commits and thus delaying project development -- and even then, getting it right every time is hard. Someone with access to the right machines coul
518.
by kijin 3y ago
In practice, it's a non-issue for anyone using a stable version of a major Linux distro, such as Ubuntu 22.04 LTS or RHEL/Alma/Rocky 9. The liblzma in those distros were cut and frozen long before our suspect began to have se
519.
by kijin 3y ago
Well, in this case it's even worse. The "community" here in all likelihood was overrun with sock puppets of a malicious state-level actor.
520.
by kijin 3y ago
Not everyone can take time off from their day job just because somebody paid them a nominal amount of money. Besides, the maintainer in this case was already taking time off regularly, not to work on xz, but to get away entirely from any ki
521.
by kijin 3y ago
Tired maintainers have no way to distinguish one from the other, that's the problem. Even if we say "no payment, no customer," it won't prevent determined attackers from paying significant amounts of laundered money in o
522.
by kijin 3y ago
Dude is a developer just like the rest of us. We all try to write clever code from time to time, but at other times write sloppy crap. Especially if there's a boss insisting on a tight deadline.
523.
by kijin 3y ago
Jia Tan tried to get his backdoored XZ into Ubuntu 24.04 just before the freeze, so that makes sense. Now is about the right time to get it into Fedora if he wants to backdoor RHEL 10, too. But I don't think valuable government targets
524.
by kijin 3y ago
Depends on what you mean by "stable". A distro with known-broken packages can be "stable" in a sense that its brokenness is reproducible with every new container you spin up, and therefore can be reliably worked around.
525.
by kijin 3y ago
The article does a good job explaining why GitHub won the developer mindshare, but there was also end user mindshare. Unlike GitHub, where the source code is front and center, SourceForge always prioritized showing a project introduction pa
526.
by kijin 3y ago
Debian's development model actually seems to hit a sweet spot between "everyone runs LTS" and "everyone is cannon fodder". Stable is LTS, sid is cutting edge, and testing is somewhere in between. You can choose the
527.
by kijin 3y ago
My current hypothesis is that the attacker(s) deliberately chose a Chinese-sounding name to make people jump to conclusions. A sophisticated state actor would be no stranger to making their actions look like somebody else's. Or maybe t
528.
by kijin 3y ago
Packages in "stable" versions get bugfixes, too. How often obviously depends on the maintainer, but anything marked as a security issue upstream tends to be patched fairly quickly. On the whole, I would assume that someone who mai
529.
by kijin 3y ago
Yes, they're obviously free to do business (or not) with whomever they want for any reason, but there should be a way to end the relationship without the unilateral threat of confiscating your property. This is going to become a bigger
530.
by kijin 3y ago
> The user ... was unable to access their account until they accepted the new ToS This kind of behavior should be illegal. They're holding your property (data) hostage. Just a few weeks ago, one of my clients had their Vultr account
531.
by kijin 3y ago
Cloudflare's license grant is quite appropriate because the whole point of a CDN is to make copies of your content and cache them closer to your users. Cloudflare also provides numerous tools that modify, and create derivative works of
532.
by kijin 3y ago
Yep, returning the wrong HTTP status code is going to confuse a lot of search engines, chat app link previews, and other automated consumers of your SPA, even if you subsequently display the correct error page.
533.
by kijin 3y ago
One can always find counterexamples in a large city. Meanwhile, the one lame station you mentioned that serves the 신반포 area is directly connected to the financial district and the airport. And just a couple of blocks away is 고속터미널 station w
534.
by kijin 3y ago
And that's the irony of cars. The more people love to drive, the less lovely the drive becomes.
535.
by kijin 3y ago
That's okay. Not every city needs to be equally car-free. Let people naturally gravitate toward the type of city they want, and we'll actually end up with more diversity than we currently have.
536.
by kijin 3y ago
A strange thing about South Korea is that even the most expensive condos in Gangnam derive a significant part of their value from being close to a subway station ( yeoksekwon ). The millionaires who live there are riding the subway right be
537.
by kijin 3y ago
> In the US, between 50 and 60 percent of the downtowns of many cities are dedicated to parking alone. This is the part I find the craziest about American cities. You are using some of the most valuable parcels of real estate in your cou
538.
by kijin 3y ago
They must have trained their customer support AI with a database stolen from dating sites.
539.
by kijin 3y ago
A pillow doesn't need to be a factory-made product that you buy at a store. Plenty of humans make pillows out of natural objects when sleeping outdoors. I can totally imagine a mountain gorilla using a chunk of wood, or even a body par
540.
by kijin 3y ago
One of my clients a couple of years ago was running a legacy LAMP stack on m5a instances, routinely maxing out the CPUs and bleeding serious money every month. Moved them over to c6i instances with the same number of cores, and CPU utilizat

More ›