kzrdude

33 ms·

661.
by kzrdude 3y ago
Don't know the brand unfortunately - I was basic and just asked the workshop to do it, because I don't have the tools to adjust the chain. I just thought it was interesting to me that the mechanic explained to me that they come in
662.
by kzrdude 3y ago
Not food, but I got a new chain for the bicycle today, and they are also teflon-lubricated when you get them (a workshop installed it). It's PFAS everywhere.
663.
by kzrdude 3y ago
sadly, the zstd cli tool links to lzma right now (as installed by some distros) :/
664.
by kzrdude 3y ago
It should be easy to go back to https://snapshot.debian.org/ and one more repository and verify old untainted releases between the two archives.
665.
by kzrdude 3y ago
Certainly, but we need an xz decompressor to read the current debian repo versions for the next decades, when they are oldstable or archived.
666.
by kzrdude 3y ago
Huge effort, because it is the default .deb compressor in Debian for example
667.
by kzrdude 3y ago
I won't pretend I understand it all, but apart from linking only when needed, some explanations have come out how it would have prevented this exploit path. From https://research.swtch.com/xz-script > The effect of
668.
by kzrdude 3y ago
Yes, not having physical media sucks. Physical objects just work better on a human scale, we know where we put them (well..) and how to trade them.
669.
by kzrdude 3y ago
Sounds exciting with the coming features! About trust. I would say, the firmer the structure of configurations is, the more trust I'm giving over to Github vs handling it myself. Is Github actions a neutral VM executor that I can confi
670.
by kzrdude 3y ago
I've enabled "trusted publishing" as it is called for python packages (publishing to cheeseshop/PyPI). However, what they call trusted publishing is just a configuration where PyPI tells github that publishing from a par
671.
by kzrdude 3y ago
And export-subst to insert the current tag or git revision into the archive too. In fact export-subst is powerful enough that there is probably some way to create an exploit triggered by a particular payload inside a commit or tag message?
672.
by kzrdude 3y ago
We can use tarballs - they are useful as signed artifacts, but only if we verify that they are reproducible.
673.
by kzrdude 3y ago
I looked at this again and I think it implies that there /would/ be a way but it's not really standardized how to do it yet? https://github.com/systemd/systemd/pull/31131#issuecomment-1...
674.
by kzrdude 3y ago
Yes, but there was some way to put them back my elf metadata
675.
by kzrdude 3y ago
zstd has improved a lot since it was brought in under the facebook roof, but those are incremental changes, it already existed before then. Here's the good old blog about that http://fastcompression.blogspot.com/
676.
by kzrdude 3y ago
systemd merged a change to using dlopen for compression libraries recently https://github.com/systemd/systemd/pull/31550 which is a safer linking method in that sense.
677.
by kzrdude 3y ago
libc is kind of special, but surely many language environments have different standard lib implementations? Java has OpenJDK and Oracle JDK.
678.
by kzrdude 3y ago
It's in an autoconf style compile test. The compile or not of the snippet is being tested, unfortunately. This just decides the configuration, doesn't stop the build.
679.
by kzrdude 3y ago
It's ironic to me to say that C has no standard library while at the same time libc is one of the most important libraries that most programs on an installed system can't go without. So it has one, but it's small. It has a fe
680.
by kzrdude 3y ago
And sometimes 128-byte because the some part of the cache system is reading two cache lines at a time in contemporary x86-64 if I understand correctly.
681.
by kzrdude 3y ago
> “here are three interns doing two years in gov.uk. They will help for the next 2 years Having temp workers come and go into all kinds of various open source projects.. does that help? :)
682.
by kzrdude 3y ago
It's weird now that "it's right there in the open", Listed among the most recent commits there is "update two test files" https://git.tukaani.org/?p=xz.git;a=commitdiff;h=6e636819e8f... And it&
683.
by kzrdude 3y ago
Is it that easy? I figured he'd face an uphill battle himself - people might not trust him either, by association, or by fear that his accounts have been compromised (and are now impersonating him.)
684.
by kzrdude 3y ago
Because of the exploit, so, why should we use configurations in production that were not covered by these tests?
685.
by kzrdude 3y ago
Jia Tan "cleaned up" in all their ZSTD branches some hours ago, probably hiding something https://github.com/JiaT75/zstd/branches/all
686.
by kzrdude 3y ago
In various places they say Lasse Collin is not online right now, but he did make commits a week ago https://git.tukaani.org/?p=xz.git;a=summary
687.
by kzrdude 3y ago
There are suggestions to roll back further
688.
by kzrdude 3y ago
Makes me wonder if he's an owner of the github organization, and what happens with it now?
689.
by kzrdude 3y ago
Thanks for the info, the filename thing sounds like a problem, one aspect of the epoch system doesn't work for the purpose then.
690.
by kzrdude 3y ago
Vim had this feature for years. But it took until I tested lazyvim (neovim distribution of plugins) that makes session restore so easily accessible, that I now rely on it.

More ›