xorcist

42 ms·

781.
by xorcist 3y ago
The situation certainly wouldn't be helped by the fact that this exploit targeted the systemd integration used by Debian and Red Hat. OpenSSH developers aren't likely to run that since they already rejected that patch for the incr
782.
by xorcist 3y ago
To be fair neither does sshd. But I'm sure someone somewhere has a good reason for gcc to write status via journald or something like that? There's however no reason to limit yourself to gcc for a supply chain attack like this. In
783.
by xorcist 3y ago
OpenSSH has a much smaller attack surface, is thoroughly vetted by the best brains on the planet, and is privilege separated and sandboxed. What VPN software comes even close to that? The only software remotely in the same league is a strip
784.
by xorcist 3y ago
Is that version truly vetted? "Jia Tan" has been the official maintainer since 5.4.3, could have pushed code under any other pseudonym, and controls the signing keys. I would have felt better about reverting farther back, xz hasn&
785.
by xorcist 3y ago
People are prematurely celebrating this did not reach a stable distribution. But we haven't seen the full fallout yet. How many debian-developer's machines have been compromised, for example?
786.
by xorcist 3y ago
From what is publicly known at the moment, yes. Note however that xzutils home page says that "versions 5.2.12, 5.4.3 and later have been signed with Jia Tan's OpenPGP key" so there would have been plenty more opportunities.
787.
by xorcist 3y ago
"Those countries in Europe" is perhaps a bit of an understatement. Any justice system that practices capital punishment is considered so dysfunctional that any plans on joining the European Union is out of the question. This is al
788.
by xorcist 3y ago
Identifiers aren't short in C (or any other language) because disk storage is expensive but because readability suffers with long identifiers. The example here is very much C-style (short, lowercase, underscore). The list of argument i
789.
by xorcist 3y ago
That is not how paging works. The swap area is also a cache in every sense of the word. And the kernel will swap out pages that clearly are accessed less frequently than another page, even if that page is the buffer cache. When used like th
790.
by xorcist 3y ago
Which is a bit surprising because they make their money from the AI/LLM hype now, which presumably is all Linux. So Linux should be a priority for them, just not on the desktop. But the step should be small.
791.
by xorcist 3y ago
That argument is questionable. C is trivial. The PC architecture is not, and the Linux architecture absolutely not. What makes kernel programming hard is that there is a lot of knowledge that must be internalized, exactly how the DMA works
792.
by xorcist 3y ago
That bothers me every time there was an incident and someone explains that "this organization has under-invested in cybersecurity". From my perspective, it is just as likely that over investing in cybersecurity is problematic. No
793.
by xorcist 3y ago
> actions are taken to ensure it doesn't happen again That sentence captures most incident related problems well. While I love a culture where mistakes are owned, care must be taken to not end up in a culture where nothing is ever g
794.
by xorcist 3y ago
Because you want to be able do report your taxes documents to the tax office? It's one of those things that sound so simple on paper, but every time someone does that trivial thing and not make documents available to the web browser, u
795.
by xorcist 3y ago
Swap (paging) can also help performance. It exists for a reason. Having metrics on paging helps you tune your application, so it is also good for observability. It a feature that can be misused, but it is not a good recommendation to turn i
796.
by xorcist 3y ago
> If an OS+apps' working set exceeds RAM, performance will slow to a crawl in any case That sounds like a misunderstanding how memory is allocated and this may be the root of it. There are many instances where this would be complete
797.
by xorcist 3y ago
There is no sync if the state is the DOM.
798.
by xorcist 3y ago
svk is a tool to do exactly this. You can always copy the actual repo, you have read access to it after all. Something like svk vastly simplifies this workflow and can keep your local copy up to date. Keep in mind that the intended workflow
799.
by xorcist 3y ago
Well, we should be a little fair to cvs and svn. The C in cvs stands for "concurrent" as in the absence of locks. That how they differed from competing products. Lockfiles existed, but were intended to be mostly informative as the
800.
by xorcist 3y ago
You can't commit to a server, obviously, but you can commit to a local directory. You would have needed set one up in advance however. Checkouts are sparse, in git terminology. Commit here approximates to a push in git terminology. The
801.
by xorcist 3y ago
A connected PDA was always a thing. Palm/3Com made phones. HP/Compaq made iPaq phones. Sharp made their Zaurus. The were OEM phones you could get branded. The Qt guys had their Trolltech phone. Everyone wanted to see what phone so
802.
by xorcist 3y ago
It is, strictly as written. The wording, both in the original article and the many rewrites, does not fully explain the problem as intended. The show host not only knows where the prize is, but actively chooses never to reveal the door wher
803.
by xorcist 3y ago
The full height drives were the 8" floppies. They hardly existed anymore in the 90s, not on PC systems. Wikipedia has a nice article with pictures: https://en.wikipedia.org/wiki/Floppy_disk Even if you didn't
804.
by xorcist 3y ago
I doubt many "hard-core cli enthusiasts" desire some sort of digital self flagellation, but instead strive for efficiency. Full screen editors are efficient, and was very quickly adopted when made available. Line editors prevailed
805.
by xorcist 3y ago
Installing F-Droid is not hard. No need for root. In fact, the usual criticism is that it's too easy. There are a number of scary warnings to click through but that's it. Not great for security but the official distribution is goo
806.
by xorcist 3y ago
The line length is hilarious. Press the little book icon (or F9 in Firefox desktop), it fixes this just as it fixes so many other unreadable web sites. Luckily our clients aren't completely strangled yet so this still works. How meta c
807.
by xorcist 3y ago
> Scrum is a worse version of the planning processes it meant to replace! You say this as if it was a coincidence. I'm allowed to say such things. Some of my best friends are scrum masters.
808.
by xorcist 3y ago
I see you haven't worked with Istio, yet. Kidding aside, it is somewhat amusing to see the same discussion as when chef happened repeat itself. Ansible clearly had to take a lot of liberties with the yaml format to make it work in prac
809.
by xorcist 3y ago
Who is complaining? This is confusing. The whole idea about Signal is to compete with mainstream, as well as with the federated, ecosystems by having a single implementation of both client and server, I believe the argument is that only by
810.
by xorcist 3y ago
The Signal devs have been very clear that they consider forked or third party clients freeloaders and will cut them off, sooner or later.

More ›