yrro

8 ms·

61.
by yrro 2y ago
The next version of CVSS needs to add a metric for these kind of bullshit non-vulnerabilities so that we can ignore them at source.
62.
by yrro 2y ago
Internet JSON (RRC 7493) forbids objects to have members with duplicate names.
63.
by yrro 2y ago
there is something called an "IPv4-compatible IPv6 address" and it's exactly the scheme you suggest: the first 96 bits are zero. It doesn't help deal with the billions of devices that only handle a 32-bit address space,
64.
by yrro 2y ago
You have merely re-invented IPv6 but with a 48-bit address space. In your universe you would still have to run dual-stack with IPv4 indefinitely.
65.
by yrro 2y ago
Google do seem to be improving here, with 7 years of support for Pixel 8 and 9, and 5 years for Pixel 6 and 7. Earlier models got 3 years which was barely acceptable.
66.
by yrro 2y ago
(specifically < https://cloudinit.readthedocs.io/en/latest/reference/modules... >)
67.
by yrro 2y ago
Am I crazy or have people lost the ability to read documentation?
68.
by yrro 2y ago
Sourceforge used to have it too!
69.
by yrro 2y ago
Does the Cloud Native PG operator count?
70.
by yrro 2y ago
I actaully didn't realise that foomatic is part of cups-filters now?! On the other hand - it's only 'activated' by cups-browsed, if I understand correctly, at least by the currently disclosed set of vulnerabilities... le
71.
by yrro 2y ago
> Linux doesn't distinguish between trusted LANs [...] and public untrusted LANs Gotta be the annoying and point out here that Linux is a kernel. Fedora Workstation, for instance, has firewalld installed & enabled by default, wh
72.
by yrro 2y ago
I believe you'd still need cups-browsed installed, enabled & configured to accept remote printer broadcasts, _and_ have foomatic installed locally in order to get hit by this. Modern version of cups will basically only talk to &quo
73.
by yrro 2y ago
They don't. cups-browsed is a legacy component that isn't needed on ordinary systems, which outsource printer discovery to an mDNS service such as avahi.
74.
by yrro 2y ago
I believe these vulnerabilities only allow RCE as the 'lp' user (which is able to access parallel ports and USB devices that identify themselves as printers). In addition the process will be confined by MAC policies (e.g., on Fedo
75.
by yrro 2y ago
Bear in mind that the default FedoraWorkstation firewalld policy does not protect TCP/UDP ports >= 1025. Fortunately, in this case, cups-browsed uses port 631/udp :)
76.
by yrro 2y ago
Modern cups discovered printers via mDNS and does indeed automatically create temporary destinations for them. This only works with "IPP Everywhere" printers which are 'driverless', i.e., the risk of doing this is limite
77.
by yrro 2y ago
The purpose of cups-browsed is to listen on a UDP port which allows it to receive broadcasts from legacy cups servers on the local network, whereupon it will talk to cups and configure a local print queue for the printers on the discovered
78.
by yrro 2y ago
If you want to get fired, sure!
79.
by yrro 2y ago
> the entire `cups-browsed` daemon should probably stop existing It's a legacy component that you don't need with modern printers - cups itself only support IPP Everywhere (printer discovery via mDNS) these days.
80.
by yrro 2y ago
You're probably aware of c-ares, if not then check it out unless you really want to write your own. (As an administrator I'm getting a bit tired of working around the differing bugs and behaviour of different resolver implementati
81.
by yrro 2y ago
Local and mote apps using the X11 protocol to connect to a local X server (such as Xwayland) isn't going anywhere.
82.
by yrro 2y ago
"content-type: text/html; charset=UTF-8" but I'm seeing a lot of sequences such as "U+00E2 LATIN SMALL LETTER A WITH CIRCUMFLEX, U+20AC EURO SIGN, U+2122 TRADE MARK SIGN" where there's clearly supposed to
83.
by yrro 2y ago
Printers stopped coming with a USB A-to-B cable many years ago. Who knew that the printer makers were in the right all along?
84.
by yrro 2y ago
Looks like an OK guide. I wouldn't put shares inside /var/lib/samba though. And the second semanage context command looks dodgy, I thought the file path arguments were regular expressions not shell glob patterns? Anyway
85.
by yrro 2y ago
Home plug
86.
by yrro 2y ago
They have somehow mastered the dark art of persuading Openreach to actually fix things
87.
by yrro 2y ago
You'll probably enjoy Jin-Roh: The Wolf Brigade as well.
88.
by yrro 2y ago
See also: swill
89.
by yrro 2y ago
Groff's HTML output is very poor. It's a sad day when it's more convenient to generate postscript and convert to PDF than it is to read the directly generated HTML output... (I know other roffs are available).
90.
by yrro 2y ago
I wouldn't mind all of that if the SQLAlchemy documentation would hide all the types until I mouse over them. Ditto for vim!

More ›