Skip to main content

elrido reshared this.


reshared this

in reply to Kris

Context for my fellow Anglophones: Bram Moolenaar, creator and maintainer of Vim, has passed away.


#PrivateBin v1.7.5 released - minor bugfixes and quality of life improvements for administrators

elrido reshared this.


CoSin 2024 live streams:

👉 streaming.media.ccc.de/cosin20…

#cosin2024

reshared this


elrido reshared this.


#BerndFix an der #CoSin2024 mit #WikiLeaks-Vortrag - zu #FreeAssange und (jetzt) #AssangeFree.

Es wird eine Gesamtübersicht seit den ersten Kontakten mit #JulianAssange 2008 (am CCC-Kongress) angekündigt; Bernd rekapituliert die Geschichte seither.

Punkto Spendeneinnahmen ist gleich einmal interessant:

Nach der Publikation der US-Depeschen nahm das Spendenaufkommen via #PayPal massiv zu: ca. EUR 100k / d wurden eingenommen - bis zum Punkt, wo PayPal das Konto der Stiftung @wauland sperrte.

This entry was edited (5 months ago)

elrido reshared this.

in reply to Hernâni Marques

Beim Besuch der Botschaft ferner zu beachten: die spanische Firma #UCGlobal war von der ecuadorischen Regierung beauftragt, für die Sicherheit (gerne hier: #Totalüberwachung) der Besuche / Besucher zu sorgen.

Wie später nämlich publik wurde, sind auch Geräte geöffnet und verwanzt, Daten abgesaugt worden usw.

Dies ist auch Gegenstand eines laufenden juristischen Verfahrens.

This entry was edited (5 months ago)
in reply to Hernâni Marques

Mit dem #Machtwechsel in #Ecuador von Correa zu Moreno wurde der Druck auf den nunmehr "unerwünschten Gast" #JulianAssange erhöht. Im Zuge dessen wurde ihm der via Correa in der Amtszeit zuvor ausgestellte ecuadorianische Pass entzogen und organisiert sowie medial inszeniert, dass er aus der Botschaft rausgeworfen wurde - in die Hände der britischen Polizei, so dass er schliesslich nach #Belmarsh (besser: #Hellmarsh) kam.

#ChaosSingularity #CoSin #CoSin2024 #FreeAssange #AssangeFree #WikiLeaks

in reply to Hernâni Marques

Fast-Forward zur Gegenwart nun - zum Rahmen des #PleaDeal|s, der in #Saipan inmitten des Pazifiks von einer US-amerikanischen Richterin besiegelt wurde, gilt für Julian auch eine #Generalamnestie gegenüber den US-Behörden für die gesamte betroffene Zeit, bis und mit zum #AssangeFree-Tag.
This entry was edited (5 months ago)
in reply to Hernâni Marques

Zum Finanziellen des Ganzen - von #FreeAssange zu #AssangeFree:

Für die Anwälte wurden für zehn Teams in acht Ländern EUR 12 Mio. ausgegeben.

Das Geld für die immensen juristischen Ausgaben kam von der "Einkaufsgesellschaft" #AssangeDAO, die ein #NFT vom Künstler pak gekauft hat.

pak hat in dem Rahmen 16'593 #ETH (#Ethereum) eingenommen, was (damals) umgerechnet ca. EUR 52 Mio. waren. Das Geld hat er im Februar 2022 an die #WHS-Stiftung gegeben, wo Kryptowährungen auf einem Hoch waren.

This entry was edited (5 months ago)
in reply to Hernâni Marques

Total hat die #WHS ca. 11'000 #ETH getauscht - immer nach Bedarf. In Fiat-Währung umgerechnet waren das über die rund zwei Jahre tatsächlich ca. EUR 17 Mio., weil der #Ethereum-Kurs in den diesen Jahren auch (länger) weiter unten war.

Dies bedeutet folglich, dass noch ca. 5'000 #ETH da sind, wo jetzt geschaut werden muss, was damit zu machen ist; gegeben die Tatsache, dass der Spenderwille (vom Künstler pak) im Wesentlichen erfüllt ist.

This entry was edited (5 months ago)
in reply to Hernâni Marques

Ich stelle die Frage, was mit Leuten wie #OlaBini und anderen vom #WikiLeaks-Umfeld ist.

Dazu sagt Bernd, dass nicht ausgeschlossen werden kann, dass die US-Regierung gegen das (erweiterte) Umfeld von WikiLeaks noch einmal eine Keule auspackt. Es müsse dann geschaut werden, wie vorgehen.

Das #NFT-Geld kann dafür zumal nicht genutzt werden, weil das nicht dem expliziten pak-Wunsch entspräche. Juristisch betrachtet sei dies klar an ihm gebunden.

This entry was edited (5 months ago)
in reply to Hernâni Marques

Fun-Fact noch dazu: wegen dem erwähnten Prozess gegen #UCGlobal, wo Andy Müller-Maguhn und Bernd im #Strafprozess als Nebenkläger auftreten (juristischer Kostenpunkt: EUR 7'500; dies im Kontext ehrenamtlicher Stiftungsratsarbeit, ohne also Lohn zu beziehen), hat das Finanzamt #Hamburg im Februar 2024 abermals die #Steuerbefreiung entzogen; erneut wurde eine Darstellung erprobt, die Stiftungsräte profitierten von dem Geld. Dabei kam von den involvierten Anwälten gar nie eine Rechnung...
This entry was edited (5 months ago)
in reply to Hernâni Marques

... d. h.: die EUR 7'500 wurden nicht überwiesen, weder an Anwälte noch sonst irgendwohin. Das wurde dem Finanzamt auch mitgeilt. Nach viermonatiger "Arbyte" hat das Finanzamt vor zwei Tagen festgestellt, dass es wieder wilde Theorien über den Korruptionsgrad der Stiftungsräte aufgestellt hat; entsprechend ist die #Steuerbefreiung von @wauland wieder hergestellt. - just vor zwei Tagen, also am 27.6.2024! 🍾 ✊

(Da hat sicher das jüngste mediale Licht #FreeAssange -> #AssangeFree geholfen. 😉)

This entry was edited (5 months ago)
in reply to Hernâni Marques

Lenin? Ach du meinst Lenín Moreno. In Deutschland nennt man meist seinen Nachnamen.
in reply to Christian Pietsch 🍑

K/A, habe den gerade nicht zur Hand gehabt. Der Kontext ist #Ecuador; zumal auch der Ausdruck da steht, "von Correa zu Lenin", was überzufälligen Charakter hat.
This entry was edited (5 months ago)
in reply to Hernâni Marques

@christian (Soll heissen: "Correa" spielt in einem russischen oder sowjetischen Kontext keine gesteigerte Rolle.)


in reply to elrido Grandmaster Bash reshared this.

Group picture from the first day.

Took a lot of notes, my highlights so far were:

  • Massimilianos' RP2040-based, Rust-driven robot racer
  • options to improve handling of bitfields in packed structs
  • typestate pattern for use in state machines, think objects that mutate into different types as the states progress, so only methods relevant to the current state are available and enforced at compile time, ex. rustls::ConfigBuilder
  • Milica shared her teams' experience switching from C++ to Rust
  • Simon Brummers' text-2-morse-code character device driver, an excellent example project to get started with Rust-based Linux-kernel-module development


It fills a lot of gaps and backstory of Immortan Joe and the citadel and the other wasteland towns and of course, Furiosa. It ends just before Fury Road hits off and even has short scenes from Fury Road as reminders of how that story went during the end c

Did go see Furiosa tonight, can highly recommend, if you enjoy George Miller's Mad Max series. I'd call this the Rogue One of the series. 🤩

It fills a lot of gaps and backstory of Immortan Joe and the citadel and the other wasteland towns and of course, Furiosa. It ends just before Fury Road hits off and even has short scenes from Fury Road as reminders of how that story went during the end credits. It would be perfect to watch the two back to back as a double feature.

Arguably, Max does briefly show up in this one, but it is only a vague reference via the iconic car and a brief shot of a man standing next to it with his back towards the audience. Bit like in the early Fury Road trailer.

Edit: Removed the CW reg. mild spoilers. Doesn't seem to translate properly to Mastodon, messed up the order of the content and didn't hide anything. Sorry.

This entry was edited (6 months ago)


Congratulations @Natanael Copa on the release of Alpine Linux 3.20!

I know how much of an effort this one turned out to be and can not thank you enough for all of your efforts to get this one over the line and into our hands.


elrido reshared this.


Auf swpc.noaa.gov findet ihr Vorhersage für Polarlichter. Einfach im Laufe des Tages oder frühen Abends noch mal checken.

reshared this


MadMike77 reshared this.


Had a productive weekend. Could release PrivateBin 1.7.2, which includes a new template, as well as convert2json 0.8.4. And I had a nice bike tour around the nearby Greifensee. :-D

elrido reshared this.


In retrospect, we should have figured out that Jia Tan was a plant from the fact that they showed up to do releases. In 20+ years of contributions to FLOSS projects I haven't found anybody willing to do the same.
in reply to Jason Petersen (he) Marcel Waldvogel reshared this.

sure you can; collecting items for the change log, running the dist with the test suite, uploading release artefacts, writing release notes and announcements… it’s a “boring” job, so very few people show up to do that


One does not simply
telnet into Mordor.


One ssh-es in,
using an exploit in a compression library,
shipped to them by their trusted distro in a supply chain attack.

Fun

elrido reshared this.


Note on all the #xz drama, there are some technical solutions for such #supplychainattack that can make such an attack way harder, at least to hide the code in tarballs etc.

slsa.dev/ e.g. is a solution. Combined with reproducible builds, it ensures that a software artifact is built exactly from the source given in a source repository, with the possibility to prove that and no way for any maintainer to tamper with (in the highest level).

#slsa #infosec #security #linux #backdoor

elrido reshared this.

in reply to rugk

Furthermore produced software artifacts proofs are written into a database similar to #certificateTransparency.

We have recently implemented this in #PrivateBin and it works great: github.com/PrivateBin/PrivateB…

Of course practically, people (especially software consumers) needed to verify it, to be worth the work.

Obviously, it's no magic bullet. It just raises the burden for an attacker. Obviously, the source code repo could be made to contain bad code, but you cannot anymore tamper at built-time.

in reply to rugk

The way this works, is, essentially, quite easy: the whole build process is documented in the same repository, builds are automated via CI/CD and all that is, to reach best support, done in an environment that prevents tampering and (crucially) is *out of your control*.

Then you get #SLSA v3: slsa.dev/get-started#slsa-3 (quite easy with GitHub Actions)

#SLSA
in reply to rugk

Now, you say, you have to trust GitHub? Sure, you do, to achieve this. But threat models: What is more likely compromised: a maintainer/account in your project, or the whole GitHub build infra?

Personally, I was also not quite convinced, given you loose "control" over your build and GitHub could theoretically now inject #malware.

However, as the project itself states, this is not a big deal, if you combine it with the older security feature aka #reproduciblebuilds.

slsa.dev/spec/v1.0/faq#q-what-…

This entry was edited (8 months ago)
in reply to rugk

To explain, we have #SLSA signatures that verify the build was done automatically by #GitHub as instructed, *and* we have traditional #gpg signatures with private keys only known to maintainer(s) that verify a maintainer actually triggered the built and locally reproduced it…
Given they both validate, you automatically achieve reproducible builds _and_ #SLSA validity.

One caveat: This was only easy, because our build process is essentially one command (git archive).

github.com/PrivateBin/PrivateB…

in reply to rugk

Wow, je mehr ich über die ganze #xz Saga lese, desto beeindruckter bin ich, was für ein unglaublicher Zufall es war, dass das so schnell gefunden wurde 😳

boehs.org/node/everything-i-kn… ist ein lesenswerter Überblick.

bugs.debian.org/cgi-bin/bugrep… gibt einen guten Eindruck, wie vor 5-6 Tagen angefangen wurde, Druck aufzubauen, die kompromittierte Version in Debian hochzuladen. Und wie viel Energie da rein gesteckt wurde.

#infosec #security

in reply to rugk

I couldn't immediately tell, but is sigstore (sigstore.dev/) a part of that approach, or is it a different project doing something similar (but only a part of the what'd be required)?
This entry was edited (8 months ago)


Gerade @Malte 's exzellente Einführung in SSRF (server side request forgery) genossen am #Winterkongress und fleissig Notizen gemacht. Habe da noch ein paar Punkte am PrivateBin directory nachzubessern. Gopher-URLs via (lib)curl zu nutzen um ganz andere Protokolle zu sprechen (das gezeigte Beispiel war SMTP) ist echt kreativ, aber wenigstens recht einfach zu unterbinden.


Experimentieren mit den Wertmodellen der KI: biastest.ch/ #Winterkongress
This entry was edited (9 months ago)

reshared this



A classic bug for a leap day: At work, colleagues discovered and fixed a bug in a lesser used tool that only occurs on February 29th. It did trip up the tests, so no one got to merge until it got identified and resolved.

The source file in question hadn't been touched in over 4 years. Last leap year, the 29th was on a Saturday, so likely no one noticed.

What was annoying is that the logic had been clearly written with the intent of handling leap years. A leap year check condition was present, validated only on a February > 28th, but had to get inverted.

You may wonder why we wouldn't have used the languages' standard library date functions to validate the date - unfortunately the language in question doesn't have such a sophisticated standard library (language omitted to protect the innocent).


elrido reshared this.


Niklaus Wirth, the inventor of the Pascal programming language, author of "Algorithms + Data Structures = Programs", and more, passed away on January 1.

Wirth's law, named after him, is an adage which states that software gets slower more rapidly than hardware gets faster.

#programming #computerscience

This entry was edited (11 months ago)

reshared this



Best #37C3 quote so far:

[...] to observe the international compressor holiday [...]

Context: Newag's train "DRM"




MadMike77 reshared this.


Congratulations to Sergio Benitez on releasing rocket.rs 0.5.0! Thank you for this great framework. 👏

I got to follow rocket's journey to async and stable #rust with the PrivateBin directory service. Coming from Python flask apps, it is really easy to pick up and get going with your webservice, offering static & templated content, easy to create web forms and JSON APIs.

Thanks to rust's strict type system I could focus on the logic and didn't have to waste time double checking and casting data received by clients. If my API accepts an integer in a certain parameter, Rocket will ensure I only receive valid requests in my logic.

reshared this


elrido reshared this.


I'm so so excited to announce #rust hyper v1.0 🚀

seanmonstar.com/blog/hyper-v1/

#rust

reshared this



Holiday in Peru


Fun


I like CSS-animations, clocks and dials for making metrics easier to digest (we are quicker at detecting angular changes than reading and parsing digits). So I'm in awe with this creative use of a watch-dial to visualize a 32-bit hexadecimal number:

retr0.id/stuff/2038/



#PrivateBin v1.6.0 released - adding translations for Japanese & Arabic, configuration option to disable email button and increases the minimal required PHP version to 7.3.


The letters below were discovered in September 1993 in a reverse time-capsule apparently sent from 2023.

The first of those emails dates from this morning. Note the author of the RFC and the publication date. :-)

RFC 1607

Fun








Schade das zu erfahren und vielen Dank an Herrn Dornier für die jahrzehnte-lange gute Betreuung und die ausgezeichneten Produkte!

Habe beruflich und privat seit Ende der 2000er Jahre immer wieder auf PC Engines für m0n0wall- und später OPNsense-basierte Router gesetzt. Diese Nachricht wurde über eine apu4d4 ins Internet geschickt und von einem Server hinter einer apu2e4 gehostet.



#TIL:

prompt injection, which is a form of cyberattack that exploits [an AI's] natural language processing abilities.

elrido reshared this.


Winterkongress der Digitalen Gesellschaft

Während zwei Tagen werden Themen rund um Informationstechnologie, Digitalisierung und deren Auswirkungen auf unsere Gesellschaft in verschiedenen Vorträgen und Workshops behandelt.

#Digitale_Gesellschaft #Winterkongress #Zürich #Linux

gnulinux.ch/winterkongress-202…

elrido reshared this.



PrivateBin 1.5.1 released - Filesystem purge lookup change & administration script

elrido reshared this.


2022 update to this quantum computing progress chart: sam-jaques.appspot.com/quantum…

tl;dr Commendable progress, but we're still a long long way from factoring.

elrido reshared this.


elrido reshared this.


At 63 #curl bindings, updated and corrected.
#curl

elrido reshared this.

in reply to daniel:// stenberg://

what’s a good use-case for PyCurl, etc? I use curl on the command like daily, but not sure what I would do with it in a program. I’m sure that I’m missing something.
in reply to daniel:// stenberg://

i think most people would just use requests module. maybe i'll try pycurl in future.
in reply to Ben Hayes

@benhayes everyone should use the tool they deem necessary to solve their problem
in reply to Ben Hayes

While python 3 now has decent native support for HTTP(S) with it's urllib module (which does cover 99+% of my use cases), PyCurl supports "FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3 and RTSP. libcurl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+password authentication (Basic, Digest, NTLM, Negotiate, Kerberos4), file transfer resume, http proxy tunneling and more!" -- pycurl.io/

So it can solves those edge cases. It may also be useful if you hit performance or memory usage issues in your python based search spider or similar massively parallel connection applications.

Unknown parent

daniel:// stenberg://
@0xDEADBEEF I am not aware of any binding for cobol!


PrivateBin 1.5.0 released - Adding S3 Storage backend, storage migration script & 4 new translations

privatebin.info/news/v1.5.0-re…




PrivateBin 1.4.0 released - Hardening the attachment preview, Google Cloud Storage and Oracle database support & adding new translations


My team at LzLabs GmbH in Wallisellen, Switzerland, is looking for a 4th DevOps Engineer. You'd be working primarily with a CloudBees (Jenkins) cluster of around 90 blades for build & testing, for several software stacks that targets RHEL, but hopefully soon™ also other platforms. And of course there are also a lot of build and deployment related projects to be spice things up on the side, like maintaining and developing a test statistics database, code coverage reporting, change log and other automation projects, all in a mostly ansible-ized environment. The companies main language is English, living in or moving to the vicinity of Zürich would certainly be advantageous.

#followerpower #Stellenangebote #jobs #jeRecrute

in reply to elrido

Next week a new hire starts in our team. To help them find their way in our environment, we created this map. Let's hope it wont scare them away. :-D


Yeah, das Friendica Update war wieder einmal ein voller Erfolg! Ich freue mich immer darauf nach dem Update die Netzwerkstatistiken zu durchstöbern und zu sehen wie das Fediverse wächst und gedeiht. Aktuell sehe ich da bei mir:

Momentan kennt dieser Knoten 2065 Knoten mit insgesamt 1238363700 registrierten Nutzern, die die folgenden Plattformen verwenden:
- Friendica (234/14306)
- BirdsiteLIVE (3/9295)
- Diaspora (104/745029)
- [...]
- Lemmy (4/15876)
- Mastodon (1195/2801105)
- Misskey (33/1234575069)
[...]


Hm, die Misskey stats bedürfen wohl noch etwas der Interpretation... 🤔


in reply to sebsauvage

the case in which the near-light speed travel has been done by the question maker is still missing. She could potentially be even older than 43.