Skip to main content


Content warning: It fills a lot of gaps and backstory of Immortan Joe and the citadel and the other wasteland towns and of course, Furiosa. It ends just before Fury Road hits off and even has short scenes from Fury Road as reminders of how that story went during the end c

This entry was edited (2 days ago)

elrido reshared this.


With more people considering #Linux after the latest #Microsoft #Windows news, here is my advice:

- Before looking at Linux at all, determine what proprietary software you're using in your workflows (MS Office and Adobe stuff being big ones) and try FOSS alternatives on Windows. (LibreOffice, OnlyOffice, Krita, GIMP, Inkscape, kdenlive, etc.) This will very much ease any future transition away from Windows. (1/7)

reshared this



Congratulations @Natanael Copa on the release of Alpine Linux 3.20!

I know how much of an effort this one turned out to be and can not thank you enough for all of your efforts to get this one over the line and into our hands.


elrido reshared this.


Auf https://swpc.noaa.gov findet ihr Vorhersage für Polarlichter. Einfach im Laufe des Tages oder frühen Abends noch mal checken.

reshared this


MadMike77 reshared this.


Had a productive weekend. Could release PrivateBin 1.7.2, which includes a new template, as well as convert2json 0.8.4. And I had a nice bike tour around the nearby Greifensee. :-D

elrido reshared this.


In retrospect, we should have figured out that Jia Tan was a plant from the fact that they showed up to do releases. In 20+ years of contributions to FLOSS projects I haven't found anybody willing to do the same.
in reply to Jason Petersen Marcel Waldvogel reshared this.

sure you can; collecting items for the change log, running the dist with the test suite, uploading release artefacts, writing release notes and announcements… it’s a “boring” job, so very few people show up to do that


One does not simply
telnet into Mordor.


One ssh-es in,
using an exploit in a compression library,
shipped to them by their trusted distro in a supply chain attack.

Fun

elrido reshared this.


Note on all the #xz drama, there are some technical solutions for such #supplychainattack that can make such an attack way harder, at least to hide the code in tarballs etc.

https://slsa.dev/ e.g. is a solution. Combined with reproducible builds, it ensures that a software artifact is built exactly from the source given in a source repository, with the possibility to prove that and no way for any maintainer to tamper with (in the highest level).

#slsa #infosec #security #linux #backdoor

elrido reshared this.

in reply to rugk

Furthermore produced software artifacts proofs are written into a database similar to #certificateTransparency.

We have recently implemented this in #PrivateBin and it works great: https://github.com/PrivateBin/PrivateBin/issues/1169

Of course practically, people (especially software consumers) needed to verify it, to be worth the work.

Obviously, it's no magic bullet. It just raises the burden for an attacker. Obviously, the source code repo could be made to contain bad code, but you cannot anymore tamper at built-time.

in reply to rugk

The way this works, is, essentially, quite easy: the whole build process is documented in the same repository, builds are automated via CI/CD and all that is, to reach best support, done in an environment that prevents tampering and (crucially) is *out of your control*.

Then you get #SLSA v3: https://slsa.dev/get-started#slsa-3 (quite easy with GitHub Actions)

#SLSA
in reply to rugk

Now, you say, you have to trust GitHub? Sure, you do, to achieve this. But threat models: What is more likely compromised: a maintainer/account in your project, or the whole GitHub build infra?

Personally, I was also not quite convinced, given you loose "control" over your build and GitHub could theoretically now inject #malware.

However, as the project itself states, this is not a big deal, if you combine it with the older security feature aka #reproduciblebuilds.

https://slsa.dev/spec/v1.0/faq#q-what-about-reproducible-builds

This entry was edited (1 month ago)
in reply to rugk

To explain, we have #SLSA signatures that verify the build was done automatically by #GitHub as instructed, *and* we have traditional #gpg signatures with private keys only known to maintainer(s) that verify a maintainer actually triggered the built and locally reproduced it…
Given they both validate, you automatically achieve reproducible builds _and_ #SLSA validity.

One caveat: This was only easy, because our build process is essentially one command (git archive).

https://github.com/PrivateBin/PrivateBin/blob/master/doc/Release.md

in reply to rugk

Wow, je mehr ich über die ganze #xz Saga lese, desto beeindruckter bin ich, was für ein unglaublicher Zufall es war, dass das so schnell gefunden wurde 😳

https://boehs.org/node/everything-i-know-about-the-xz-backdoor ist ein lesenswerter Überblick.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067708 gibt einen guten Eindruck, wie vor 5-6 Tagen angefangen wurde, Druck aufzubauen, die kompromittierte Version in Debian hochzuladen. Und wie viel Energie da rein gesteckt wurde.

#infosec #security

in reply to rugk

I couldn't immediately tell, but is sigstore (https://www.sigstore.dev/) a part of that approach, or is it a different project doing something similar (but only a part of the what'd be required)?
This entry was edited (1 month ago)


Gerade @Malte 's exzellente Einführung in SSRF (server side request forgery) genossen am #Winterkongress und fleissig Notizen gemacht. Habe da noch ein paar Punkte am PrivateBin directory nachzubessern. Gopher-URLs via (lib)curl zu nutzen um ganz andere Protokolle zu sprechen (das gezeigte Beispiel war SMTP) ist echt kreativ, aber wenigstens recht einfach zu unterbinden.


Experimentieren mit den Wertmodellen der KI: https://www.biastest.ch/ #Winterkongress
This entry was edited (2 months ago)

reshared this



A classic bug for a leap day: At work, colleagues discovered and fixed a bug in a lesser used tool that only occurs on February 29th. It did trip up the tests, so no one got to merge until it got identified and resolved.

The source file in question hadn't been touched in over 4 years. Last leap year, the 29th was on a Saturday, so likely no one noticed.

What was annoying is that the logic had been clearly written with the intent of handling leap years. A leap year check condition was present, validated only on a February > 28th, but had to get inverted.

You may wonder why we wouldn't have used the languages' standard library date functions to validate the date - unfortunately the language in question doesn't have such a sophisticated standard library (language omitted to protect the innocent).


elrido reshared this.


Niklaus Wirth, the inventor of the Pascal programming language, author of "Algorithms + Data Structures = Programs", and more, passed away on January 1.

Wirth's law, named after him, is an adage which states that software gets slower more rapidly than hardware gets faster.

#programming #computerscience

This entry was edited (4 months ago)

reshared this



Best #37C3 quote so far:

[...] to observe the international compressor holiday [...]

Context: Newag's train "DRM"




MadMike77 reshared this.


Congratulations to Sergio Benitez on releasing rocket.rs 0.5.0! Thank you for this great framework. 👏

I got to follow rocket's journey to async and stable #rust with the PrivateBin directory service. Coming from Python flask apps, it is really easy to pick up and get going with your webservice, offering static & templated content, easy to create web forms and JSON APIs.

Thanks to rust's strict type system I could focus on the logic and didn't have to waste time double checking and casting data received by clients. If my API accepts an integer in a certain parameter, Rocket will ensure I only receive valid requests in my logic.

reshared this


elrido reshared this.


I'm so so excited to announce #rust hyper v1.0 🚀

https://seanmonstar.com/blog/hyper-v1/

#rust

reshared this



Holiday in Peru


Fun


I like CSS-animations, clocks and dials for making metrics easier to digest (we are quicker at detecting angular changes than reading and parsing digits). So I'm in awe with this creative use of a watch-dial to visualize a 32-bit hexadecimal number:

https://retr0.id/stuff/2038/



#PrivateBin v1.6.0 released - adding translations for Japanese & Arabic, configuration option to disable email button and increases the minimal required PHP version to 7.3.


The letters below were discovered in September 1993 in a reverse time-capsule apparently sent from 2023.

The first of those emails dates from this morning. Note the author of the RFC and the publication date. :-)

RFC 1607

Fun








Schade das zu erfahren und vielen Dank an Herrn Dornier für die jahrzehnte-lange gute Betreuung und die ausgezeichneten Produkte!

Habe beruflich und privat seit Ende der 2000er Jahre immer wieder auf PC Engines für m0n0wall- und später OPNsense-basierte Router gesetzt. Diese Nachricht wurde über eine apu4d4 ins Internet geschickt und von einem Server hinter einer apu2e4 gehostet.



#TIL:

prompt injection, which is a form of cyberattack that exploits [an AI's] natural language processing abilities.

elrido reshared this.


Winterkongress der Digitalen Gesellschaft

Während zwei Tagen werden Themen rund um Informationstechnologie, Digitalisierung und deren Auswirkungen auf unsere Gesellschaft in verschiedenen Vorträgen und Workshops behandelt.

#Digitale_Gesellschaft #Winterkongress #Zürich #Linux

https://gnulinux.ch/winterkongress-2023

elrido reshared this.



PrivateBin 1.5.1 released - Filesystem purge lookup change & administration script

elrido reshared this.


2022 update to this quantum computing progress chart: http://sam-jaques.appspot.com/quantum_landscape_2022

tl;dr Commendable progress, but we're still a long long way from factoring.

elrido reshared this.


elrido reshared this.


At 63 #curl bindings, updated and corrected.
#curl

elrido reshared this.

in reply to daniel:// stenberg://

what’s a good use-case for PyCurl, etc? I use curl on the command like daily, but not sure what I would do with it in a program. I’m sure that I’m missing something.
in reply to Ben Hayes

@benhayes if you write a program that needs Internet transfers for example...
in reply to daniel:// stenberg://

i think most people would just use requests module. maybe i'll try pycurl in future.
in reply to Ben Hayes

@benhayes everyone should use the tool they deem necessary to solve their problem
in reply to Ben Hayes

While python 3 now has decent native support for HTTP(S) with it's urllib module (which does cover 99+% of my use cases), PyCurl supports "FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3 and RTSP. libcurl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+password authentication (Basic, Digest, NTLM, Negotiate, Kerberos4), file transfer resume, http proxy tunneling and more!" -- http://pycurl.io/

So it can solves those edge cases. It may also be useful if you hit performance or memory usage issues in your python based search spider or similar massively parallel connection applications.
Unknown parent

daniel:// stenberg://
@0xDEADBEEF I am not aware of any binding for cobol!


PrivateBin 1.5.0 released - Adding S3 Storage backend, storage migration script & 4 new translations

https://privatebin.info/news/v1.5.0-release.html


elrido reshared this.


Wenn ihr mal „sprechende“ RGB-Codes braucht: https://hexwords.netlify.app

elrido reshared this.



PrivateBin 1.4.0 released - Hardening the attachment preview, Google Cloud Storage and Oracle database support & adding new translations


My team at LzLabs GmbH in Wallisellen, Switzerland, is looking for a 4th DevOps Engineer. You'd be working primarily with a CloudBees (Jenkins) cluster of around 90 blades for build & testing, for several software stacks that targets RHEL, but hopefully soon™ also other platforms. And of course there are also a lot of build and deployment related projects to be spice things up on the side, like maintaining and developing a test statistics database, code coverage reporting, change log and other automation projects, all in a mostly ansible-ized environment. The companies main language is English, living in or moving to the vicinity of Zürich would certainly be advantageous.

#followerpower #Stellenangebote #jobs #jeRecrute

in reply to elrido

Next week a new hire starts in our team. To help them find their way in our environment, we created this map. Let's hope it wont scare them away. :-D


Yeah, das Friendica Update war wieder einmal ein voller Erfolg! Ich freue mich immer darauf nach dem Update die Netzwerkstatistiken zu durchstöbern und zu sehen wie das Fediverse wächst und gedeiht. Aktuell sehe ich da bei mir:
Momentan kennt dieser Knoten 2065 Knoten mit insgesamt 1238363700 registrierten Nutzern, die die folgenden Plattformen verwenden:
- Friendica (234/14306)
- BirdsiteLIVE (3/9295)
- Diaspora (104/745029)
- [...]
- Lemmy (4/15876)
- Mastodon (1195/2801105)
- Misskey (33/1234575069)
[...]
Hm, die Misskey stats bedürfen wohl noch etwas der Interpretation... 🤔

elrido reshared this.


Les testeurs: 😂

elrido reshared this.

in reply to sebsauvage

the case in which the near-light speed travel has been done by the question maker is still missing. She could potentially be even older than 43.

Retrocomputing Forum reshared this.


!Retrocomputing Forum An article on a large, mid-90s BBS setup and a second article containing some more background of what it got used for (includes a higher-resolution image):
- http://rachelbythebay.com/w/2022/01/26/swcbbs/
- https://3drealms.com/news/3d-realms-website-turns-20/

elrido reshared this.


a computer can never be held accountable

therefore a computer must never make a management decision

(IBM, 1979 slide)

reshared this



Oh, wow: Nachdem ich von den beiden Druckwellen des Vulkanausbruches in der Nähe von Tonga hörte, habe ich in den Messungen von meiner kleinen Wetterstation nachgeguckt und die sind dort klar zu erkennen!


Als ich 1997 meine erste Reise in die USA machte, hatte ich einen Psion Siena dabei und darauf Tagebuch geführt. Leider konnte ich mir damals das Datenkabel nicht leisten und es irgendwann verpasst die leeren Batterien zu tauschen und die Dokumente gingen so verloren.

Vor einigen Wochen habe ich mir aus Neugier dessen grossen Bruder angeschafft, den Psion Series 3a. Und diesmal auch ein serielles Kabel dazu, damit ich Programme hoch- und Daten davon runter laden kann. Hab mal ein paar Notizen dazu gemacht:



Field report on upgrading a rocket v0.4 application to v0.5


in reply to elrido