• 2 Posts
  • 62 Comments
Joined 1 year ago
cake
Cake day: June 6th, 2023

help-circle





  • Nono, you are demanding in a not nice tone from a open source community to implement some bloat workaround to fix some you-specific-issue with commercial software. You know how free and open source software works? Either you contribute something positive, or you color yourself glad you get to use something so great completely for free and stay silent. Bark at that commercial vendor that doesn’t use the money from licenses + selling your soul to build something half decent! This upcoming demand-culture around things that others kindly share with wanting nothing in return pisses me off. Especially when it’s not even something about the project, but carrying over unrelated cruft, instead of directing the demand to the entitiy it would be justified against.

    Just build a browser extension that does the conversion. Or a script that watches a folder where you drag it into as an intermediary, and then it converts it automatically. And then share it for free, because you are a kind person! You might find a handful of people that like it. And then watch some asshat writing you a demand that “stop converting to jpeg, forever stop that! I need bitmaps for my gameboy! Just give me a SETTING where I can chooose and a nice dialog where I can pick the freaking color palette!”




  • As far as I understand, in this case opaque binary test data was gradually added to the repository. Also the built binaries did not correspond 1:1 with the code in the repo due to some buildchain reasons. Stuff like this makes it difficult to spot deliberately placed bugs or backdors.

    I think some measures can be:

    • establish reproducible builds in CI/CD pipelines
    • ban opaque data from the repository. I read some people expressing justification for this test-data being opaque, but that is nonsense. There’s no reason why you couldn’t compress+decompress a lengthy creative commons text, or for binary data encrypt that text with a public password, or use a sequence from a pseudo random number generator with a known seed, or a past compiled binary of this very software, or … or … or …
    • establish technologies that make it hard to place integer overflows or deliberately miss array ends. That would make it a lot harder to plant a misbehavement in the code without it being so obvious that others note easily. Rust, Linters, Valgrind etc. would be useful things for that.

    So I think from a technical perspective there are ways to at least give attackers a hard time when trying to place covert backdoors. The larger problem is likely who does the work, because scalability is just such a hard problem with open source. Ultimately I think we need to come together globally and bear this work with many shoulders. For example the “prossimo” project by the Internet Security Research Group (the organisation behind Let’s Encrypt) is working on bringing memory safety to critical projects: https://www.memorysafety.org/ I also sincerely hope the german Sovereign Tech Fund ( https://www.sovereigntechfund.de/ ) takes this incident as a new angle to the outstanding work they’re doing. And ultimately, we need many more such organisations and initiatives from both private companies as well as the public sector to protect the technology that runs our societies together.


  • Well you must have either set up a port redirect (ipv4) or opened the port for external traffic (ipv6) yourself. It is not reachable by default as home routers put a NAT between the internet and your devices, or in the case of ipv6 they block any requests. So (unless you have a very exotic and unsafe router) just uhhh don’t 😅 To serve websites it is enough to open 443 for https, and possibly 80 for http if you want to serve an automatic redirect to https.


  • A colleague of mine had a (non externally reachable) raspberry pi with default credentials being hijacked for a botnet by a infected windows computer in the home network. I guess you’ll always have people come over with their devices you do not know the security condition of. So I’ve started to consider the home network insecure too, and one of the things I want to set up is an internal ssh honeypot with notifications, so that I get informed about devices trying to hijack others. So for this purpose that tool seems a possibilty, hopefully it is possible to set up some monitoring and notification via uptime kuma.


  • skilltheamps@feddit.detoAndroid@lemmy.worldLooking for a Python Interpreter
    link
    fedilink
    English
    arrow-up
    5
    arrow-down
    1
    ·
    edit-2
    3 months ago

    Well it is compiled to byte code in a first step, and this byte code then gets processed by the interpreter. Now Java does the exact same thing: gets compiled to byte code which then gets executed by the jvm (java virtual machine), which is essentially a interpreter that is just a little simpler than the python one (has fewer types for example). And yet, nobody talks about a java interpreter







  • True words. The sustained effort to keep something in decent shape over years is not to be underestimated. Now when life changes and one is not able or willing anymore to invest that amount of time, ill-timed issues can become quite the burden. At one point I decided to cut down on that by doing a better founded setup, that does backup with easy rollback automatically, and updates semi-automatically. I rely on my server(s), and all from having this idea to having it decently implemented took me a number of months. Just because time for such activities is limited, and getting a complex and intertwined system like this reliably and fault tolerant automated and monitored is simply something else than spinning up a one off service


  • And they believe all employees actually remember so many wildly different and long passwords, and change them regularly to wildly different ones? All this leads to is a single password that barely makes it over the minimum requirements, and a suffix for the stage (like 1 for boot, 2 for bitlocker etc), and then another suffix for the month they changed it. All of that then on sticky notes on the screen.