But I’m not bisexual, horny or…well, just those two.

Nobody is both that bored and that motivated. Unless paid.

deleted by creator

This feels very “just found out about politics and damn” tbh.

Ok.

I think this would be of value for sharing with people that aren’t aware (my kid when she was younger).

Or is there a better resource to do this?

I have a feeling there are a lot of busy people trying to answer that question, now. Yikes.

Water slide.

Yeah it sounds pretty wild already with some kind of, like, door knock mechanism using certificates? So you can’t scan for it. And some reverse engineering countermeasures.

Like everyone else, I have to wonder what libraries have been compromised in a way that nobody has noticed yet.

Some of the trust comes from eyes on the project thanks to it being open source. This thing got discovered, after all. Not right away, sure, but before it spread everywhere. Same question of trust applies to commercial software too.

Ideally, PR reviews help with this but smaller projects esp with few contributors may not do much of that. I doubt anyone has spent time understanding the software supply chain (SSC) attack surface of their product but that seems like a good next step. Someone needs to write a tool that scans the SSC repos and flags certain measures like the # of maintainers.

PS: I have the worst allergies I’ve had in ages today and my brain is in a histamine fog so maybe I shouldn’t be trying to think about this stuff right now lol cough uuugh blows nose

Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of it’s “great new features”. We even worked with him to fix the valgrind issue (which it turns out now was caused by the backdoor he had added). We had to race last night to fix the problem after an inadvertent break of the embargo.

He has been part of the xz project for 2 years, adding all sorts of binary test files, and to be honest with this level of sophistication I would be suspicious of even older versions of xz until proven otherwise.

Damn. I would love to see a full post mortem on this compromise.

Well maybe they aren’t experienced info security professionals :)

I get where you’re coming from but is he managing his risk or not?

Does he understand the risk? If yes, good. No? Bad.

Is he ignoring the risk? If yes, bad. No? Good.

Is he weighing the risks against the benefits he receives of using these apps and taking appropriate steps to mitigate those risks? If yes, then good. No? Bad.

Cyber security isn’t “lock everything down at all costs”. Otherwise I would insist you throw your phone in an incinerator along with all your computers, live in a bunker reinforced against nuclear attack with a small army to guard you, never leave it, never talk to anyone… Etc.

It is enabling one to achieve their goals with a tolerable amount of risk. That level of tolerable risk is different for everyone.

“Lobsters on snowbanks in cute little mittens” would fit the theme and the meter better… Just sayin’

deleted by creator

That’s good to hear, thanks.

Ugh that sounds irritating. I’m still waiting to hear about a Pixel that isn’t fraught with annoying issues so I can finally upgrade from my 4a. Sounds like I will be waiting a while longer.

Totally agree. Have been there and done that quite a few times too.

Big W for DeLonghi there for sure. New respect unlocked :) it looks like it is well designed and laid out too.

Way to go!! I didn’t realize these were so fixable but not surprising. My old Gaggia was easy to find parts for and easy to work on.

Despite a sizeable backlog I still bought stuff. American Truck Simulator, The Longing, and Subnautica.

Edit: awww :’(

Direct hit, captain!