thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

wesleybliss

version: '2'
services:
    myapp:
        build: .
        container_name: "myapp"
        image: debian/latest
        environment:
            - NODE_ENV=development
            - FOO=bar
        volumes:

estesp

The new generic distributed content manifest format (schema version 2) [see distribution/distribution#62] is approaching final approval, and while some discussion has happened in-line, it seems reasonable to break out the various pieces that would be required to implement a multi-arch Docker image solution on top of the flexible manifest format being proposed.

As a starting point it is useful to discuss what the intended use case is for multi-architecture images in the Docker platform. The following requirements summarize the expected capabilities of the engine + registry + storage/retrieval format that is implemented.

Requirements

• A specific repository name:tag manifest will need to contain the proper information for access/retrieval of multiple architectures
  • For example docker pull ubuntu:15.04 should have the capability on a POWER system to pull the POWER-specific image layers which comprise an Ubuntu 15.04 image
• Not every name:tag manifests will have information for

thatalextaylor

def pretty_time_delta(seconds):
    sign_string = '-' if seconds < 0 else ''
    seconds = abs(int(seconds))
    days, seconds = divmod(seconds, 86400)
    hours, seconds = divmod(seconds, 3600)
    minutes, seconds = divmod(seconds, 60)
    if days > 0:
        return '%s%dd%dh%dm%ds' % (sign_string, days, hours, minutes, seconds)
    elif hours > 0:
        return '%s%dh%dm%ds' % (sign_string, hours, minutes, seconds)

chilts

var request = require('request');
var unzip   = require('unzip');
var csv2    = require('csv2');

request.get('http://s3.amazonaws.com/alexa-static/top-1m.csv.zip')
    .pipe(unzip.Parse())
    .on('entry', function (entry) {
        entry.pipe(csv2()).on('data', console.log);
    })
;

killercup

/*
 * I add this to html files generated with pandoc.
 */

html {
  font-size: 100%;
  overflow-y: scroll;
  -webkit-text-size-adjust: 100%;
  -ms-text-size-adjust: 100%;
}

d3m3vilurr

IDs

• user_id - user/:uid
• feed_id - feed/:feed_uri
• category_id - :user_id/category/:category (special category: global.all, global.uncategorized)
• tag_id - :user_id/tag/:tag (special tag: global.saved)

APIs

http://cloud.feedly.com/:version/:api

skull-squadron

killall ssh-agent; eval `ssh-agent`