thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

Mic92

#!/usr/bin/env python3
import http.client
import json
import os
import time
import urllib.parse
import urllib.request
from pathlib import Path
from typing import Any

s1341

{
  config,
  lib,
  ...
}: let
  cfg = config.services.freeipa-server;
in {
  options.services.freeipa-server = {
    enable = lib.mkEnableOption "freeipa service";
    router = lib.mkOption {

kurohouou

blueprint:
  name: Low Battery and Device Unavailable Check
  description: Regularly test all sensors with 'battery' device-class for crossing
    a certain battery level threshold as well as if it is unavailable.
  domain: automation
  input:
    threshold:
      name: Battery warning level threshold
      description: Battery sensors below threshold are assumed to be low-battery (as
        well as binary battery sensors with value 'on').

mfenniak

{ pkgs, ... }:

let
  readlink = "${pkgs.coreutils}/bin/readlink";
  notify-send = "${pkgs.libnotify}/bin/notify-send";
in {
  systemd.user.services.detect-reboot-for-upgrade = {
    script = ''
      set -eu -o pipefail

gnremy

christianparpart

Synchronized Output

Synchronized output is merely implementing the feature as inspired by iTerm2 synchronized output, except that it's not using the rare DCS but rather the well known SM ? and RM ?. iTerm2 has now also adopted to use the new syntax instead of using DCS.

Semantics

When rendering the screen of the terminal, the Emulator usually iterates through each visible grid cell and renders its current state. With applications updating the screen a at higher frequency this can cause tearing.

This mode attempts to mitigate that.

cketti

// ==UserScript==
// @name         Element youtube preview
// @namespace    http://tampermonkey.net/
// @version      0.3
// @description  fix the embeds!!
// @author       Cinnabar
// @author       cketti
// @match        https://app.element.io
// @match        https://your.element.url.example
// @icon         data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==

danieldk

Rough procedure for updating cargo hashes. Warning: this still requires a lot
of manual work to cover all bases. Based on:

https://github.com/NixOS/nixpkgs/pull/112764/commits/2650d5d2b8c19844224f8b368887153e2f18fdae

# Invalidate all hashes

rg -l "cargoHash" | grep "\.nix" |  xargs -n1 sed -i -re 's/cargoHash = "..../cargoHash = "sha256-1234/g'
rg -l "cargoSha256" | grep "\.nix" |  xargs -n1 sed -i -re 's/cargoSha256 = "[^s].../cargoSha256 = "1234/g'
rg -l "cargoSha256" | grep "\.nix" |  xargs -n1 sed -i -re 's/cargoSha256 = "sha256-..../cargoSha256 = "sha256-1234/g'

Konfekt

To diff common binary files in git using appropriate external converters such as unrtf, pandoc, docx2txt.pl, odt2txt, git-xlsx-textconv, git-xlsx-textconv.pl or pptx2md, add to ~/.config/git/config the lines

[diff]
  [diff "pdf"]
    binary = true
    # textconv = pdfinfo
    textconv = sh -c 'pdftotext -layout "$0" -enc UTF-8 -nopgbrk -q -'
    cachetextconv = true