thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

juanje

# This is a simple example of how to run a basic service inside a container with Podman

# Podman
## Pull the Docker image
podman pull docker.io/redis

## Run the container as you would do with Docker
podman run -d --name redis_server -p 6379:6379 redis

# But Podman facilitate some extra ways:

rafael-neri

<?php

function validaCPF($cpf) {
 
    // Extrai somente os números
    $cpf = preg_replace( '/[^0-9]/is', '', $cpf );
     
    // Verifica se foi informado todos os digitos corretamente
    if (strlen($cpf) != 11) {
        return false;

brcontainer

// ==UserScript==
// @name         UxHomologation
// @namespace    http://tampermonkey.net/
// @version      0.1
// @description  Ajuda a detectar se esta em que ambiente baseado no domínio
// @author       Guilherme Nascimento
// @match        *://dominio-do-ambiente-de-homologação.com.br/*
// @grant        none
// ==/UserScript==

define-private-public

// Filename:  HttpServer.cs        
// Author:    Benjamin N. Summerton <define-private-public>        
// License:   Unlicense (http://unlicense.org/)

using System;
using System.IO;
using System.Text;
using System.Net;
using System.Threading.Tasks;

umidjons

Simple Web service - SOAP Server/Client in PHP

Implementation of the SOAP server - server.php:

<?php
// turn off WSDL caching
ini_set("soap.wsdl_cache_enabled","0");

// model, which uses in web service functions as parameter

pavelbinar

/* Random Boolean */

var randomNumber = Math.random() >= 0.5;
console.log(randomNumber);

uris77

# This is a very crud example of using the Repository Pattern with SQLAlchemy. It allows me to completely ignore interactions with 
# the database. This is only pulled in whenever I require to persist or retrieve an object from the database. The domain/business 
# logic is entirely separated from persistence and I can have true unit tests for those.

# The tests for persistence are then limited to very specific cases of persistence and retrieving instances, and I can do those 
# independent of the business logic. They also tend to be less tests since I only need to test them once.

jonashansen229

<?php
/*
* Mysql database class - only one connection alowed
*/
class Database {
	private $_connection;
	private static $_instance; //The single instance
	private $_host = "HOSTt";
	private $_username = "USERNAME";
	private $_password = "PASSWORd";

banaslee

eXtreme Go Horse (XGH) Process

Source: http://gohorseprocess.wordpress.com


1. I think therefore it's not XGH.
In XGH you don't think, you do the first thing that comes to your mind. There's not a second option as the first one is faster.

2. There are 3 ways of solving a problem: the right way, the wrong way and the XGH way which is exactly like the wrong one but faster.
XGH is faster than any development process you know (see Axiom 14).