martenson

FAQ on the xz-utils backdoor

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that gives developers lossless compression. This package is commonly used for compressing release tarballs, software packages, kernel images, and initramfs images. It is very widely distributed, statistically your average Linux or macOS system will have it installed for

martenson

// 3D Dom viewer, copy-paste this into your console to visualise the DOM as a stack of solid blocks.
// You can also minify and save it as a bookmarklet (https://www.freecodecamp.org/news/what-are-bookmarklets/)
(() => {
  const SHOW_SIDES = false; // color sides of DOM nodes?
  const COLOR_SURFACE = true; // color tops of DOM nodes?
  const COLOR_RANDOM = false; // randomise color?
  const COLOR_HUE = 190; // hue in HSL (https://hslpicker.com)
  const MAX_ROTATION = 180; // set to 360 to rotate all the way round
  const THICKNESS = 20; // thickness of layers
  const DISTANCE = 10000; // ¯\\_(ツ)_/¯

martenson

# I ran each block individually by hand by pasting =P

df -hl /var/lib/docker /var/jenkins && \
systemctl stop docker && \
umount /var/lib/docker && \
pkill -u jenkins

# wait a few seconds, but not too long because Jenkins will reconnect D=

umount /var/jenkins && \

martenson

Run the installer

Make sure nobody is running a docker container before restarting the service...

MAIN

$ ssh g2main@cvmfs0-tacc0.galaxyproject.org
$ cvmfs_server transaction main.galaxyproject.org
$ systemctl restart docker.service
$ docker run --rm -v /cvmfs:/cvmfs -p 127.0.0.1:8818:8888 galaxy/main_installer

martenson

Backbone.js
BlameHighlighter
DocBlockr
EasyDiff
FileDiffs
Git
GitGutter
Indent XML
JSON Reindent
LESS

martenson

--- from_file
+++ untitled 1
@@ -9,13 +9,22 @@
 from optparse import OptionParser
 
 parser = OptionParser()
-parser.add_option( '-c', '--config', dest='config', help='Path to Galaxy config file (universe_wsgi.ini)', default='universe_wsgi.ini' )
+parser.add_option( '-c', '--config', dest='config', help='Path to Galaxy config file (config/galaxy.ini)', default=None )
 parser.add_option( '-e', '--egg-name', dest='egg_name', help='Egg name (as defined in eggs.ini) to fetch, or "all" for all eggs, even those not needed by your configuration' )
 parser.add_option( '-p', '--platform', dest='platform', help='Fetch for a specific platform (by default, eggs are fetched for *this* platform' )

martenson

128.118.201.178 - - [05/May/2014:15:12:06 -0400] "PUT /api/histories/e89067bb68bee7a0/set_as_current HTTP/1.1" 200 - "http://martenson.bx.psu.edu:8080/library/list" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36"

galaxy.web.framework ERROR 2014-05-05 15:13:07,230 Uncaught exception in exposed API method:
Traceback (most recent call last):
  File "/Users/marten/marten-galaxy/lib/galaxy/web/framework/__init__.py", line 331, in decorator
    rval = func( self, trans, *args, **kwargs)
  File "/Users/marten/marten-galaxy/lib/galaxy/webapps/galaxy/api/histories.py", line 139, in set_as_current
    trans.history = history
  File "/Users/marten/marten-galaxy/lib/galaxy/web/framework/__init__.py", line 1022, in set_history
    self.galaxy_session.current_history = history