thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

OrionReed

// 3D Dom viewer, copy-paste this into your console to visualise the DOM as a stack of solid blocks.
// You can also minify and save it as a bookmarklet (https://www.freecodecamp.org/news/what-are-bookmarklets/)
(() => {
  const SHOW_SIDES = false; // color sides of DOM nodes?
  const COLOR_SURFACE = true; // color tops of DOM nodes?
  const COLOR_RANDOM = false; // randomise color?
  const COLOR_HUE = 190; // hue in HSL (https://hslpicker.com)
  const MAX_ROTATION = 180; // set to 360 to rotate all the way round
  const THICKNESS = 20; // thickness of layers
  const DISTANCE = 10000; // ¯\\_(ツ)_/¯

xdesro

/**
 *  @param {import("@11ty/eleventy/src/UserConfig")} eleventyConfig
 */
module.exports = (eleventyConfig) => {
  return {};
};

franky47

{
  "explorer.experimental.fileNesting.enabled": true,
  "explorer.experimental.fileNesting.patterns": {
    "*.ts": "$(capture).js, $(capture).d.ts, $(capture).test.ts",
    "*.js": "$(capture).js.map, $(capture).min.js, $(capture).d.ts, $(capture).test.js",
    "*.jsx": "$(capture).js",
    "*.tsx": "$(capture).ts, $(capture).*.ts, $(capture).*.tsx",
    "tsconfig.json": "tsconfig.*.json",
    "docker-compose.yml": "docker-compose.*.yml",
    ".env": ".env.*",

jonathantneal

":" //#;exec /usr/bin/env node --input-type=module - $@<$0

import process from 'process'

const { argv } = process

console.log(argv)

bnb

defaults:

• npm config set init-author-name ""
• npm config set init-author-url ""
• npm config set init-author-email ""
• npm config set init-license "ISC"
• npm config set init-version "1.0.0"

custom (example)

• npm config set init-author-name "Tierney Cyren"
• npm config set init-author-url "https://bnb.im"

trungpv1601

let NETWORK_PRESETS = {
  'GPRS': {
    'offline': false,
    'downloadThroughput': 50 * 1024 / 8,
    'uploadThroughput': 20 * 1024 / 8,
    'latency': 500
  },
  'Regular2G': {
    'offline': false,
    'downloadThroughput': 250 * 1024 / 8,

malchata

// This is Node script that uses Puppeteer (headless Chrome) to measure the decode time
// of a single image injected into a blank HTML document. It uses minimist to take command
// line arguments. Example usage: node measure-image-decode.js https://example.com/example-image.jpg
// This example assumes you're running a local server to grab the blank document.
// Thanks to Paul Irish and Tim Kadlec for their input!

const puppeteer = require("puppeteer");
const argv = require("minimist")(process.argv.slice(2));

async function getDecode(url) {

ebidel

<!-- 
Complete feature detection for ES modules. Covers:

1. Static import: import * from './foo.js';
2. Dynamic import(): import('./foo.js').then(module => {...});

Demo: http://jsbin.com/tilisaledu/1/edit?html,output

Thanks to @_gsathya, @kevincennis, @rauschma, @malyw for the help.
-->

samthor

// UPDATE: In 2023, you should probably stop using this! The narrow version of Safari that
// does not support `nomodule` is probably not being used anywhere. The code below is left
// for posterity.

/**
 * Safari 10.1 supports modules, but does not support the `nomodule` attribute - it will
 * load <script nomodule> anyway. This snippet solve this problem, but only for script
 * tags that load external code, e.g.: <script nomodule src="nomodule.js"></script>
 *
 * Again: this will **not** prevent inline script, e.g.: