thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

fabaff

"""Support for the SpaceAPI."""
from contextlib import suppress

import voluptuous as vol

from homeassistant.components.http import HomeAssistantView
from homeassistant.const import (
    ATTR_ENTITY_ID,
    ATTR_ICON,
    ATTR_LOCATION,

artizirk

# Matrix Synapse workers example config 

# backends
upstream synapse_master {
	server 192.19.18.12:38008;
}

upstream synapse_federation {
	server 192.19.18.12:8083;
}

chriswayg

Cloud images in Proxmox

• Preparing Cloud-Init Templates
• Cloud-Init Support - Proxmox VE
• Proxmox VE Administration Guide

A script which automates these steps for multiple distros incl. CoreOS, CentOS, Arch and ALpine

• create-cloud-template.sh

Steps for creating an Ubuntu 18.04 cloud template

• Using a ready-to-use Ubuntu image

mschep

# Very minimal BIRD2 configuration with RPKI enabled

log syslog { info, remote, warning, error, auth, fatal, bug };
log "/var/log/bird.debug.log" { debug, remote, trace };

router id 193.0.31.28;

protocol device {
}

susam

Recon and Attack Vectors from My Logs

This document contains excerpts from my web server logs collected over a period of 7 years that shows various kinds of recon and attack vectors.

There were a total of 37.2 million lines of logs out of which 1.1 million unique HTTP requests (Method + URI) were found.

$ sed 's/^.* - - \[.*\] "\(.*\) HTTP\/.*" .*/\1/' access.log > requests.txt

leoluk

#!/usr/bin/python3 -u

import asyncio
import sh

from systemd import journal
from systemd.daemon import notify


GATEWAY_IP = "192.168.10.1"

Mic92

{ pkgs ? import <nixpkgs> {} }:

let
  fixWrapper = pkgs.runCommand "fix-wrapper" {} ''
    mkdir -p $out/bin
    for i in ${pkgs.gcc.cc}/bin/*-gnu-gcc*; do
      ln -s ${pkgs.gcc}/bin/gcc $out/bin/$(basename "$i")
    done
    for i in ${pkgs.gcc.cc}/bin/*-gnu-{g++,c++}*; do
      ln -s ${pkgs.gcc}/bin/g++ $out/bin/$(basename "$i")

edolstra

This document contains some ideas for additions to the Nix language.

Motivation

The Nix package manager, Nixpkgs and NixOS currently have several problems:

• Poor discoverability of package options. Package functions have function arguments like enableFoo, but there is no way for the Nix UI to discover them, let alone to provide programmatic ways to

YtvwlD

[[source]]
url = "https://pypi.org/simple"
verify_ssl = true
name = "pypi"

[packages]
mpris2 = "*"
paho-mqtt = "*"
dbus-python = "*"
pygobject = "*"