thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

schacon

#!/bin/bash

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
NO_COLOR='\033[0m'
BLUE='\033[0;34m'
YELLOW='\033[0;33m'
NO_COLOR='\033[0m'

jscher2000

// Run code in Browser Console after enabling chrome debugging --
// about:config => devtools.chrome.enabled => true
// https://developer.mozilla.org/docs/Tools/Browser_Console
try {
	var tabPromise = SyncedTabs._internal.getTabClients();
	tabPromise.then((arrDevices) => {
		if (arrDevices && arrDevices.length > 0){
			// Generate a string with the format of a bookmark export file
			var d, e, out = '<!DOCTYPE NETSCAPE-Bookmark-file-1>\n<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-8">\n<TITLE>Bookmarks</TITLE>\n<H1>Bookmarks Menu</H1>\n<DL><p>\n';
			const escapeHtmlEntities = function(aText){return (aText || '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;')};

bmaupin

Goal

Find a replacement for Llama (R.I.P. 😢)

Conclusion

🦙 Keep using Llama! 🦙

• Llama still works and no other application seems to match Llama in terms of ease of use and cell-tower location (Llama's killer feature)
• Cell-tower location UX seems to be unmatched by the alternatives (training new locations, ignoring towers, seeing location events)

hurryabit

#!/usr/bin/env node
"use strict";

const fs = require("fs");

const SPEEDSCOPE_JSON_SCHEMA = "https://www.speedscope.app/file-format-schema.json";

const [node, prog, ...options] = process.argv;

if (options[options.length - 2] !== "-o") {

onlurking

Programming as Theory Building

Peter Naur

Peter Naur's classic 1985 essay "Programming as Theory Building" argues that a program is not its source code. A program is a shared mental construct (he uses the word theory) that lives in the minds of the people who work on it. If you lose the people, you lose the program. The code is merely a written representation of the program, and it's lossy, so you can't reconstruct

JacobHayes

#!/usr/bin/env python3
#
# Modified from https://github.com/newren/git-filter-repo/blob/master/contrib/filter-repo-demos/lint-history
#
# pip3 install git-filter-repo black
# git pull
# git remote prune origin # clean up associated local branches too
# python3 black_history.py
# git remote add origin <url>
# git push -u origin --mirror --no-verify

mkows

'''
Based on https://gist.github.com/enjalot/2904124 (in Python 2) -> quick-migrated to Python 3

Usage: python server-cors
'''
import http.server as httpserver

class CORSHTTPRequestHandler(httpserver.SimpleHTTPRequestHandler):
    def send_head(self):
        """Common code for GET and HEAD commands.

johnhw

### JHW 2018
import numpy as np
import umap



# This code from the excellent module at:
# https://stackoverflow.com/questions/4643647/fast-prime-factorization-module
    
import random

ddevault

WAYLAND_PROTOCOLS=/usr/share/wayland-protocols

# wayland-scanner is a tool which generates C headers and rigging for Wayland
# protocols, which are specified in XML. wlroots requires you to rig these up
# to your build system yourself and provide them in the include path.
xdg-shell-protocol.h:
	wayland-scanner server-header \
		$(WAYLAND_PROTOCOLS)/stable/xdg-shell/xdg-shell.xml $@

xdg-shell-protocol.c: xdg-shell-protocol.h