thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

Nick-Gabe

(function (interval = 0) {
  document
    .querySelectorAll('[class="artdeco-button artdeco-button--2 artdeco-button--secondary ember-view invitation-card__action-btn"]')
    .forEach((btn, i) => setTimeout(() => btn.click(), i * interval));
})(1000)
// You can change the 1000, it will be the interval to avoid spamming all at once

bramtechs

Upgrade Debian 9 (current WSL) to Debian 12 (bookworm testing)

Note: I do not maintain this gist anymore, but people report that it still works. Please check the comments for any revisions or extra things you should take into consideration.

As of writing, the Debian distro for WSL (Windows Subsystem for Linux) is quite old.

You can get more up-to-date package managers, text-editors and compilers by upgrading WSL to Debian 12 (current testing).

• Root required
• Use at your own risk, preferably on a fresh installation.

swuecho

#
# The official PVE docs on how to prepare cloud-init templates:
#   https://pve.proxmox.com/wiki/Cloud-Init_Support#_preparing_cloud_init_templates
#
# Additional guides and resources:
#   https://dae.me/blog/2340/how-to-add-an-existing-virtual-disk-to-proxmox/
#   https://pve.proxmox.com/pve-docs/qm.1.html

# use the Qemu/KVM Virtual Machine Manager to import the disk
qm importdisk 107 Univention-App-kopano-core-KVM.qcow2 local-lvm

VitorBlog

import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.io.OutputStream;
import java.net.URL;
import java.net.URLConnection;
import java.util.stream.Collectors;

public class HasteBin {

uptimizt

 gzip -d backup-20100910164109.sql.gz

samueldcs

<?php
    /**
     * Classe Bhaskara, onde calculamos
     * o conjunto solucão de uma equacão
     * dados os valores dos coeficientes
     * a, b e c.
     *
     * @author Samuel Simão
     *
     */

Manouchehri

# Source:
# https://www.cloudflare.com/ips
# https://support.cloudflare.com/hc/en-us/articles/200169166-How-do-I-whitelist-CloudFlare-s-IP-addresses-in-iptables-

for i in `curl https://www.cloudflare.com/ips-v4`; do iptables -I INPUT -p tcp -m multiport --dports http,https -s $i -j ACCEPT; done
for i in `curl https://www.cloudflare.com/ips-v6`; do ip6tables -I INPUT -p tcp -m multiport --dports http,https -s $i -j ACCEPT; done

# Avoid racking up billing/attacks
# WARNING: If you get attacked and CloudFlare drops you, your site(s) will be unreachable. 
iptables -A INPUT -p tcp -m multiport --dports http,https -j DROP

quagliato

<select id="estado" name="estado">
    <option value="AC">Acre</option>
    <option value="AL">Alagoas</option>
    <option value="AP">Amapá</option>
    <option value="AM">Amazonas</option>
    <option value="BA">Bahia</option>
    <option value="CE">Ceará</option>
    <option value="DF">Distrito Federal</option>
    <option value="ES">Espírito Santo</option>
    <option value="GO">Goiás</option>

denji

Moved to git repository: https://github.com/denji/nginx-tuning

NGINX Tuning For Best Performance

For this configuration you can use web server you like, i decided, because i work mostly with it to use nginx.

Generally, properly configured nginx can handle up to 400K to 500K requests per second (clustered), most what i saw is 50K to 80K (non-clustered) requests per second and 30% CPU load, course, this was 2 x Intel Xeon with HyperThreading enabled, but it can work without problem on slower machines.

You must understand that this config is used in testing environment and not in production so you will need to find a way to implement most of those features best possible for your servers.