thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

keilmillerjr

Convert Manjaro to Arch Linux

Conversion Script

1. Download, make, and run script.

$ git clone https://github.com/kskeigrshi/manjaro-to-archlinux.sh
$ cd manjaro-to-archlinux.sh
$ makepkg
$ ./to_arch

anonfloppa

select event_json.json::json->'content'->>'body' as message,
       events.room_id,
       room_stats_state.name,
       events.sender
from events 
left outer join event_json on 
    events.event_id=event_json.event_id
left outer join room_stats_state on 
    room_stats_state.room_id=events.room_id
where event_json.json::json->'content'->>'body'<>'' and events.sender='@ACCOUNT_NAME:SERVER.DOM';

nitred

About

• I faced bandwidth issues between a WG Peer and a WG server. Download bandwidth when downloading from WG Server to WG peer was reduced significantly and upload bandwidth was practically non existent.
• I found a few reddit posts that said that we need to choose the right MTU. So I wrote a script to find an optimal MTU.
• Ideally I would have liked to have run all possible MTU configurations for both WG Server and WG Peer but for simplicity I choose to fix the WG Server to the original 1420 MTU and tried all MTUs from 1280 to 1500 for the WG Peer.

Testing

• On WG server, I started an iperf3 server
• On WG peer, I wrote a script that does the following:
  • wg-quick down wg0
• Edit MTU in the /etc/wireguard/wg0.conf file

ZipFile

Retrieving Auth Token

1. Run the command:

   python pixiv_auth.py login

   This will open the browser with Pixiv login page.

marguerite

for (i in activities()) {
  activityID = activities()[i];
  desktops = desktopsForActivity(activityID)
  for (j in desktops) {
    desktop = desktops[j];
    desktop.wallpaperPlugin = "org.kde.image";
    desktop.wallpaperMode = "Scaled and Cropped";
    desktop.currentConfigGroup = new Array("Wallpaper", "org.kde.image", "General");
    desktop.writeConfig("Image", "file:///home/zhou/Pictures/Bing/AlpineLarches_ZH-CN10557456981_1920x1200.jpg");
  }

ixs

#!/usr/bin/env python3
#
# Simple Intel x520 EEPROM patcher
# Modifies the EEPROM to unlock the card for non-intel branded SFP modules.
#
# Copyright 2020,2021,2022 Andreas Thienemann <andreas@bawue.net>
#
# Licensed under the GPLv3
#
# Based on research described at https://forums.servethehome.com/index.php?threads/patching-intel-x520-eeprom-to-unlock-all-sfp-transceivers.24634/

abc1763613206

import requests
import json
import random


Back_URL = 'https://api.bilibili.com/x/web-interface/archive/stat?aid='

headers = {
	'Cookie': "Replace Me With REAL COOKIE" ,
	'Pragma': 'no-cache',

klzgrad

调查目的：了解当前各基于TLS的协议方案中ClientHello的指纹独特性。理论背景见 https://arxiv.org/abs/1607.01639 。

指纹数据库：

• https://tlsfingerprint.io
• https://github.com/cisco/mercury

naiveproxy v78.0.3904.70-4

（利益相关：我是这个的作者）

TrillCyborg

Mastodon Docker Setup

Setting up

Clone Mastodon's repository.

# Clone mastodon to ~/live directory
git clone https://github.com/tootsuite/mastodon.git live
# Change directory to ~/live

cd ~/live