photon-torpedo

Red Hat security bulletin on this incident: https://access.redhat.com/security/vulnerabilities/RHSB-2026...

Quote:

> The affected packages are frontend libraries that are compiled and bundled into some container images during the Red Hat product build process.

So you might be affected if you deployed any Red Hat container images built after the compromise, I guess. (I doubt anyone besides Red Hat is using the affected packages directly.)

You can listen to the Wizball tunes here:

https://deepsid.chordian.net/?file=/MUSICIANS/G/Galway_Marti...

(use the little up/down arrows to switch between subtunes)

Minio recently started removing features from the community version. https://news.ycombinator.com/item?id=44136108

Good question. Something to do with interactive mode?

  $ cat l.sh
  alias l=ls
  l
  $ sh l.sh
  file1  file2  l.sh
  $ bash l.sh
  l.sh: line 2: l: command not found
  $ bash -i l.sh
  file1  file2  l.sh

Edit: Ah yes, the man page says so.

> Aliases are not expanded when the shell is not interactive, unless the expand_aliases shell option is set using shopt

Report from the Taiwan agency:

https://www.cwa.gov.tw/V8/E/E/EQ/EQ113019-0403-075809.html

And a list of all recent earthquakes, showing the aftershocks:

https://www.cwa.gov.tw/V8/E/E/index.html

At least 1.2PB...

https://www.youtube.com/watch?v=R2S2RMNv7OU

> is for them to have broken the encryption algorithms behind TLS/HTTPS.

Or if they have access to, or can subpoena, a MitMaaS for HTTPS. Like Cloudflare.

This is nice, but unfortunately

> Rosetta doesn’t support the bootstrapping or installation of Intel Linux distributions on Mac computers with Apple silicon using the Virtualization framework.

So I guess it still won't be possible to run RHEL (or derivative) VMs on Apple Silicon. (Their aarch64 images don't work, something obscure with page size IIRC. Odd because Debian/Ubuntu's aarch64 work fine.)

Edit: Looks like RHEL9 has changed page size so it can run as a VM on Apple Silicon. Unfortunately my common use case for VMs is to prototype things for production, and that's all on RHEL7/8. :(

> do they consider the memory is faulty when there are correctable errors?

It depends on the frequency. Occasional CEs are somewhat expected (on a large enough scale) and one can live with them, after all that's what ECC is for. When CEs start happening frequently on one machine, most likely a DIMM is going bad and will worsen over time, so one should replace it.

> The question was: which DIMM should we replace?

On server-class machines, ECC errors often also show up in the system event log, so one can run "ipmitool sel list" and inspect the most recent messages, and they often point to the failing DIMM in a nomenclature that corresponds to how the slots are labelled on the mainboard or in its manual.

In this case, they are using a "gaming" mainboard, so this strategy probably doesn't work (no nice system event log).

The author mentions that they also wrote a backup program (bup), and for backup programs it would be very convenient if directory mtimes would get updated like this (recursively up to the root), as it would allow to skip scanning the entire filesystem for changed files (which in my experience is where backup programs spend most of their time).

> pow(pow(pow(pow(pow(2, 2), 2), 2), 2), 2))

The Julia equivalent is:

    julia> ((((2^2)^2)^2)^2)^2
    4294967296

Julia's ^ is right-associative.

The root password hash is not sufficient to log in as root, but knowing the hash enables an attacker to run an offline brute-force attack to crack the password. Depending on the password complexity, this may or may not be feasible.

That said, this attack may be able to extract other information from system memory that would enable de-facto root access, it depends a lot on what's running on the machine.

> What can we do?

Install the patches and enjoy the reduced performance. Or run Linux on ARM, and hope that noone will find similar exploits in the ARM architecure.

Well, that's sorted then.

XFS V5 filesystems can be upgraded: https://wiki.gentoo.org/wiki/XFS#Year_2038_timestamp_support...

Edit: I see that V5 is the upstream default since "only" ~2015, so indeed there are likely many V4 filesystems still around.

> The person who knows most about the hardware on which the program will be run is the person running it, not the programmer.

Then again, in scientific computing, often these are the same person.

Also: https://www.theregister.com/2022/06/08/google_blocking_priva...

According to this, Google wants to drop Manifest v2 support in Jan 2023.

Great timing. Here in the UK it's a four-day weekend. Can imagine that many affected will see this too late...

Perhaps see this past discussion: https://news.ycombinator.com/item?id=18612590

> Anyone interested in mechanical keyboards surely is able to use Google to find decent offers.

Umm, there are now almost daily threads on HN about how bad Google search has become, especially for product search... So I'd guess many people will be happy about a no-nonsense offering from a somewhat reputable manufacturer like Logitech.

Careful, your #2 and #3 are incorrect -- skip and seek operate with blocks, not bytes. So your #2 would copy 32 bytes after the first 32kB of data, and #3 would write 512 bytes at position 5120k.

> but practical algorithms with better exponents exist for all of them.

I'm aware of randomized algorithms with better complexity, which come at the cost of only giving approximate results (though the approximation may be perfectly good for practical purposes). See e.g. [1]. Are there other approaches?

[1] https://doi.org/10.1137/090771806

Thanks! This also works in Firefox 100.

Apart from the local lockdowns, China as a whole has recently issued a ban on international travel from China, making it difficult for people to leave the country. So in some sense, the whole population is locked down (or locked in). Source e.g. https://edition.cnn.com/2022/05/13/china/china-covid-outboun...

P2P market places already exists, I guess. The tricky part is how parties can trust each other, and I think this might actually be solvable by blockchain / smart contract tech. Basically a smart contract takes the role of the trusted intermediary / escrow account. I believe this is being worked on (e.g. Nexus ASA on the Algorand blockchain).

Another lesson: Keep your own copy of all files. Use takeout.google.com.

Then if the password manager is compromised, the second factor wouldn't add any protection over just a password.

Then again, people that use password managers at all usually have stronger passwords and less password reuse, so it can be an acceptable tradeoff.

Apart from all the advice on how to do such destructive operations more safely, I think there's also a lesson to be learned about communicating more actively:

1. Vimeo responds to the original request with "will look into it", then... nothing happens? This may depend on culture, but at least from my experience in the UK, this is a very non-committal response, and if you really want them to do something, you'll need to chase them. Wait a few days and inquire if they have any estimate for when it might get done, or if they need more information. I find that the "looking into it" response is sometimes used to gauge how important the request is to you.

2. Once you go with your own solution, just drop a quick message to Vimeo: "Hey, just wanted to let you know we've found our own solution for this, and won't require your help any more. Sorry if you've already committed any resources for this task. Have a nice day, yada yada." This not just avoids what happened here, but is also a courtesy to them.

> What are people using VPNs for mostly, if they're living in a country without internet censorship?

Current example: https://news.ycombinator.com/item?id=31248250

Also, rsync can create more faithful copies than scp. E.g. scp can't copy a symlink as a symlink, instead it will follow the symlink and copy the file or directory.