rietta

I agree. And unstated in this write up is the direct upload route. Even if your Cloudflare was perfect, once the attacker got the preflight they send the binary file up to S3 directly and then hit the variant route directly. The first code to “validate” the upload was the exploitable libvips code.

Correct, which is how the ActiveStorage gem was patched. After this, Rails raises a Vips::Error: VipsForeignLoad exception on an attempted variant render of a malicious file. I plan on writing a technical detail post soon with some more code level details and "indicators of compromise" but this one was getting long. This is more for management to understand why wait to patch is a major issue. The discovery to active exploit attempt timeline is the story here.

I am not sure, but my read on the original disclosure is no. libvips itself has a variant processor for matlab v5 files, which the exploit took advantage of.

Cloudflare or a WAF may or may not help. These can often catch and block specific bot traffic, but not every attack payload is delivered naively. It would be part of a defense in depth. Having the underlying vulnerability fixed is critically important. For those on AWS, WAF & Shield is also very useful but at the end of the day these let legitimate traffic through, such as legitimately uploading a file that only in its contents is malformed.

Hugged to death? website is not working for me from the xfinity network.

There are way worse choices to fall back on than LibreOffice. Heck, it's the primary tool I actually use in my business. I can tell you first hand that it does not handle all the random stuff that corporate Excel users come up with, but if you start with basic principles the files usually work great in the other direction.

This is something Windows and Mac OS got right in the 1990s. I remember reading specifically about it in terms of digital accessibility too at the time.

They got painfully expensive and then acquired. I still remember the arguments with clients and finally went all in AWS ECS, which is still quite pricey but clients seem to complain less about the Amazon bill then they did about Heroku.

Oh! That's a term I have not heard in a long time!

I am doing metadata auditing for government documents these days and there are UUIDs in lots of files going back a very long time. I have certainly seen them in PDFs and Word and Excel documents that long predated the current AI integrations.

Edit to add: I just tested LibreOffice/26.2.5.2 and it is not injecting a UUID into the metadata either for a ODT or a DOCx (2007) file. I do not have native MS Office available on hand to test at the moment. I do see these UUIDs in published government documents but cannot swear to exactly what step of the pipeline is stamping them. Definitely on files that predate the AI integration push by Microsoft.

That is about the time I started using Claude Code as a paid account at any level. Previously I was extremely skeptical. Overall, it works and it has sorted out some things I would have probably let go for a lot longer especially with the markup on my very ancient website. Markup issues, template migrations, maintaining stringent preservation going back to HTML that was hand crafted in the late 1990s. I also learned quickly you cannot ask the magic 8 ball to solve things. You have to make it read, and plan, and then review and go back and forth with it. This can legitimately take hours. The difference is I can oft get most of the website modernized rather than just some of it following the more traditional methods. I've also seen how one can hit those limits pretty quickly, if they are going down from here that will make it less useful. And no way I am paying more on a usage credit basis. Prior to this, all my code work had been strictly with local AI as the inference engine and I can go back to that.

Edit to add: As a 3 month experiment, it has been positive. I have gotten things to work that none of the people I have hired and paid over the years took care of. And I myself have been too busy to prioritize. It's a useful tool, but only a fool would think it replaces the judgment of a professional. Not yet anyway.

I appreciate this personal account. I too enjoy a good book and it can bring back memories.

Also looking at your photo, I am in shock with how clean and organized you are. That is one area where my family struggles both because our house is relatively small and also because we have little bitty kids. My wife would be "in heaven" if we ever got the house as clean as yours. We both work and I do my best to clean and tidy throughout the week. But clutter and the kid stuff always takes over.

I do have my personal misgivings on passkeys based on the current implementation trajectory, but am still working out the details before writing on them. If anyone has direct experience with the recovery modes as used by real people, I would love to hear it. This will be a future blog post for me.

I wrote this yesterday before seeing the news about the Firefox iOS native ad blocker. Still working through my bookmark management but off to a good start. I wish I had made the full leap years ago.

I have a 1st grader. The public school did tag testing in kindergarten and then the children in the program have a special class on Mondays for the more challenging work. Is this not talented and gifted? They call it TAG.

I have it after I shot an indoor USPSA (IPSC) match right after a major ear infection. I always wear double ear plugs and muffs. The ENT I saw said he thought it was the infection that did it not the shooting. My hearing test came back very good despite the ringing. It’s always there, especially when it’s dead silent but after about four years, I don’t think about it anymore most of the time. I always wear shooting grade earmuffs even when doing yardwork with a lawnmower and the weedeater, I baby my hearing the best I can. It is a good reminder that we only get it once.

And thus demarcs the extinction of games published after that date. 100 years from now those disks will be all that is knowable to the extent libraries and museums preserve compatible drives.

There is no cross platform standard that accomplishes the goals that authors turn to TUIs to solve. There is no widely distributed remotely accessible interface that pops up GUI windows from a shell context that works everywhere.

Seems Backblaze does not even read their own blog with articles about 3-2-1 backups and sync not being the same as backup.

I upgraded to a 4070 super last year. I ran both cards at the same time for a little bit, but it got really frustrating to keep the wrong card from being assigned to a particular task with llama. I really should’ve taken an R&D tax credit on my AI research but I’m still able to expense it for the business.

I am so grateful that I bought my 128 GB ram kit in January of last year for my own 9950 upgrade. We just built my dad a 7000 series to replace his old AM4 (2017 build) and 32 gigs DDR five was nearly the same price at Micro Center that I paid last year. I was able to gift him an Nvidia 1060 discreet graphics card so that he could continue to run his two monitors. The newer motherboards have much less on board capability for that.

We have one at the local park nearby. A neighbor also has one in her front yard. It's a really neat concept!

The server is not returning anything. Is this a honeypot that now has firewalled my IP for trying to see that page or is the site just hugged to death?

Hence my question.

What is the best alternative that can run as a Docker image that mimics AWS S3 to enable local only testing without any external cloud connections?

For me, my only use for Minio was to simulate AWS S3 in docker compose so that my applications were fully testable locally. I never used it it production or as a middle ware. It has not sat well with me to use alternative strategies like Ruby on Rails' local file storage for testing as it behaves differently than when the app is deployed. And using actual cloud services creates its own hurdles of either credential sharing among developers and gets rid of the "docker magic" of being to run a single set up script and be up and running to change code and run the full test suite.

My use case is any developer on the team can do a Git clone and run the set up script and then be fully up and running within minutes locally without any special configuration on their part.

Anyone interested in keeping access should fork this open source repository now and make a local archived copy. That way when this organization deletes this repository there can still be access to this open source code.

In the Ruby on Rails space, we had this happen recently with the prawn_plus Gem where the original author yanked all published copies and deleted the GitHub repository.

On GitHub, when a private repo is deleted forks are deleted. But for public repos, the policy is different. See https://docs.github.com/en/pull-requests/collaborating-with-....

This is the latest of a sunset trap set for those of us who use Minio for local testing but not production use.

It was certainly popular enough to be included in the 4th-century Codex Sinaiticus, which is the oldest extant "complete" Bible (Genesis through Revelation) in a single bound volume. Interestingly, in that manuscript, The Shepherd of Hermas and the Epistle of Barnabas actually appear right after the New Testament. The library has published scanned copies online at https://www.codexsinaiticus.org/en/. It is an epic resource for anyone studying this history or textual criticism.

Spot on. The Criterion of Embarrassment is a powerful tool here; the fact that women were the primary witnesses to the resurrection is a classic example, given that a woman's testimony held little to no legal weight in 1st-century Roman or Jewish contexts. If you were inventing a myth to gain social traction, you simply wouldn't write it that way.

Your point about verisimilitude extends to Onomastics as well. Research shows that the New Testament Gospels accurately reflect the specific frequency of Jewish names in 1st-century Palestine. In contrast, Gnostic texts often use names that don't fit the era or geography, frequently showing 3rd-century Egyptian linguistic influences instead. It suggests the canonical authors had "boots on the ground" knowledge that the later Gnostic writers lacked.

This has been a source I’ve referred to on and off for years. It’s really interesting to read some things that don’t show up in our everyday Bible. Including things that were considered not canon by the early church. I enjoyed reading the translation of the Shepherds of Hermas. It was not the easiest to follow, but in a sense it was a very popular allegory like Pilgrim’s Progress was centuries later!

Extremely interesting read. I need to go back over it again in detail on my computer not just my phone while holding my baby.

A key theme in a future fiction I am writing (slowly) is that all digital data has been lost and the time we are in now is known as a digital dark age where little is known about our society and culture. Resurrecting an archeologically discovered DVD is a key plot point I am working through. That it will be the first insight into our time in over a millennium. Other conflicting interests will be finally succeeding at re-introducing corn at commercial scale after all hope had been lost and past attempts at re-germinating from the frozen seed bank had failed for hundreds of years. It's a work in progress.