166 karma · joined March 29, 2019
https://nvd.nist.gov/vuln/detail/CVE-2026-55200
libssh2/libssh2#2052
libssh2/libssh2@97acf3d
https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c
https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc
https://web.archive.org/web/20260623211210/https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc(I hope I'll live to see them all sentenced to life without parole)
(Sadly, it's just Mikrotik gear that can't use any fancy censorship evasion protocols).
And I sincerely hope that you will never have to know what it's like to flee your own country, first hand. Peace.
Have a bit of compassion, would ya?
My childhood crush is in Ukraine (I mean, he's Ukrainian), my dear friend (Ukrainian) had to leave everything and seek refuge in NL. My friends (Russian) are under a constant threat of getting imprisoned for 10+ years because they still help support queer and trans people in Russia.
Compared to them I feel very privileged, because I was able to GTFO on my own. But if you think that all Russian citizens must be deported, you're either a troll or a madman. Besides, this is exactly what, for example, Stalin did to Chechens, or think about what the USA did to the Japanese.
Did it help someone? No. Did it ruin millions of lives? You fucking guess.
upd: made it all clearer, and sorry for all the profanity
Before you ask: yes, dialup works on modern networks if the codec is G.711 (uncompressed). Most public phone network is this way because fax is a thing, but some bulk carriers or some enterprises use compressed codecs.
Example: we bought tickets worth 300 EUR from Deutsche Bahn, they were hit by a DDoS and couldn't complete the transaction.
We got charged *twice* (i.e. 600 EUR and not refunded yet. AND no tickets!!!
Now they claim all they can do is to give us 600 EUR in vouchers (that are not even transferrable).
Would a Chargeback work in this case?
And my friend (who's ordered the tickets) has a very traditional bank that only gives a statement monthly, and probably accepts claims on every 29 of February, between 7 and 8 AM and only by fax (IYKYK those German companies...)
Sorry, I know it's horrible, but I couldn't resist.
The same landlord whose workers outright forgot to install the water heater in the kitchen the day I got the flat, and __painted shut__ the bathroom window. LMAO.
Though I can only second this -- use transparent fiber and be creative in where you route it -- and nobody will be able to tell you did something 'naughty' in your rental.
33kbps is enough to get on IRC and spread the news.
This, and literally all of them have paint chipping off the chassis at the slightest provocation. I have like 50 at work.
edit: we have now a mix of MacBook Airs/Pros (most of workforce), Frameworks (specialized tech roles running Linux and resource-intensive software) and HP ProBooks (run-of-the-mill Windows machines, or just where you don't need anything special at all).
If said junk was alpha- or beta-emitting, it could be enough of a danger for cancer.
What would probably work UNLESS they roll out pretty sophisticated DPI that could block by signatures and do active probing:
1. AmneziaVPN (https://amneziavpn.org) - they have the hosted option, or you could run your own on a cheap VPS (preferable). They use Xray/REALITY or a variant of Wireguard with extra padding that confuses DPIs. Should be good enough.
2. Psiphon
3. Lantern
4. Sometimes Tailscale works surprisingly well (even in Russia where they have advanced DPI systems!)
Here's a link to several Tor browser mirrors for you so you could download the VPN software itself:
https://mirror.freedif.org/TorProject/
https://mirrors.mit.edu/torproject/download/
A couple of Tor bridges in case Tor is blocked:
webtunnel [2001:db8:9947:43ae:8228:97b7:7bd:2c2e]:443 6E6A3FCB09506A05CC8E0D05C7FEA1F5DA803412 url=https://nx2.nexusocean.link ver=0.0.1
webtunnel [2001:db8:a436:6460:fa7b:318:4e8e:9de3]:443 F76C85011FD8C113AA00960BD9FC7F5B66F726A2 url=https://disobey.net/vM8i19mU4gvHOzRm33DaBNuM ver=0.0.2And there's not even the only one (there are other syncitins).
Disclaimer: I'm not a medical professional