Daniel @daniel@campduffel.social
Admin
Nostr:
acd1f62fad47b98657ac57e91c34613201d0ad273f331b67799874b887c42c60
Joined Dec 2019
Ok, we finally got around to getting in the “snow den” it’s like 70F today 😂.
@chiasm I don’t think it’s an insecurity or narcissistic thing but, yeah, I occasionally look through my posts and it’s like checking yourself in the mirror. Totally a good thing to want first impressions to be good and accurate. I also find that my perception of time can be really off, such as when I thought I made a specific post.
@ned I briefly looked into opening a bowling alley…not very profitable and nigh impossible to keep the doors open. The beer is probably their only saving grace.
@ruenoak I haven't used it in a bit. I really liked most of Gemini's philosophy and haven't completely given up on it. The TLS requirement always bugged me and makes setup harder. Server hardware has to be beefier to deal with it too. Gemtext could have been markdown instead of creating yet another flavor of markup. Modern browsers are a nightmare of complexity, but requiring a new one to view Gemini is a hurdle. Something like XHTML solves a lot of the same problems.
@sirjerrykhurl Nice, I’ve painted some stuff in there.
A couple of weeks of solitude in nature, working on some projects, would be nice. Why does that seem so impossible?
@julian What game is that?
Update: Our sitter was thankfully not having a heart attack, but other than a potassium deficiency, they’re not sure what’s going on. We’re glad she went in anyways. They say that death is the first symptom for around 1/3rd of people with heart problems. They can’t really ask those folks, but I suspect that a lot of them just brush off pain hoping it will go away.
It was the supposed to be date night, but the sitter (22) told us that she couldn’t make it because she was going to the hospital because she thought she might be having a heart attack! Please keep her in your prayers. I took the family out to dinner and then the car broke down afterwards…It was actually a beautiful afternoon for car trouble. Glad I was there and that we have hospitals, tow trucks, and Ubers.🙂
@Big_Diggity That would have been a good April 1 prank! Stinks that it happened though.
Ok I jumped up, hit the lights, and found a stick…this is what was in the freaking bed…
The wife wasn’t feeling good so I went down to the basement to sleep in the spare room. I turned the light off and laid down. Just as I put my head on the pillow, I feel it move and in the darkness I hear the signature rattle…there’s a freaking rattlesnake in my bed, near my head! I’m just gonna lay here for a while and doomscroll. Maybe it will leave. I think it crawled away. OMG why don’t I keep the house cleaner. This is where we fold our laundry and it’s just in a big pile next to me…
Daniel
boosted
I think a LOT of people are missing the fact that we got LUCKY with this malicious backdoor.
The backdoor was created by an Insider Threat - by a developer / maintainer of various linux packages. The backdoor was apparently pushed back on March 8th (I believe) and MADE IT PAST all QA checks.
Let me state that again. Any quality assurance, security checks, etc., failed to catch this.
This was so far upstream, it had already gotten into the major Linux distributions. It made it into Debian pre-release, Fedora rolling, OpenSUSE rolling, Kali rolling, etc.
This is an example of Supply Chain Security that CISOs love to talk and freak out about. This is an example of an Insider Threat that is the boogey man of corporate infosec.
A couple more weeks, and it would have been in many major distributions without any of us knowing about it.
The ONLY reason we know about it is because @AndresFreundTec got curious about login issues and some benchmarking checks that had nothing to do with security and ran the issue down and stumbled upon a nasty mess that was trying to remain hidden.
It was luck.
That's it. We got lucky this time.
So this begs the question. Did the malicious insider backdoor anything else? Are they working with anyone else who might have access to other upstream packages? If the QA checks failed to find this specific backdoor by this specific malicious actor, what other intentional backdoors have they missed?
And before anyone goes and blames Linux (as a platform or as a concept), if this had happened (if it HAS happened!!!) in Windows, Apple, iOS, etc.... we would not (or will not) know about it. It was only because all these systems are open source that Andres was able to go back and look through the code himself.
Massive props and kudos and all the thank yours to Andres, those who helped him, to all the Linux teams jumping on this to fix it, and to all the folks on high alert just before this Easter weekend.
I imagine (hope) that once this gets cleaned up, there will be many fruitful discussions around why this passed all checks and what can be changed to prevent it from happening again.
(I also hope they run down any and all packages this person had the signing key for....)
@chiasm @pre @sotolf The closest thing I can think of would be the “cut rounds” that they used to make in Devon. Very similar to what we call biscuits.
https://www.reddit.com/r/Baking/comments/i7gxjy/devon_cut_rounds_a_savory_version_of_a_scone/
Daniel
boosted
Admin
Nostr:
acd1f62fad47b98657ac57e91c34613201d0ad273f331b67799874b887c42c60
Joined Dec 2019
