kpcyrd

36 ms·

1.
by kpcyrd 11d ago
Since this seems to be the thread for public DoH providers, this article is probably worth mentioning (it can sort by DoH, DoT, DoQ, etc support). https://en.wikipedia.org/wiki/Public_recursive_name_server
2.
by kpcyrd 27d ago
I'm well aware of those issues (having worked on this for many years), but I still believe the majority of python packages won't be affected by this. :) Most of these you would fix once on the relevant [build-system] and be done w
3.
by kpcyrd 27d ago
They use the word "Reproducible Builds" for linking the VCS commit to PyPI's repacked source code upload, that's why "reproduce the source code" sounds a little confusing. For projects with native bindings you
4.
by kpcyrd 27d ago
I think running this with network access disabled is a good idea, but it's also important to note "was independently reproduced" is about "we challenged the SBOM and were able to produce this output from the stated input
5.
by kpcyrd 2mo ago
An SSH bastion host allows to request direct-tcpip channels, but is going to restrict other channel types, like pty requests, shell requests, exec requests or other subsystems. The "login permission" term is confusing because it&#
6.
by kpcyrd 2mo ago
Unfortunately Bitchat feels like an unfinished proof of concept. At a festival I got notifications there are "other users nearby", which made me question if and how the app is broadcasting it's presence, possibly at all times
7.
by kpcyrd 2mo ago
This makes the problem harder instead of easier. The most practical conclusion is "the package registry is the VCS, but with stricter rules". Those stricter rules are useful, the registry acts as a authority to ensure no version s
8.
by kpcyrd 3mo ago
This. Capitalism only became problematic the minute it stopped having a cozy spot for software developers~ And even then people prefer blaming the prediction machine instead of recognizing their situation as the logical conclusion of capita
9.
by kpcyrd 3mo ago
The server actually hosting the rootkit executable is npmjs.com, run by a for-profit company, and they still take about 24h to act on our reports, while reported AUR packages have been processed in about 1-2h by people that work unrelated d
10.
by kpcyrd 3mo ago
You could try rkhunter or unhide from the official repositories, but I haven't tested this myself and I don't know how well they work with BPF rootkits (and/or this one specifically). All of the packages I have triaged involv
11.
by kpcyrd 3mo ago
This is essentially what the [extra] repository is. Not using the AUR and sticking to official Arch Linux packages exclusively is a very valid and reasonable choice (that I follow myself actually). A large number of "an Arch Linux upda
12.
by kpcyrd 3mo ago
This is an "in addition to" problem though, not an "instead of" problem. Having code reviewed the PKGBUILD doesn't mean the upstream software is safe to use, having reviewed the upstream software and it's depen
13.
by kpcyrd 3mo ago
There's no shortage in ideas of how to make the AUR easier to moderate. A "quarantine button", an invite system, a request system for adoption similiar to how orphan requests work, code review attestations similiar to cargo-c
14.
by kpcyrd 3mo ago
This may happen even with `pkgctl build` if a makedepends= (transitively) pulled in the shared library into the build environment, but depends= doesn't. There's warnings in place if a .so dependency is detected, but it's up t
15.
by kpcyrd 5mo ago
You don't need vendoring for this, Cargo.lock already gives you locked-dependencies until you run `cargo update`. There is an ongoing RFC to support having cargo intentionally only use library versions that are least X days old: https
16.
by kpcyrd 5mo ago
The repository suddenly contains thousands of files that I need to worry about. With regular locked-dependencies (but non-vendored) like Cargo.lock does, I have them contained in archives with well-known hashes that other people have also l
17.
by kpcyrd 5mo ago
You are getting distracted by domain names, your Cargo.lock files already cryptographically address the source code. Either make sure all your Cargo.lock files contain no known-bad hashes, or make sure all your Cargo.lock files contain only
18.
by kpcyrd 5mo ago
1) This is only relevant for rustup.rs, most Rust source code is coming from crates.io 2) Most projects have a Cargo.lock that contain sha256 checksums of the source code. You can still announce new versions of everything and hope people pu
19.
by kpcyrd 5mo ago
crates.io _is_ the source code repository (: It's explicitly the source of truth that cargo-crev and cargo-vet reviews are based on, linking it to a git repository first is not a substitute for reading the source code.
20.
by kpcyrd 5mo ago
This is "only" used for loans and renting, the German government is never going to query the score this company has assigned you. Social services are never impacted. Equifax on the other hand claims: > Social Services - When go
21.
by kpcyrd 6mo ago
You don't think non-consensually revealing somebody's identity is a problem? Resorting to DDoS is not pretty, but "why is my violent behavior met with violence" is a little oblivious and reversal of victim and perpetrato
22.
by kpcyrd 6mo ago
I stopped programming in python about 8-9 years ago because the tooling was so bad.
23.
by kpcyrd 6mo ago
Step 1: discontinue the public repository, step 2: sell access to your GPL codebase. The GPL (and even the AGPL) doesn't require you to make your modified source code publicly available (Debian explicitly considers licenses with this r
24.
by kpcyrd 6mo ago
I think this was more about "please choose _any_ license" because of the problem outlined here: https://opensource.stackexchange.com/questions/1150/is-my-co...
25.
by kpcyrd 6mo ago
I feel like this is related to these issues (with somebody attempting this approach for real): https://github.com/chardet/chardet/issues/327 https://github.com/chardet/chardet/issues
26.
by kpcyrd 6mo ago
Many of the anti-debugging techniques for desktop binaries do not work on WebAssembly: it can't jump to an address, it can't read the instruction pointer, it can't read/access it's own machine code, ...
27.
by kpcyrd 6mo ago
Obfuscated javascript could still import a WebAssembly polyfill, if there really was any advantage in doing so: https://github.com/evanw/polywasm Since WebAssembly instructions are much easier to reason about, you coul
28.
by kpcyrd 6mo ago
It's mostly Rust compiled to wasm binaries. There's also TinyGo and you could use C/C++ as well, but those 3 are a lot less common as far as I can tell.
29.
by kpcyrd 6mo ago
Your open source experience is very different from my open source experience.
30.
by kpcyrd 6mo ago
Running Rust on them worked well for me: https://github.com/kpcyrd/ch32v003-demo I had to put in more effort regarding RAM use and flash size, but I managed to fit a game into the 16kb limit regardless: https:/&#

More ›