0x0

Most email providers support mail forwarding and distribution lists, but maybe they should have added some sort of opt-in confirmation when adding recipients outside the local domain...?

I think I read somewhere that scammers set up an email distribution list / alias / forwarding from one something.onmicrosoft.com account to dozens of victims, and then they trigger a (real!) paypal email with that one something.onmicrosoft.com address as the recipient. So the email has a valid DKIM signature from paypal, then microsoft forwards that email to all the victims, which will still pass DKIM while amplifying the attack (and maybe boosted by microsoft's SPF reputation as well) to hit as many people as possible. Apparently the paypal emails are real but dangerous as they will allow the attacker to somehow take over the victim's account if they log in, as the "middleman" onmicrosoft.com alias then becomes associated with the account which was the original "to"-email from paypal. Something like that, at least.

I usually avoid logging in to xcode. I prefer to manually configure provisioning profiles and code signing certificates by hand in the developers.apple.com web interface anyways. You can use xcodebuild on the command line to get a signed ipa, and then you can use altool or application loader to upload the ipa to appstoreconnect. I don't trust xcode to not stomp all over my carefully configured provisioning profiles and app ids.

Also worth noting that "_new" is NOT a reserved keyword, but it is sometimes mistakenly used instead of "_blank". Which can lead to funny behavior if you are visiting 2 or more sites making this mistake, as the links could then start opening in windows that were initially opened by the other site. Or least that's how it was back in the days of popup windows, before tabs and popup blockers became the norm.

Looks like the security/integrity of SSL isn't taken too seriously as the build recommends to use a hex editor to replace "_strtoi64" and "_strtoui64" with "functions likely to return 0 such as iswxdigit" in order to successfully link OpenSSL on windows 2000 and earlier. Unclear what impact such a hack would have on the integrity of the crypto operations performed by OpenSSL?

This is particularly interesting as there seems to be, for decades, a general consensus that the problem of text compression is the same as the problem of artificial intelligence, for example https://en.wikipedia.org/wiki/Hutter_Prize

Microsoft SQL Server is only available as an x86-64 docker container binary. They actually had a native(?) arm64 docker container under the name "azure-sql-edge", which was (and still is) super useful as you can run it "natively" in an arm64 qemu linux for example, but alas that version was not long lived, as Microsoft decided to stop developing it again, which feels like a huge step backwards.

https://techcommunity.microsoft.com/blog/sqlserver/azure-sql...

There's probably other closed-source linux software being distributed as amd64-only binaries (rosetta 2 for linux VMs isn't limited to docker containers).

Is the runtime of this application "a number of minutes greater than the heat death of the universe" to find something that could pass off as matching the target visualhostkey?

Isn't the whole point of VisualHostKey in ssh to act as a security mechanism, i.e. "yes this looks like the correct server key" on first use on a new client that doesn't already have the key in known_hosts?

I guess if you use this, then the security of your key is only as strong as for how many minutes the bruteforce took (since anyone else could also run the tool and generate their own key matching the desired fingerprint in the same amount of minutes you needed - or less).

A large chunk of that php code could probably be replaced with a call to https://www.php.net/wordwrap

Aha. This was on a laptop. I missed that distinction.

Odd, this is not happening here on macOS 15.0.0. Turning bluetooth off either via the system settings app or the menu bar icon shuts off bluetooth immediately with no prompt for me...

I guess you could format a diff patch file locally and paste it as a text comment in an issue in their repo...? :P

Closed-source applications or games, I'd say.

I'd be very surprised if ubuntu has backported the keystroke obfuscation feature (which was introduced in 9.5) to 8.9.

When the feature is missing, you're not safe from keystroke interception at all, which is what this bug is all about, so any 8.9 version would be actually considered "unsafe" until the whole feature is backported, which seems unlikely to happen?

Interesting, I started playing with spotlight and typing in (-20)^21 returns " = 0", which is obviously not correct.

And typing in "(-22)^21" gives "-71100888972574851072", but wolfram alpha insists it should be "-15519448971100888972574851072".

Looks like there are still bugs here.

The screenshot in the article shows MD5() is returned as part of the error message from the web server, so it is probably also a part of the original server-side query.

The Oral-B app was fun a few years ago when it was fairly lightweight, showed an up-to-date current world events news feed, while logging data into apple health and encouraging a brushing streak. Then they rewrote the entire app and it lost almost all of those features. I never opened the app once after the first run after the upgrade. Really makes me wish for an iOS app store that would allow installing older versions, like testflight does (up to 90 days only, unfortunately). Maybe it's time to break out a BLE sniffer... although I'm sure getting a HealthKit entitlement for a one-off unlicensed adhoc app is impossible :(

Maybe they should rename the operating system from "Microsoft Windows" to "Microsoft Window".

Search in settings in firefox seems to have a bug. Searching for "adver" gives no hits related to this, despite this setting being under a header labeled "Website Advertising Preferences"

Patch out for Debian 12; Debian 11 not affected.

https://security-tracker.debian.org/tracker/CVE-2024-6387

Their web crawler / scraper "ClaudeBot" is the worst semi-legitimate crawler I've ever encountered. Extremely aggressive scraping from a ton of IP addresses with a ton of concurrent accesses, often getting lost in an infinite maze of dynamic url path combinations. Do better, please.

Setting the home directory to a special device node file "/dev/null" sounds like a good way to shoot yourself in the foot, and I've never heard of this practice before. On Debian, at least, it seems like setting the home directory to "/nonexistent" is more common.

For example, running "deluser" later could end up performing a "remove home" cleanup operation, and you certainly don't want to remove the /dev/null file.

Had to check the article date at first to see if the "-Wanalyzer-infinite-loop" was a play on casually solving the halting problem with a gcc flag!

Looks like the Jia Tan OpenPGP key was replaced a few months ago as well: https://github.com/tukaani-project/tukaani-project.github.io...

All these older (4.x, 5.0.x etc) releases that were suddenly uploaded a few months ago should probably also be considered suspect: https://github.com/tukaani-project/tukaani-project.github.io...

Interesting commit in January where the actual OpenPGP key was changed: https://github.com/tukaani-project/tukaani-project.github.io...

Wow, that's a lot of anonymous accounts adding comments there urging for a fast merge!

And this "Hans Jansen" guy is apparently running around salsa.debian.org pushing for more updates in other projects as well: https://salsa.debian.org/users/hjansen/activity

Just because macs don't use systemd, doesn't mean the backdoor won't work. The oss-sec post talks about liblzma having backdoors in crc32_resolve() and crc64_resolve() and that it has not been fully reversed. This could perhaps affect more than just sshd on x86-64 linux?