It looks like Gitea made the same fix (rm -r .git after template processing) back in February: https://github.com/go-gitea/gitea/commit/2176e84ab977011ff2b...
PR: https://github.com/go-gitea/gitea/pull/36734
So likely Gitea < 1.25.5 was vulnerable.
20,932 karma · joined April 28, 2010
PR: https://github.com/go-gitea/gitea/pull/36734
So likely Gitea < 1.25.5 was vulnerable.
https://codeberg.org/forgejo/forgejo/pulls/14301:
*Critical:* fix: prevent template expansion from interfering with git repo initialization. When generating a new repository from a template repository, Forgejo clones the template repository, removes the `.git` folder, performs variable template expansion on files listed in `.forgejo/template`, and initializes a new git repository. During this process, variable template expansion could be misused in order to create a new `.git` folder, which git would adopt and incorporate during its initialization of a new git repository. A malicious template repository could be used to read arbitrary data from the Forgejo host, and to execute arbitrary processes on the Forgejo host, as a remote code execution attack. To address this issue, after variable expansion is completed, any existing `.git` folder is removed from the directory before the git repository is initialized.
https://codeberg.org/forgejo/forgejo/pulls/14301:
ensure authorization reducer is accessed when checking editable PRs in APIs. When editing a git repo contents through Forgejo's API, a specialized security control is used to permit repository maintainers to edit branches that they do not own when an open pull request with the "allow maintainer edit" option is present. This specialized security control did not take into account API-specific security restrictions, such as repo-specific access tokens. As a result, it was possible for an API access token with restricted permission to make modifications outside of that restricted permission. The specialized security control has been updated to take into account API authentication security restrictions.
---
So if like me you run a private forgejo instance with closed signups and limited repository creation, you can wait for the update. Otherwise maybe take it off the public internet for a bit?
What they say "Some ISPs provide open networks and some [unspecified] smart devices automatically connect to such networks". They don't say these TVs (or any TVs) are in that bucket. Given how much they've tested about these TVs, I'd say they'd have found and named any TVs that did that.
Honestly this was more a behaviour of very early wifi devices, I don't think I've run into such a device in decades, since people started talking about open wifi networks like they talk about piles of needles.
Honestly there's enough real misbehaviour documented in the video to go without making some up, and it's a little disappointing GN decide to allude to that claim without proof.
It's from a comment, not even the article or the video it's based on. It's just the same internet rumor mill that's been going around for years, but more official because someone quotes it on an discussion on a news article because someone posted it in the comments of the article.
Anyone who's tried to test this theory has not proved it. A few claims in support forums are more likely to be people's guests or family just connecting it to the wifi.
My experience: Pinta is an inferior Paint.NET . It's about the same level of complexity, but everything is just like... 60-85% as good.
Krita is a heavier program, but has a similar level of polish. You might not use half the features, but Krita's what I'd suggest for anyone wanting an open source alternative to Paint.net
I mean, they also had their own gameplay appeal, but I think the current player pool of WoW+FFXIV+ESO+GW is probably a more accurate reflection of how widespread the appeal of them as pure games is, while the crazy numbers of 00s WoW were about the social network aspect.
It looks more like a Runescape asset than a Minecraft one, for example:
https://runescape.wiki/images/thumb/The_Adventurous.png/1200...
Also webp is IMO subjectively worse at the same file sizes than the other two. Dunno if there's any studies on it to back that up though. It also has a max image size that is plausibly a problem in some use cases (16k in one dimension) while AVIF is 65k per axis and JXL 1M per axis.
If alternatives can handle the load, those who would consider those alternatives if Microsoft opposed a rate limit are likely to move to them anyway.
If alternatives aren't able to manage, then user's aren't going to jump since those services won't actually provide more usage.
- It was believed that GitHub would be more reliable than our self hosted Gitlab CI runners. This has proven to be very false.
- It was believed it would be easier to write tooling. I’m not on the dev tooling team, so can’t confirm if they found it true or not, but from the outside I see a lot more “Github can’t do that” than I did “Gitlab can’t do it”
In particular, it’s a photo editor at core. You can use it for postprocessing of other image types if you want, or for pasting together memes or whatever. But it’s not designed for e.g. doing illustrations or digital painting or sketches
This isn’t even unique to GIMP in that way. Photoshop is also a sub par art program (though admittedly they’re a little more flexible than GIMP). But if you wanted something better for than Photoshop and were ok with proprietary windows/mac software there’s clip studio paint and before that there was paint tool sai etc.
While until the rise of Krita being actually good (having tried it many times over the years prior, that’s some time around 2018) if you wanted Linux or just wanted FOSS, you had to use Gimp and that breed resentment at it being the wrong tool
For example, ublock origin is able to patch out anti-adblock scripts that Safari content blockers cannot. Try tvtropes for an example. Works fine with firefox and ublock origin, displays a “allow ads of subscribe” instead of the content on safari.