evgpbfhnr

In some contexts (e.g. embedded) you'd be surprised at how reluctant some people are to upgrade when they can run through a dozen of hoops for workarounds such as changing hash instead...

So to recap, with a non-upgraded sshd you need:

- an account with /etc/shadow hash set to '*'

- (note root won't work by default because of PermitRootLogin prohibit-password default)

- attempt twice, first attempt fails second long password is accepted (that took me a while to understand)

In practice passwd -l seems to lock with a ! prefix, and new account without passwords are created with a single ! which is also not affected, I'm not sure how big the impact actually will be in practice and don't understand the recommendation to upgrade urgently right now... Just don't use `*`?

EDIT: ah, some default container images apparently have a default alpine user with that hash, so I guess that's bad for them. This makes a bit more sense now.

all config combinations aren't valid (because of dependencies), and when there isn't they are mostly independent (e.g. 2 builds with CONFIG_FOO=y/CONFIG_BAR=y and CONFIG_FOO=n/CONFIG_BAR=n cover 100% of the cases for unrelated FOO/BAR), so it's not that bad.

And folks do build stuff, including with the awesome "randconfig" mode which generates a.. random config, so while it's still possible for some specific config to not actually work at runtime it's actually quite unlikely for build itself to fail (for releases at least)

You can script around https://git.kernel.org/pub/scm/linux/security/vulns.git/ (which is likely what the page you linked use)

> Replacing Pandoc (GPL and so incompatible the the App Store TOS)

... wait, you can't publish an app using GPL components to the app store? What's the point of this? .. oh, that made quite some noise around 2010 https://lwn.net/Articles/391423/ but I had forgotten all about it... Impressed this still stands...

You're describing https://bellard.org/ts_zip/ ("Text Compression using Large Language Models") ?

It's actually already implemented in javascript, I didn't understand what this was about until I turned js on and saw the blocked screen.

And it gets even more fun when browsers such as firefox implemented this, then decided no we won't do it and removed the feature -- now there's no way to access your router web interface over link-local address...

(rationale being that whatwg said no: https://github.com/whatwg/url/issues/392 ; firefox bug https://bugzilla.mozilla.org/show_bug.cgi?id=700999 )

The "solution" is to use a proxy such as https://github.com/twisteroidambassador/prettysocks/tree/ipv... which incidentally encode the % as a `s` and handle special URLs like this http://fe80--1ff-fe23-4567-890as3.ipv6-literal.net for you through the socks dns resolution feature... I've never found anything else that works recently -_-

I'd definitely love to see more screens like this sold (and getting better & more affordable with time)!

The mira pro color is marked as sold out and I can't even figure how to check non-color version on their site, so this doesn't look like something they sell a lot of though...

Our company had the same shift, but it's not so much forbidden as just unsupported as they disabled simple password auth.

If you waddle through setting up a project on the google developers console, setup your own oauth auth flow, find/scaffold something with mutt oauth script to fetch your mails locally, then you can likely get it to work too... (And then sending mails is another sidequest, and if sending mail breaks for some reason that's one in two odds you don't notice for a couple of days.. but it's fine spending work time on this right?)

How they react after you're done is another problem though... I told the IT lead and his reaction was just a shrug, but some could be more vindictive.

(logo doesn't render on my browser... So I wouldn't have guessed either.) (firefox/linux, but it really is a font problem, not a browser problem)

Ironically it was quiet enough in our previous apartment, but moving to a house we now have the neighbor using their awfully loud snow-spitting machine before 6AM after snowy nights... (And it snows a lot)

iiuc, this mail isn't about his PRs being rejected, it's the OCA submission e.g. the CLA obtention form.

(So his ping "any progress?" apparently fell on the wrong ears, if he wasn't told he had to submit a new application with something corrected...)

Great js implementation! I don't have any iThing but I'd happily play your js version in a browser for a while.

Since you mentioned Simon Tatham puzzles there's a js version here[1], but it really just isn't quite as good

[1] https://www.chiark.greenend.org.uk/~sgtatham/puzzles/js/patt...

(if I were to nitpick, for large grids one might want to make the separating line a bit thicker every 5 blocks for faster counting, and repeat numbers at the bottom/right -- but at the size the examples are in neither are needed)

(BTW you didn't mention for overlapping but there's a nice trick: just try from either end, count how many cells are leftover, and take that off the starting side of each block)

>> You definitely can use Linux with few simple servers with 128 MB RAM. > > This is not difficult, you just need to run `htop` and perform addition of the RES column (which is in KB unless a unit is shown). Example:

I'm not quite sure what points this makes... That's supposed to fit on 128MB? And it doesn't include memory consumed by the kernel itself (which is not negligible at this scale), and linux needs spare for cache to work remotely decently.

    $ awk '{ tot+=$2 } END { print tot /1024 }' < list
    214.035

I'm sure you can run a linux with 128MB of ram, but certainly not with systemd and a default kernel... Perhaps DSL (damn small linux) or alpine.

mem, yes, definitely. I'm not sure how you can protect yourself from that (or root user using ptrace or equivalent debugging tool) though...

Oh, memfd_secret?

       The memory areas backing the file created with memfd_secret(2) are visible only to the processes that  have  ac‐
       cess  to the file descriptor.  The memory region is removed from the kernel page tables and only the page tables
       of the processes holding the file descriptor map the corresponding physical memory.  (Thus, the pages in the re‐
       gion can't be accessed by the kernel itself, so that, for example, pointers to the region  can't  be  passed  to
       system calls.)

> This article does not mention that environment variables are also visible by process in /proc/*/environ (which has restrictive permissions, but is completely visible to root).

He's explicitly not using export, so they won't show up there. Plain variables are not in the environment.

(it's good to bring up this file as well as getting inherited by child processes though)

> I’m also intrigued by the potential that type systems have for “tagging” secrets and preventing their propagation beyond where they’re needed

facet (rust) allows tagging fields as sensitive so they won't show up in logs: https://facet.rs/guide/attributes/#sensitive

I'm sure other languages have equivalents but I rarely see this.. for example I was about to say serde doesn't do it, but it looks like it's possible with a wrapper type? https://docs.rs/redactrs/latest/redactrs/

Anyway, this kind of tagging is good, I want more!

I don't get why a bad guy couldn't dump the current log / hash, then load a kernel module that'd just replay the same values whenever someone asks for it? Does the log have a challenge/nonce from the client that'd change the hash everytime it's obtained? (if the client loads their own kernel module they can check it's on the list, but the whole point is about not having to do that, right..)

I had the same problem on our home server.. I just stopped the git forge due to lack of time.

For what it's worth, most requests kept coming in for ~4 days after -everything- returned plain 404 errors. millions. And there's still some now weeks later...

I get a new fingerprint id everytime I refresh the page (firefox, linux) -- so that might be sampling a tiny bit too much. audio and canvas fingerprint are constant though so it's probably plenty enough...

Also convinced they're observing a correlation with this rather than something age specific. It's like exercise, it's really impressive how people who stay active in their late years can still be very fit way into their 80s or 90s, yet if one stops trying it just crumbles away.

Breaking the system is the point! Let them break stuff, you learn when you have to fix it afterwards.

Thank you!

Unfortunately I get the same kind of garbage around closing curly braces / closing parenthesis / dots with this magick filter... It seems to do slightly better with an extra `-resize 400%`, but still very far from as good as what you're getting (to be fair the monochrome filter is not pretty (bleeding) when inspecting the result).

I wonder what's different? ( ImageMagick-7.1.1.47-1.fc42.x86_64 and tesseract-5.5.0-5.fc42.x86_64 here, no config, langpack(s) also from the distro)

To author -- code sample as images is great for syntax highlight but I wanted to play with the examples and.. got stuck trying to copy the content.

(also expected tesseract to do a bit better than this:

  $ wl-paste -t image/png | tesseract -l eng - -
  Estimating resolution as 199
  const std = @import("std");
  const expect = std.testing.expect;
  
  const Point = struct {x: i32, y: i32};
  
  test "anonymous struct literal" {
  const pt: Point = .{
  x = 13,
  -y = 67,
  33
  try expect (pt.x
  try expect(pt.y
  
  13);
  67);

)

If you're curious about the legacy link being a 404, the correct link seems to be that: https://tenacityaudio.org/legacy/legacy.html

(found sniffing around https://codeberg.org/tenacityteam/tenacityaudio.org , this 404 was reported on IRC)

Oh! That didn't exist a few months ago, I need to update and do this then :D

I have a script that allows searching for windows based on title; so e.g. if I know I had a shell open in directory X I could search for that and jump to it... But in practice I quickly have 5+ shells in a directory once I start working on something and at this point my script doesn't let me differentiate between these easily enough to be useful.

Hmm, perhaps that could be made more interactive and allow cycling through these without closing the search overlay... I'll give that a try! :)

Yes and no; the difference with workspace is that I was limited to 0-9 with my old wm, so at some point I'd just run out of space and had to close some windows. (well, that, and X11 is apparently limited to 256 clients by default and I never changed that; but I rarely hit that limit :P)

I do have some struts on the side, but I'm basically always juggling with at least 4 or 5 tasks so I always have things open; (I'm not using any right now but I do like the "quake terminals" temporary term styles... But for the same reason it's not always appropriate -- if I didn't close the term, it's because I wasn't done with it and mean to get back to it...)

I started using niri before the overview, I think that could help if I get used to it. But better than overview, what I'd want is something always visible like some horizontal scrollbar indicator to remind me there's e.g. more than 3 windows hidden or something. That might be possible to do with waybar and a bit of glue parsing the windows list...

My only complain about niri is that after a few weeks without reboot I end up with ~500 terms open, as I often open a new shell to check something, get distracted, and forget about it as it scrolls out of the view... (I usually notice at the 400-500 mark because this machine starts swapping noticeably, and closing it all is a chore that usually ends in pkill without checking...)

Maybe a bit more self discipline would help :)