hxelk1

I only have a limited math background, but-

You're only looking at the symbolic part: deriving a statement from prior statements. I agree that the derivation either is correct or isn't.

But then there's the rest: the philosophy and intuition behind the symbolic manipulation. You can skip that if your goal is to use the results, but I don't think you can skip that if your goal is to develop the field.

I feel great sympathy for the mathematicians. This must be gut wrenching. It will lead to progress eventually, for sure, but right now a lot of them are in a bad place.

Edit: for readability.

This is brilliant, I'll be using that. Thanks.

We needed to implement some changes in our code and it became a blog post. I'm sharing it in the hope that it might be marginally interesting :)

Careful, this won't stop systemctl from showing the full process command line in its output.

This isn't about systemd. OpenSSH is one of the most (if not the most) security-critical program in the distribution. Many systems run with just ssh enabled. That's why you don't mess with it.

Which library pulled the vulnerability in is mostly irrelevant.

Couple of years ago, I noticed some weird Outlook headers on our internal company e-mails and decided to take a look. It turned out our company Outlook (or Exchange? who knows) mail server was configured to relay mail through some 3rd-party SPAM filter and the SPAM filter trusted some headers which weren't stripped on ingress. So you could send an e-mail with the headers set and they would reach the SPAM filter unmodified. As the company had a 3rd-party SPAM filter, all Outlook security was disabled. This allowed me to send e-mail with forged sender. Outlook in its amazing brilliance would attach the "sender's" company photo and show some kind of a "Trusted" badge or something.

I reported the issue and the admins weren't impressed. They insisted that this wasn't a major problem since the only way to make the e-mail appear to come from somebody in the company was to use you company account (outside e-mail would be filtered correctly). After some back and forth, I just told the admin to check his mailbox. It said something like, "if you don't think this is serious, you're fired" and it was "from" the CEO, with his smiling photo next to the name.

That finally did the trick.

EDIT: typos.

I believe the xz backdoor relied on Debian patching OpenSSH with libsystemd to work.

The thing is, the first example doesn't handle many edge cases which normally arise and are a common source of bugs and security vulnerabilities. The second example doesn't suffer from those issues by design.

In other words, it's OK to type the first example on the command line and it'll work just fine (and if it won't, you'll be able to step in and fix). But running it as part of anything automated would be haphazard.

As I read this, the whole point is that you have something that feels quite familiar syntactically to a common shell, but sane. Kudos to the author!

> you can actually declare startup dependencies and other useful relationships

In theory, yes. In practice, I had a lot of trouble ordering things correctly in non-trivial cases.

> it's quite annoying that the armchair linux experts complain about how "lol systemd is so stupid for reinventing the wheel, give me my shell scripts back"

I can only speak for myself, but I don't want the abysmal sysvinit scripts back. I just want a simple process supervision suite which is true to the UNIX way of doing things. The sysvinit/systemd dichotomy is false.

Runit and s6 are both very real alternatives to systemd. They lack a ton of features, but they are a way to reliably run services. They do use shell scripts, but not for the reasons sysvinit did. They are extremely simple and have a very small attack surface as a result. Runit itself is a spiritual descendant of daemontools which predate systemd by great many years.

The problem with systemd is that it's a mediocre solution to many problems. UNIX deserved better.

[Edit: whitespace]

I've spent a lot of time studying systemd alternatives. I believe the overall best design is Skarnet's s6, and that too includes a sudo-like program:

https://skarnet.org/software/s6/s6-sudo.html

I was very surprised when I learned about it, but it does make sense (for s6 at least).

> There is absolutely no reason to tie your new sudo replacement to systemd. Absolutely none.

With s6, the idea is to replace a SUID binary with an IPC mechanism. That does make sense, since (parts of) the init system need to be running as root.

> I am very glad to have jumped ship from systemd.

All that aside, so am I.

From: krygorin4545 <krygorin4545@proton.me> To: "1067708@bugs.debian.org" <1067708@bugs.debian.org> Cc: "sebastian@breakpoint.cc" <sebastian@breakpoint.cc>, "bage@debian.org" <bage@debian.org> Subject: Re: RFS: xz-utils/5.6.1-0.1 [NMU] -- XZ-format compression utilities Date: Tue, 26 Mar 2024 19:27:47 +0000

Also seeing this bug. Extra valgrind output causes some failed tests for me. Looks like the new version will resolve it. Would like this new version so I can continue work.

--

Wow.

(Edited for clarity.)

I tried to get my GP involved. Called the doctor's office, told the nurse about my endeavor and asked for a checkup (this was a week into the fast). The nurse basically told me that while she saw value in what I did, the doctor doesn't approve of fasting, and that it would be better to not even ask.

She gave me contact info of another doctor, who was however five years dead by the time I tried to reach her the next morning. I figured out I won't let this stop me.

Haha, yeah, the name is very confusing :)

About a year ago, I did two extended water fasts (24 and 16 days, about 8 weeks apart). I wanted to do a single 40 day one (just for kicks, to see if I last) but stopped after 24 days as I wasn't feeling well.

I've lost 18 kg during the first one (102 kg -> 84 kg), then quickly regained about 4 kg, and lost about 10 kg during the second one (88 -> 78). After the second fast, I started resistance training between two and four times a week (with a brain-endowed gym coach). I'm currently down 14 kg (88 kg), but gained quite a lot of muscle.

Though I can't recommend water fasting on blanket terms, if you're like me and you prefer short-term intense stress to long-term baseline stress, you may find that it's a great way to lose a lot of weight quickly, start feeling better about yourself and what your body is capable of, and get on the path to a healthier life style.

It was truly a remarkable experience.

For me, the trigger was https://www.youtube.com/watch?v=yaWVflQolmM.

I feel your pain. I think software is certainly getting much more complex (because it can, not because it has to). Complexity comes with a cost.

I hate when a mostly static website is rendered completely client side, for example. Most of the time, I just want to read the text, maybe see some (non-marketing) images, and that's it. I don't want hundreds of kilobytes of JS executed on my machine just for that.

Thanks for suggestion! I did do several fire drills in the past, where I would change keys and wait for people to reach out. At the beginning of the semester, almost nobody would; by the end, over 80 % of the class would reach out prior to connecting to our shared infrastructure. But I thought that having a real-world smoking gun would be even better motivation to think about it. Sort of "don't be this poor guy" kind of thing. I've also been thinking about actually MitM-ing them myself, and probably will, but I am not sure how far I want to go :).