johnnyapol

Is anyone else getting a redirect loop when trying the link? At first I was thinking it had to do with my Firefox settings to force HTTPS but even just:

curl -L lukedeniston.com/memory-leak-mystery

> curl: (47) Maximum (50) redirects followed

isn't working.

The biggest reason I flew Southwest was just because with the $20-$25 for early bird check-in each way, I could pretty much guarantee I wouldn't be stuck with a middle seat and would be likely to have control of where on the plane I was (e.g. if I had a tight connection, could be closer to the front).

If being able to pick an acceptable seat ends up costing more than this, I'll be firmly in the territory of just price shopping between the other US airlines and picking whoever has the best price for the route. Admittedly, as someone who flies alone the vast majority of the time, this system worked well for me without much overhead. I can understand how families might be relieved at being able to reserve seats all next to each other as the cost of early bird for say 4 people would really add up. I guess I'll just be enjoying my current setup while I can and then move forward without any sort of loyalty.

I love RSS. I take a bit of an unconventional approach and use Discord as my RSS reader. I run a self hosted instance of MonitoRSS (https://github.com/synzen/MonitoRSS). I have a server with just me and my bot instance and I tend to group my feeds into categories and channels (effectively creating a tab system per subscription or group of subscriptions). I have Discord installed on my laptop, phone, and desktop so this means that I can easily look at all my subscribed feeds wherever it's convenient for me. When I'm not set to "do not disturb", I even get push notifications on my devices when content is posted to feeds that go to channels I haven't muted. I think the only real downside of the setup is some days I am very busy and don't check the server that often, so I'll come back to a large backlog of things to read and I'll end up missing or under-appreciating some gems.

Something worth noting: unless I'm missing something, this isn't Beeper Mini (the Android app) but the iMessage-Matrix bridge Beeper created. However, this is still handy if you have a Mac or jailbroken iPhone (edit: for registration, seems like it's not required after the initial setup) as you can self-host it.

IPv6 not having NAT doesn’t make it incompatible with stateful firewalls. You can still have routers doing drop inbound by default.

MiB refers to mebibyte, which is in base-2 (2^20 bytes).

MB is canonically base 10 (10^6 bytes).

Key excerpt/context from the advisory:

We discovered a Local Privilege Escalation (from any user to root) in polkit's pkexec, a SUID-root program that is installed by default on every major Linux distribution:

"Polkit (formerly PolicyKit) is a component for controlling system-wide privileges in Unix-like operating systems. It provides an organized way for non-privileged processes to communicate with privileged ones. [...] It is also possible to use polkit to execute commands with elevated privileges using the command pkexec followed by the command intended to be executed (with root permission)." (Wikipedia)

This vulnerability is an attacker's dream come true:

- pkexec is installed by default on all major Linux distributions (we exploited Ubuntu, Debian, Fedora, CentOS, and other distributions are probably also exploitable);

- pkexec is vulnerable since its creation, in May 2009 (commit c8c3d83, "Add a pkexec(1) command");

- any unprivileged local user can exploit this vulnerability to obtain full root privileges;

- although this vulnerability is technically a memory corruption, it is exploitable instantly, reliably, in an architecture-independent way;

- and it is exploitable even if the polkit daemon itself is not running.

Unfortunately, certain applications are gimped if you don't use the electron version. A notable example of this for me is Discord where push-to-talk doesn't function in the web version due to API limitations.

Another app I use that has this problem is Spotify. While it isn't electron, it is using CEF (chromium embedded framework) and can be dynamically linked to a distro one with some effort. Using the web version means I dont have my music available offline for listening.

My major annoyance with Electron is every app shipping its own version of it, particularly on Linux where most distros tend to ship electron in the repositories. I'd really rather not have 5 different chromium versions - that are lacking security updates - on my system. I wish packagers were more aggressive about not bundling them.

Are you running an antimalware program with real-time scanning enabled on Windows? I've found that typically causes a lot of the slowdowns on builds if you don't have your worktree excluded from it. Linux still ends up faster for me even without the anti-malware on Windows but its not as dramatic.

The DMCA notice can be found here https://lumendatabase.org/notices/25498447 which includes an IP address (along with some tweets).

I personally have put a lot of faith in them but there's also a lot of alternatives in case they were to flop or become corrupted:

1.https://zerossl.com/letsencrypt-alternative/

2. Cloudflare will issue you free TLS certs (assuming you're okay with them doing TLS termination). I assume other CDNs / caching proxies with free plans will also do this.

3. https://www.buypass.com/ssl/products/acme

4. https://www.sslforfree.com/

I'm sure there's more, but that's just what I could quickly find.

I don't know Google's motivation but frankly I welcome TLS everywhere on the public-facing web now that certs are free thanks to LetsEncrypt.

For me, it comes down to two things:

1. Privacy. When I'm on non-private networks, its nice to have assurance that other people aren't able to get the specific contents of what I'm viewing.

2. ISP bad behavior. A number of ISPs have been doing things like injecting ads or other trackers into plain-HTTP sites. https://www.infoworld.com/article/2925839/code-injection-new...

This was my interpretation of the statement too. Specifically what comes to mind is apps that depend on native/shared libraries that only have an ARM build and not a x86 build shipped.

Flatpak achieved this on Linux. There are "portals" which are dispatched and will mount virtual filesystems to permit access to specific files selected by the user. These portals typically are provided by the desktop environment as to resemble to look and feel of the user's choice. There's no kernel-level interface as the OP was alluding to but by combining several other kernel interfaces we can get this kind of sandboxing.

There's active research going on into "post-quantum" cryptography to protect the need for secure communications if/when quantum computers become powerful enough to pose a serious threat to the status quo.

https://blog.cloudflare.com/the-tls-post-quantum-experiment/ is a great read about a sample deployment of this by Cloudflare.

I was disappointed to not see any mentions of Gridcoin in the Proof of Stake section. It rewards people for their contributions to certain BOINC projects. There definitely is a range of "usefulness" to the projects supported. There are computations like distributed protein folding (Rosetta@Home) all the way to analysis of Minecraft phenomenon (Minecraft@Home). While the Minecraft makes for some very entertaining YouTube videos, the electricity used would probably be better spent on other projects. However, it is still a significant improvement over the computation for Bitcoin.

https://gridcoin.us/ https://gridcoin.us/guides/whitelist.htm

> A more analogous example to the case at hand would be an employee at Google/Humana/Tinder selling your private details to a third party. This ruling means that such activity is perfectly legal, even if the terms of their employment state the opposite.

No, this isn't what this means at all. This ruling just means you haven't committed a crime under the Computer Fraud and Abuse Act by accessing that data if you didn't "hack" to get access to it. Depending on the information you sold, you could've violated other laws and you definitely violated the Non-Disclosure agreement you signed with those companies.

For reference, the cop in this case had other convictions under wire fraud laws that weren't changed by this.

I think it definitely can be a project thing. My experience with IWYU has been on very large codebases and I considered its ability to find transitive includes a blessing. The specific case where it shined for me was it made it much easier to identify the true impact of fileset changes on the larger codebase when it came to refactoring.

I'm not saying your calculus is wrong but this does make an assumption that all clots are created equal and I don't believe that is the case.

The specific issue being observed is "cerebral venous sinus thrombosis (CVST)" in combination with "low levels of blood platelets (thrombocytopenia)" per the Joint CDC and FDA statement (1).

Low blood platelets means anti-clotting treatments can pose a substantial bleeding increase, making this already dangerous condition difficult to treat.

(1) https://www.fda.gov/news-events/press-announcements/joint-cd...

It's definitely not ideal as I'm probably going to get compromised through development tools / extensions I acquire or some Firefox exploit/ exploit in some open source tool I use. However, I've made a big effort on my system to put all proprietary software behind flatpak and customize the sandbox via flatseal.

Right now all the non-open source games I play are installed via flatpak. I also use Spotify and Discord which I've both put behind it. In the case of steam+spotify+some other games,they have no reason to be accessing any of my personal files and so they've been cut off accordingly. Discord has a slightly more permissive model but soon I won't need to give it any direct file system access thanks to recent electron changes (the file chooser should be able to selectively grant permission for files I want).

Mods - looks like SeattleTimes is syndicating this and lacks the aggressive paywall. Here's an alternative link:

https://www.seattletimes.com/nation-world/nation/weather-ser...

The quoted article that the author has is pretty hard to read when browsing with a dark theme, so I'm re-posting the section as I feel its worth a read:

----------------------------------

Hosting Under Duress

By Milo Trujillo (illegaldaydream@ddosecrets)

On June 19th, Distributed Denial of Secrets published BlueLeaks, approximately 270 gigabytes of internal documents from U.S. local-LEA/federal-agency fusion centers, municipal police departments, police training groups, and so on. The documents have revealed a range of abuses of power, from tracking protestors and treating journalists and activists like enemies, to willful inaction against the alt-right, with additional BlueLeaks-based stories emerging each week. Thank you, Anonymous, for leaking this data!

The retaliation against DDoSecrets has been significant. Twitter promptly banned @ddosecrets, followed by Reddit's bans of /r/ddosecrets and /r/blueleaks, all for violating content policies regarding posting personal information and hacked material. Both blocked the ddosecrets.com domain name in posts, and Twitter went as far as blocking it in DMs, and blocking URL-shortened links by following them with a web spider before approving the message. German police seized a DDoSecrets server on behalf of U.S. authorities (our hosting providers are geographically scattered), and goons from Homeland Security Investigations paid a visit to some folks operating a mirror of DDoSecrets releases, asking questions about the BlueLeaks documents and the founder of DDoSecrets, ultimately attempting to recruit them as informants and offering money for info that led to arrests.

None of these actions have hindered distribution of the BlueLeaks documents, which were released by torrent, and all are directed at the publishers of the documents, not the hackers that leaked them. Wikileaks maintains an active Twitter account and has faced no such domain banning. What we have is a warning: publishing information on U.S. law enforcement, even when clearly in the public interest, will not be tolerated.

So how do you design server infrastructure to operate in this hostile space, where third party corporations will ban you and self-hosted servers are liable to be seized? Distribution, redundancy, and misdirection. All the documents published by DDoSecrets are distributed by torrent, so there is no central server to seize or account to ban to halt distribution, and data proliferates so long as there is public interest. But leaking data is only half of the DDoSecrets mission statement: raw documents aren't valuable to the public, the ability to extract meaning from them is. Therefore, DDoSecrets works closely with journalists and academics to help them access and analyze data, and runs a number of services to make analyzing leaks easier, like Whispers (https://whispers.ddosecrets.com/), a search tool for Nazi chat logs, or X-Ray (https://xray.ddosecrets.com/), a crowd-sourced transcription tool for leaked business records with formats too challenging to OCR. These services have to be hosted somewhere.

Static services like Whispers or the homepage are easy: They're set up with backups and Docker containers and Ansible scripts. If a server disappears, rent a new one from a different hosting provider and re-deploy with a couple lines in a terminal. A few services aren't quite so easy to replicate, though. The Data server maintains a copy of every leak, available over direct HTTPS, mostly so we can give a URL to less technical journalists that "just works" in their browser, without walking them through using a torrent client. All the data is available by torrent and nothing unique is on the server, but finding a new hosting provider to spin up a 16-terabyte system (not counting redundant drives in the RAID) and then re-uploading all that data is, to say the least, inconvenient. The same goes for Hunter, the document-ingesting cross-analyzing leak search engine. It would be nice if we only had to migrate these servers infrequently.

The solution for these large servers is to hide them away forever, and make a repeat of the German seizure unlikely. These servers are now hosted only as Tor onion sites, and are only connected to, even for administration, via Tor. A tiny "frontend" virtual machine acts as a reverse-proxy, providing a public-facing "data.ddosecrets.com" that really connects via Tor to the much larger system. The reverse-proxy can be replaced in minutes, and doesn't know anything about the source of the data it's providing.

We'll end with a call to action. None of the design outlined above is terribly complex, and with the exception of the Tor reverse-proxy, is pretty common IT practice in mid-sized companies that have outgrown "a single production server" and want scalable and replaceable infrastructure. The technical barrier for aiding the cause is low. Hacking has always been about challenging authority and authoritarianism, and that mindset is needed now in abundance, at DDoSecrets and beyond. No time to waste - Hack the Planet!

Is anyone else unable to access the site? I'm currently on Firefox 85.0.2 (Arch Linux). I've tried disabling advanced privacy guard but I still get stuck in an infinite refresh loop :-(

We're going to need another flag https://en.wikipedia.org/wiki/Free_Speech_Flag

A course scheduler for my school, QuACS ( https://github.com/quacs/quacs ) was built entirely around git scraping. Around 7:30AM EST each morning, a GitHub Action is kicked off to scrape various things (class hour schedule, course catalog, faculty directory, etc) and produce a commit containing the current data. Then, the website is rebuilt (also using GitHub Actions) and hosted on GitHub pages. The only thing that's not static about the site is a call is made to our Student Information System (SIS) to retrieve current enrollment numbers in courses for seats.

It's helpful as the data is now open for everyone in a nice format, so some other projects that utilize course data have been taking advantage of it.

I think their claim is the researchers can run a Linux install with KASAN and see the results but they are unable to use an equivalent of that on MacOSX, Windows as Apple, Microsoft do not allow an end-user to perform that kind of instrumentation on their own device.

Just out of curiosity, though, how could I block network traffic that did not use a specific DNS server to progress? Even on public wifi, like Amtrak, where I am required to use a captive portal on first connect before anything can be done, I can, after accepting their TOS, re-load dnscrypt-proxy and be back on my merry way. In addition, some things don't even need DNS to function at all (what if I memorized the IP? What if the IP is hard-coded in?)

They could probably say "drop all requests to 1.1.1.1, etc." but nothing is stopping me from running my own DoH resolver that they would have to manually scan for.

The only valid argument I've heard against DNS over HTTPS is that it makes it harder for institutions / companies to block other DNS servers than their own internal ones because they simply can't just drop port 53 traffic anymore. This was brought up to me in the context that many universities enforce their own DNS servers to help block malware from being able to phone home or filter access to malicious IPs in general.

I guess in theory, this could still be accomplished by filtering based on IP - a whole other cat and mouse game. Although, it's not like it wasn't a cat-and-mouse game before - you could bypass these blocks by running DNS on non-standard ports unless some form of DPI was being performed.