rietta

We used to call those checks!

I’m still terrified how normal people are going to navigate being locked out of their email account because their device that was their passkey is no longer accessible and there’s no backup solution to restore access.

I’ve similar issues even in a lower level with LastPass where it won’t even let you enter your two factor if it doesn’t recognize where you’re coming from but then you have to be connected to your email, but your email password is stored in LastPass. There is a real possibility of being locked out at all devices at the same time and not being able to get in to the first one.

I remember when open source software, and Linux in particular, was the threat to the world according to Microsoft execs.

That does seem strange. So he has been experimenting seeking something. I have kept the same LTS installations sometimes until the bitter end of the support cycle.

What should we call them then? I certainly used the term code gate to refer to a code review process prior to the mainstream use of LLMs.

Neat!

I had switched some projects to SeaweedFS's Docker image. It worked well. This is good to know there is a successor open source project that would require no code changes to use. Will evaluate.

The site is safe. It has been a trademark of Aaron Patterson a core Ruby on Rails contributor for decades.

Unrelated to the content of this post, I fixed the website header to be much smaller and unobtrusive while reading. Tested on my iPhone and in the Firefox responsive simulator as promised in the comments there.

I had not even seen Aaron's post. Thank you for sharing that link.

Isn't that the truth! I remember it very, very well. Vividly even.

The promise of React Native was easing development burden from the web app to the native app. It makes sense if they are just using coding agents to cut out the framework and just go native.

That was my thought when I saw the headline and then reading the article confirms this is the inflection point per their own words. Very interesting.

I didn't go with the scroll up but did drastically shrink the header and make a hamburger menu. I still like having it sticky because many a time I have been on a page and forgot who I was reading. Hopefully what is up now is a good tradeoff and provides good experience for a future reader.

Appreciate you.

HN has moved on, but I wanted to come back again and say thank you to you and those who replied below. I just pushed an update to the website that makes the header much more mobile device friendly.

I love the understated "some time ago" linking to a 2004 blog post. Raymond has been at this a long time :-)

Fascinating! I wonder if cloth artifacts, such as the Shroud of Turin, would also exhibit similar signatures. Though I have read some extremely compelling multi-disciplinary evidence exist to its authenticity to 1st century Judea, not a forgery.

I have other disks, including personal files, that are not mass market. Including some very fun early "Rietta Solutions" programs by my learning days. I was very early mimicking the look and feel of commercial shareware at the time, including printing diskette labels with version numbers and copyright dates with an inkjet.

The disk appears visually in good shape. It has been stored all these years in the original box in an air conditioned basement. I am not seeing any white material or other obvious corrosion. However, I can confirm that my first attempt to read the imaged data failed. I did not record the output from ddrescue but it was something like 34% on the 1.4 MB. Got a corrupted screen when trying to run the installer in a Windows 98 SE QEMU vm. I have not dug into it very deeply.

I wanted to say I really, really appreciate your comment here John. libvips is a very useful tool set and maintaining it is certainly a bigger public challenge than I ever took on. I just wish the Ruby on Rails community had hardened their use of it sooner. Again, thank you.

Normalize into flat xml that I could then parse in Nokogiri.

Edit for clarity: I am a Rubyist at heart so I reach for Ruby for almost all of my automation, ML, and even now AI stuff. Fro a very long time, I have been able to use CLI LibreOffice to do amazing things. It can read everything, even obscure formats by today's standards, going back into the 1990s. And then once in OpenOffice XML you have one target to parse in your scripting language of choice to do document analysis, data loss prevention detection, and more. All with a clean open source license with no server usage restrictions, unlike MS Office.

This is awesome! I have used LibreOffice (and Open Office) extensively for decades now. It is my real office suite I use for real work and real business accounting tasks. Yes, I am very well aware that Calc is different than Excel but it can get nearly all the same tasks done as long as you are not tied deep into a corporate environment passing Excel-specific files around. I have also made great business uses of it in Docker too, generating perfect PDFS from templates, and normalizing document formats for analysis. I donate a modest $19/month personally to the foundation, much rather pay them than Microsoft!

Neat! Thank you for the info on that one. Bookmarked!

Before I spend well over $100 importing that device, I previously was thinking of brining up a 2001 era motherboard with a USB stack and can natively host the drives, but the 486 that has sat unused may be a solid option. I presumably can find a way to transfer data to a modern system over serial cable or something.

I am working an a fictional world set 1800 years in the future. A whole subplot is the digital resurrection of 1990s Microsoft Encarta encylopedia which was the first time in a millennia they had a glimpse into this time beyond fragmentary evidence from printed materials. In the timeline of the novel, the disks had been discovered 300 years prior but no one knew how to read them and the general degradation of the substrates. Then 150 years before a graduate student figured out how to use imaging from multiple different disks and piece together to get an entire rendering of the bit pattern. But it took only at the time of the narration that the breakthrough was made on how to decode and render the data in part because of "digital Rossetta stone discovery" found at a dig in North America encrusted in volcanic obsidian glass. Anyway, the professor protagonist ends up traveling in a post oil world by sail to Argentina as an invited guest in a highly interest lecture scene reminiscent of the Dead Sea scrolls discovery.

There is a lot of work to do, but I am actually intellectually interested in realistically understanding how the far future can deal with interpreting the digital dark ages that we currently live in now which are completely forgotten because the administrators stopped copying data one day.

Another type confusion vulnerability! Interesting.

Thank you. I will work on that.

Thanks for the heads up. The navigation header does not collapse as I never liked hamburger menus but it should be more than two lines. Works more than that on my iPhone 16. What size is yours? I will pull it up in the Firefox simulator next week and try to make it better.

We recently updated the design. This is a very old site so it has some quirks in the design for sure.

I agree. And unstated in this write up is the direct upload route. Even if your Cloudflare was perfect, once the attacker got the preflight they send the binary file up to S3 directly and then hit the variant route directly. The first code to “validate” the upload was the exploitable libvips code.

Correct, which is how the ActiveStorage gem was patched. After this, Rails raises a Vips::Error: VipsForeignLoad exception on an attempted variant render of a malicious file. I plan on writing a technical detail post soon with some more code level details and "indicators of compromise" but this one was getting long. This is more for management to understand why wait to patch is a major issue. The discovery to active exploit attempt timeline is the story here.

I am not sure, but my read on the original disclosure is no. libvips itself has a variant processor for matlab v5 files, which the exploit took advantage of.

Cloudflare or a WAF may or may not help. These can often catch and block specific bot traffic, but not every attack payload is delivered naively. It would be part of a defense in depth. Having the underlying vulnerability fixed is critically important. For those on AWS, WAF & Shield is also very useful but at the end of the day these let legitimate traffic through, such as legitimately uploading a file that only in its contents is malformed.

Hugged to death? website is not working for me from the xfinity network.