I ❤️ Open Source, reverse engineering and Linux.
Opinions / Shitposting are my own.
btw I use Arch
A PSA since there's some confusion on this...
There is no vulnerability in Gorilla Sessions.
The vulnerability is in Palo Alto's internal SessDiskStore, which looks similar to FilesystemStore. Early analysis came to the mistaken conclusion that the vulnerable path was in FilesystemStore, but it's not. FilesystemStore authenticates the Session.ID with securecookie, SessDiskStore does not.
I'm growing convinced this is not a vulnerability in gorilla/sessions.FilesystemStore at all, but in a Palo Alto internal gorilla/sessions.Store implementation called SessDiskStore which works similarly but critically doesn't protect the session ID with securecookie.
https://github.com/gorilla/sessions/blob/3eed1c4ffcde6f23b6f88068c63c1ef6190df331/store.go#L191
Fantastic work by @amlw - xzbot
Exploration of the xz backdoor (CVE-2024-3094). Includes the following:
* honeypot: fake vulnerable server to detect exploit attempts
* ed448 patch: patch liblzma.so to use our own ED448 public key
* backdoor format: format of the backdoor payload
* backdoor demo: cli to trigger the RCE assuming knowledge of the ED448 private key
This is... such a good tutorial and now I'm going to rework my website's font sizes.
https://www.joshwcomeau.com/css/surprising-truth-about-pixels-and-accessibility/
EDIT: Please also check the replies for a system/browser font size gotcha.
“Should I use pixels or rems?”. In this comprehensive blog post, we'll answer this question once and for all. You'll learn about the accessibility implications, and how to determine the best unit to use in any scenario.
The Wi-Fi only works when it's raining 🌧📶
Happy April Cools! A few people and I decided lying for April 1st is cliché, so we're surprising you with truthful essays on unexpected topics.
Mine is about the hardest hardware problem I've ever had to debug:
https://predr.ag/blog/wifi-only-works-when-its-raining/
liblzma and xz version 5.6.0 and 5.6.1 are vulnerable to arbitrary code execution compromise
I accidentally found a security issue while benchmarking postgres changes.
If you run debian testing, unstable or some other more "bleeding edge" distribution, I strongly recommend upgrading ASAP.
... After that, "box" became a standing joke at Greenplum; whenever the onsite meetings bogged down, someone would remark "maybe we should put it in a box."
Greenplum's initial SW/HW product offering was nicknamed "Big data in a box".
So, if you knew Simon, tonight raise a shot glass of tequila to him and toast one of Postgres' most brilliant developers ... and one who knew how to find the humor in surprises. (4/fin)
Filippo Valsorda
HD Moore
Cecilie 🧙♀️
Predrag Gruevski
Xe 
AndresFreundTec
Berkubernetus