| Personal (ITA) | https://www.saccani.net |
| Company (ENG) | https://www.libraesva.com |
Over Half (55%) of US IT and Security Professionals Surveyed Not Prioritizing Email Security, Despite Almost 9 in 10 (88%) Experiencing Successful Attacks in the Last Quarter | Business Wire
xz/liblzma: Bash-stage Obfuscation Explained, https://gynvael.coldwind.pl/?id=782.
"The maintainers of libcolorpicker.so can’t be the only thing that stands between your critical infrastructure and Russian or Chinese intelligence services"
https://lcamtuf.substack.com/p/oss-backdoors-the-allure-of-the-easy/?1
OK, so here's my slightly more eloquent take on the xz thing, complete with a zinger closing paragraph:
https://lcamtuf.substack.com/p/technologist-vs-spy-the-xz-backdoor
https://boehs.org/node/everything-i-know-about-the-xz-backdoor
I have begun a post explaining this situation in a more detailed writeup. This is updating in realtime, and there is a lot still missing.
Just a backdoor in XZ. Nothing important. https://www.openwall.com/lists/oss-security/2024/03/29/4
I was doing some micro-benchmarking at the time, needed to quiesce the system to reduce noise. Saw sshd processes were using a surprising amount of CPU, despite immediately failing because of wrong usernames etc. Profiled sshd, showing lots of cpu time in liblzma, with perf unable to attribute it to a symbol. Got suspicious. Recalled that I had seen an odd valgrind complaint in automated testing of postgres, a few weeks earlier, after package updates.
Really required a lot of coincidences.
Era da qualche giorno che mi guardavo intorno spaesato in cerca di un po' di luciditĂ . Finalmente un articolo sensato:
Email e metadati, i dubbi da DPO sul provvedimento del Garante
https://www.key4biz.it/email-e-metadati-i-dubbi-da-dpo-sul-provvedimento-del-garante-privacy/480013/
IPv4 will outlive me for sure
Johnny Ryan
Ivan Enderlin 🦀
lcamtuf 
Evan B🥥ehs
Steve Bellovin
AndresFreundTec
