Теодор Златанов / Ted Zlatanov

@tzz@infosec.exchange
71 Followers
195 Following
943 Posts
Making TRAMP go Brrrr….

I recently changed jobs and found myself in a position where I would need to do a lot of work over TRAMP. I had used TRAMP before and it tended to be slow. Since I would be using it all day now I figured I should take some time to make it faster. TRAMP is great TRAMP really is an amazing piece of technology. It supports a huge number of protocols and for the most part, it lets you pretend that you are working with on a local system.

The more cash you need, the more you want to borrow. In the short term this reduces your need for cash, but after a while it increases it. A vicious cycle.

The same pattern shows up all over the place, where a short-term fix makes the problem worse in the long run. This pattern is an example of a 'system archetype', and we can draw it as a diagram. Different instances of this archetype will give diagrams with different words - but the archetype is the pattern of edges with plus signs, minus signs and delays.

I've been working on the math of this stuff. I'm fascinated by how a general problem that haunts my life - I like to put off solving problems, and wind up making them worse - can be summarized as a simple diagram.

(1/n)

It would be appallingly petty of me to suggest that if you didn't want the megacorps breathing down your neck 24/7 demanding your free labour, maybe you shouldn't have slapped the MIT Free Labour Licence on your software when you could have just as well gone for something the megacorps scurry away from like cockroaches exposed to sunlight such as the "viral" GNU Glorious People's Licence, so of course I wouldn't dream of suggesting it.

https://social.wildeboer.net/users/jwildeboer/statuses/114726269598973831

Insecure defaults can lead to surprises. When creating FIFO sockets with systemd, be sure to note that SocketMode defaults to 0666 - that is world readable and writable. That is: any local user can communicate with the FIFO. If your FIFO is used to perform privileged operations you must ensure that either the FIFO file itself is located in secured location or set SocketMode to stricter value.

I spotted one such insecure use in cloud-init: the hotplug FIFO was world writable. This is CVE-2024-11584 and fixed in cloud-init 25.1.3.

The commit fixing this is in https://github.com/canonical/cloud-init/pull/6265

#CVE_2024_11584 #ubuntu #systemd #infosec #cybersecurity

Sync security by blackboxsw · Pull Request #6265 · canonical/cloud-init

Sync security patches for release.

GitHub

@Fledglingnerd I can’t see the @pluralistic post you’re replying to but.. if we’re piling on libertarians.. has anyone mentioned the bears?

https://newrepublic.com/article/159662/libertarian-walks-into-bear-book-review-free-town-project

The Town That Went Feral

When a group of libertarians set about scrapping their local government, chaos descended. And then the bears moved in.

The New Republic
@anne_twain Good question. Let me try to explain. The element nitrogen just happens to form very strong bonds with itself. It's the coincidence of the size of the atoms, the charge on the nucleus and the number of electrons, but the result is that nitrogen forms a diatomic (two-atom) molecule, dinitrogen, that has one of the strongest bonds that we know of.
If you add in the fact that it is symmetrical, it means the molecule is particularly unreactive. It's "stable" and difficult to attack. 1/n

Great news everyone! Thomas Ptacek at Fly.io published "My AI Skeptic Friends Are Nuts", and it was shoved in front of me enough times that I have sentenced him to a swift death. Godspeed, Thomas, I pray that your incineration is speedy and painless.

https://ludic.mataroa.blog/blog/contra-ptaceks-terrible-article-on-ai/

Contra Ptacek's Terrible Article On AI — Ludicity

huh, you always learn something new.

automatic temporary ACL permissions on video/audio/etc devices for the active #linux user has been a thing for more than 10yrs: #uaccess

(active==sitting in front of the screen in contrast to using ssh remotely)

https://enotty.pipebreaker.pl/2012/05/23/linux-automatic-user-acl-management/

yet, the issue of writing documentation for it, is still open.

https://github.com/systemd/systemd/issues/4288

#systemd #acl

Linux automatic user ACL management | -ENOTTY

as usual, distance has brought clarity. i had overlooked the fact that i was seeing timeout errors, not lookup errors. the problem was not, in fact, dns. the problem was that the hostname resolved to 127.0.0.1, which means something different from the context of the container than it does from the host os.

i'm a little annoyed at myself for missing the obvious earlier, but at least it registered eventually, and i can move on without having that nagging "but i'm not really sure what was actually happening" feeling.
Use Signal. We promise, no AI clutter, and no surveillance ads, whatever the rest of the industry does. <3