chameleon @ chameleon @kbin.social

i'm lizard 🦎

---

Read more

Posts

1

Comments

106

Joined

2 yr. ago

You're looking at the wrong line. NixOS pulled the compromised source tarball just like nearly every other distro, and the build ends up running the backdoor injection script.

It's just that much like Arch, Gentoo and a lot of other distros, it doesn't meet the gigantic list of preconditions for it to inject the sshd compromising backdoor. But if it went undetected for longer, it would have met the conditions for the "stage3"/"extension mechanism".

Sam Jones's FAQ is by far the best single source, links to other solid sources for more in-depth technical details and also lightly debunks a few things.

The main thing sources online disagree on are which distros are affected. That's because it's not a simple yes/no and some distros are taking a nuanced approach in their public communication, while others have chosen the sledgehammer in an attempt to get people to upgrade their systems but keep/kept the nuance in the back room where the audience understood not everything was known yet. Some distros are underselling how vulnerable they were, others are overselling it.

Realistically, I think vendors will be trying to push their crap using this attack as leverage. They did it with Heartbleed, Shellshock and the Log4j issue. Their software won't/wouldn't accomplish anything, just like it didn't with those issues, but they're sure as hell gonna try to make it seem like it does.

The base runtime pretty much every Flatpak uses includes xz/liblzma, but none of the affected versions are included. You can poke around in a base runtime shell with flatpak run --command=sh org.freedesktop.Platform//23.08 or similar, and check your installed runtimes with flatpak list --runtime.

23.08 is the current latest version used by most apps on Flathub and includes xz 5.4.6. 22.08 is an older version you might also still have installed and includes xz 5.2.12. They're both pre-backdoor.

It seems there's an issue open on the freedesktop-sdk repo to revert xz to an even earlier version predating the backdoorer's significant involvement in xz, which some other distros are also doing out of an abundance of caution.

So, as far as we know: nothing uses the backdoored version, even if it did use that version it wouldn't be compiled in (since org.freedesktop.Platform isn't built using Deb or RPM packaging and that's one of the conditions), even if it was compiled in it would to our current knowledge only affect sshd, the runtime doesn't include an sshd at all, and they're still being extra cautious anyway.

One caveat: There is an unstable version of the runtime that does have the backdoored version, but that's not used anywhere (I don't believe it's allowed on Flathub since it entirely defeats the point of it).

Unfortunately, it's definitively an instance of intentional design. This whole consent dialog thing became a booming "consent management platform" industry. Many of them advertise better acceptance rates than the competition, or used to but have removed those claims in more recent times now that the big GDPR boom is over.

This particular dialog is TrustArc, who are infamous. At one point they defended it with a "well, we gotta retry if it fails to make sure your preference is expected, and we can't know if your adblocker is causing it to fail or if it's just a fluke", which is one of those things where they say something that's not totally wrong but you know they're lying through their teeth.

Reproducible builds generally work from the published source tarballs, as those tend to be easier to mirror and archive than a Git repository is. The GPG-signed source tarball includes all of the code to build the exploit.

The Git repository does not include the code to build the backdoor (though it does include the actual backdoor itself, the binary "test file", it's simply disused).

Verifying that the tarball and Git repository match would be neat, but is not a focus of any existing reproducible build project that I know of. It probably should be, but quite a number of projects have legitimate differences in their tarballs, often pre-compiling things like autotools-based configure scripts and man pages so that you can have a relaxed ./configure && make && make install build without having to hunt down all of the necessary generators.

Won't help here; this backdoor is entirely reproducible. That's one of the scary parts.

This is a fun one we're gonna be hearing about for a while...

It's fortunate it was discovered before any major releases of non-rolling-release distros were cut, but damn.

Login isn't necessary, but there is no :latest tag published so you need to pull a version that exists. The current version is at codeberg.org/forgejo/forgejo:1.21.8-0 or at :1.21 if you want one that tracks patch updates (as found in the container registry).

My casual-browsing-only netbook is currently running on a RAID0 setup between the internal eMMC and the microSD card because I think it's funnier that way. Nothing useful's stored on there and it's one nixos-rebuild away from being reinstalled so I don't mind the inevitable breakage.

Someone hacked in a clear (in-game). First time it happened to this level, but not the first time it happened overall.

sudo mv /etc/default/grub /root/old_etcdefaultgrub to get it out of the way, then sudo dnf reinstall /etc/default/grub to reinstall the package that provides it, giving you a fresh unmodified copy. Should work for practically any config file on Fedora.

Storj is blockchain stuff with the storage and bandwidth provided by individual node operators. They've kinda tried to bury the whole blockchain stuff and generally keep it removed from their main signup/pricing/usage flow; customers pay in USD and never have to see any of it. But it's still there in the background and it's still the main reward system for node operators.

There's some clickwrapped T&Cs for operators that set some minimum requirements, they've made sure one node leaving doesn't cause data loss, but I'd still be very wary of using them for anything irreplaceable. It only takes one crypto crash or the like for the whole thing to die out, and while they might end up suing some guys running an old NAS out of their garage, that's not gonna get your data back.

Already been done, there's a data dump of every MM1 course on archive.org. The dump is dated but it came after level uploads for MM1 were shut down so it should be about as complete as it gets, minus courses deleted by Nintendo before that.

Actually playing anything seems to be quite complex but there's some instructions in the reviews, so it should be doable for someone to set up a replacement server in the future (Pretendo network already has the basics for custom Wii U online running).

DP is very much not free. VESA themselves is happy to tell you that DisplayPort is excluded from their list of free standards, and the leaked copies of old standards are stamped with a "distribution to non-members is prohibited" notice on every page.

I'm not sure where that misconception came from, but it really needs to stop at some point. The best thing to say about VESA is they're slightly less bad than the HDMI Forum. But only by so little.

This is a shot in the dark, but since the permissions look fine to me, the only other thing that comes to mind is that the SELinux contexts might not have been copied. Fedora is one of the few distros that enables SELinux in enforcing mode right out of the box. That can be very complex to understand if it breaks.

There is a Fedora documentation page about SELinux. The /var/log/audit/audit.log log file should be full of errors relating to your /home if it broke. I believe that stat /home and stat /new_home should display the SELinux context if SELinux is active, and they should be identical.

Also possible I'm totally off the mark, though, it's just a possibility.

I don't think Factorio is suitable for a first-time gamer. The way the inventory, hotbar and the map work aren't immediately obvious if you've never played a game. If you do try, at least turn biters off. The time pressure that's added by having to set up defense would be difficult enough to handle, but offensive combat is quite the struggle if you're still trying to learn basic gaming controls. You'd be dealing with things like swapping hotbars to one with grenades & stuff, control schemes changing the moment you get into a vehicle and weird targeting quirks. And by the time you get to trains or advanced oil cracking quite a lot of people tend to drop off the game in general.

I'd start with something like Minecraft on peaceful difficulty, then give easy or normal a try after a couple of hours if that goes well. Peaceful leaves time to learn all the basic controls and is fun enough to run around in by itself, and you're not going to get blasted by a creeper that fell behind you.

For the port thing, you can set the net.ipv4.ip_unprivileged_port_start sysctl to a lower value like 80 (may need to go lower if you also do email). It also applies to IPv6.

The default of 1024 is for security, but the actual security granted by it is not really that relevant nowadays. It stems from a time where ports 1024 were used by machines to trust other machines using stuff like rsh & telnet, and before we considered man-in-the-middle attacks to be practical and relevant. Around the start of this millennium, we learned better. Nowadays we use SSH and everything is encrypted & authenticated.

The only particularly relevant risk is that if you lower it enough to also include SSH's default port 22, some rogue process at startup might make a fake SSH server. That would come along with the scary version of the "host key changed" banner so the risk is not that high. Not very relevant if you're following proper SSH security practices.

Within 15 days of making the account, to add. If you missed it or decided you'd rather not give them the password to your previous email account (the alt objective for the Gmail-specific thing) you don't get a second chance.

I get that it's free but I trust them much less because of the way they handle that.

It's difficult because you have a 50/50 of having a manager that doesn't respect mistakes and will immediately get you fired for it (to the best of their abilities), versus one that considers such a mistake to be very expensive training.

I simply can't blame people for self-defense. I interned at a 'non-profit' where there had apparently been a revolving door of employees being fired for making entirely reasonable mistakes and looking back at it a dozen years later, it's no surprise that nobody was getting anything done in that environment.