carrylex

joined 8 months ago
44
Low Level Fun (lemmy.world)
 
58
ichπŸš—iel (lemmy.world)
 

In Spanien passieren Sachen... Quelle

 

Also: Did you know that the Higgs-Bugson is a subspecies of the Heisenbug?

[–] carrylex 8 points 1 month ago

Short answer: Google Play

Long answer: Google Play and/or people with special requests like https://lemmy.ml/post/12332630

[–] carrylex 14 points 2 months ago (3 children)

Btw SAP GUI was probably developed by the same guy since it was perfect from the beginning...

66
Packaging (lemmy.world)
 
229
PS/2 things (lemmy.world)
submitted 2 months ago* (last edited 2 months ago) by carrylex to c/[email protected]
 

In todays edition of "stuff that I found in my storage" a PS/2 meme

Image transcription:

mov rax, rbx add rax, rcx HELLO IT'S THE KEYBOARD I HAVE AN IMPORTANT MESSAGE E

762
Packet Loss (lemmy.world)
submitted 2 months ago* (last edited 2 months ago) by carrylex to c/[email protected]
 

Found this in the depths of my storage. Not sure where its from but might improve the day of some people ^^

 
 

Still waiting for end to end encryption...

 

Source

Wisdom of the day:

  • Give your buildserver enough disk space
  • Don't underestimate compressed stuff
 

cross-posted from: https://lemmy.world/post/17714161

Template

Source - The colors of the grids represent CO2 emissions

The title is a reference to the 2021 Texas power crisis

[–] carrylex 12 points 5 months ago (3 children)

I also want to highlight Florida - which has around 10 different electric grids...

392
submitted 5 months ago* (last edited 5 months ago) by carrylex to c/memes
 

Template

Source - The colors of the grids represent CO2 emissions

The title is a reference to the 2021 Texas power crisis

[–] carrylex 9 points 5 months ago* (last edited 5 months ago) (5 children)

Well from my personal PoV there are a few problems with that

  1. You can't detect all credentials reliably, they could be encoded in base64 for example
  2. I think it's kind of okay to commit credentials and configuration used for the local dev environment (and ONLY the local one). E.g. when you require some infrastructure like a database inside a container for your app. Not every dev wants to manually set a few dozen configuration entries when they quickly want to checkout and run the app
[–] carrylex 47 points 5 months ago* (last edited 5 months ago) (7 children)

I also personally ask myself how a PyPI Admin & Director of Infrastructure can miss out on so many basic coding and security relevant aspects:

  • Hardcoding credentials and not using dedicated secret files, environment variable or other secret stores
  • For any source that you compile you have to assume that - in one way or another - it ends up in the final artifact - Apparently this was not fully understood (".pyc files containing the compiled bytecode weren't considered")
  • Not using a isolated build process e.g. a CI with an isolated VM or a container - This will inevitable lead to "works on my machine" scenarios
  • Needing the built artifact (containerimage) only locally but pushing it into a publicly available registry
  • Using a access token that has full admin permissions for everything, despite only requiring it to bypass rate limits
  • Apparently using a single access token for everything
    • When you use Git locally and want to push to GitHub you need an access token. The fact that article says "the one and only GitHub access token related to my account" likely indicates that this token was at least also used for this
  • One of the takeaways of the article says "set aggressive expiration dates for API tokens" - This won't help much if you don't understand how to handle them properly in the first place. An attacker can still use them before they expire or simply extract updated tokens from newer artifacts.

On the other hand what went well:

  • When this was reported it was reacted upon within a few minutes
  • Some of my above points of criticism now appear to be taken into account ("Takeaways")
[–] carrylex 3 points 5 months ago* (last edited 5 months ago)

Just for further clarification, the API works like this:

  • time is the local (client) time (in this case UTC-7)
  • servertimezone is the time zone where the server is located
  • timezoneoffset is the offset of the local time relative to the servertimezone (offset from the servers PoV)

To get the UTC date you have to do something like this:

time.minusHours(timezoneoffset).atZone(servertimezone).toUTC()
[–] carrylex 4 points 5 months ago (3 children)

Well if it's a 32bit timestamp you're screwed after 19 January 2038 (at 03:14:07 UTC)

[–] carrylex 35 points 5 months ago (9 children)

So just for additional context:

This meme was brought to you by the following API response scheme:

{
  "time": "2007-12-24 18:12",
  "servertimezone": "Europe/Vienna",
  "timezoneoffset": -8
}

when it could have just been

{
  "date": "2007-12-24T18:21:00-07:00"
}
[–] carrylex 4 points 5 months ago (1 children)

If you use utc here and a time zone definition changes, you’re boned

I'm pretty sure that things like the tz database exist exactly for such a case.

[–] carrylex 24 points 6 months ago (2 children)

As far as I can tell it's the other ways around: IPv4 is getting more costly

Example: AWS started to charge for IPv4 addresses a few months ago - a IPv4 address now costs around $3.6 per month

view more: next β€Ί