ilmagico

joined 2 years ago
[–] ilmagico 83 points 10 months ago

The first one was a genuine bug, the second a malicions backdoor. The only common thing is they are both open source projects. I agree with having more oversight and funding on critical open source software, but suggesting that these two vulnerabilities are the same in some way is a bit of a stretch.

[–] ilmagico 2 points 10 months ago (1 children)

While Google is hardly privacy-respecting and ad-free, I guess the fact it can be more easily customized is a plus, maybe I should consider it for the future. After all, that's the same reason I stick with Android.

Can GoogleTV be rooted like android can, preferably without resorting to hacks, like in some android phones where the bootloader is unlockable?

[–] ilmagico 3 points 10 months ago

Only Israeli I know that actually spoke out against apartheid and the oppression of Palestinian is Yuval Abraham. Are there others? I hope there are, and they are just afraid to speak up.

[–] ilmagico 5 points 10 months ago

There are very few Israeli that actually protest the killing of women and children, or any innocent Palestinian, while mostly are just upset the hostages haven't been rescued yet. I support those very few Israeli, who are probably afraid to come out (only one I know of here).

[–] ilmagico 5 points 10 months ago (6 children)

I mean, yeah sure, but are the alternatives that much better in this respect? Which alternative non-ad-ridden, privacy-respecting smart tv would you recommend (or ended up buying)? Asking for my future tv choice...

[–] ilmagico 11 points 10 months ago (1 children)

"security" for themselves, not the customer, I guess

[–] ilmagico 6 points 10 months ago* (last edited 10 months ago)

Unauthorized as in, not authorized to work, i.e. illegal workers. At least, that's how I read it

[–] ilmagico 1 points 10 months ago

I was not attacking you, I was trying to have a conversation. Yes, nazis spreading all over asia would be likely worse than two nukes over Japan, but in saying that, there is the underlying assumption that this spread was otherwise unstoppable, or in other words, that the Japanese were capable of perpetrating it, at the time (using the wording in my original comment) while in fact they were almost defeated already.

But maybe you disagree that they were effectively defeated, or maybe you had something else interesting to say other than "I don't need to make assumptions" right after making an assumption.

Anyways, you choose to call me dogshit, and have the guts to talk about nuance when you yourself don't seem to get it, so, I don't even know why I'm still wasting time with you. I'll just block you and move on. Au revoir.

[–] ilmagico 11 points 10 months ago

I agree with people saying this might be mostly for satellite images, but even a drone pilot, staring at a shaky and noisy camera image due to the distance, EW and other interference, might have a hard time telling a decoy from a real one, well, unless there's a helicopter on it of course.

[–] ilmagico 9 points 10 months ago (1 children)

I still run it on a 10 year old chromebox (replacing chrome with linux of course). It's really not that heavy. If it seems very slow, I'd try rebuilding the database from a dump (if mysql/mariadb), and making sure the db is on a fast drive. At least, those two things made a huge difference for me. Also, some people reported huge speedups switching to postgres.

[–] ilmagico 12 points 10 months ago (1 children)

From my understanding, Arch based distros don't link ssh with systemd, and so are likely unaffected. That includes EndeavourOS. Since researchers are still analyzing the code, Arch took some steps to patch it anyways, just in case there some other hidden backdoor.

[–] ilmagico 9 points 10 months ago* (last edited 10 months ago)

TL;DR: Simply downgrade to a version before 5.6.0, or follow the official recommendations for your distro. For Arch, for example, simply upgrade your system.

Explanation (from my understanding ): a malicious developer snuck a backdoor into xz, starting with version 5.6.0,and thankfully it was caught before it could do much damage. This seems to only affect Fedora and Debian based distros, or otherwise distros where ssh is patched to link to systemd, which in turn links to xz. Arch doesn't seem to be affected, but they took some preventative action. Again, follow the announcements from your distro, or just downgrade xz.

It is not yet clear what a malicious actor can do with that backdoor, but it seems, in affected systems, it enables remote code execution (if you don't know what that means, just know it's really bad), but last I checked security researchers were still analyzing the code. Things move fast, so maybe by now it is known.

view more: ‹ prev next ›