Polymaths.social

"Broccoli2Shell" is the dumbest fucking name for the CVE of the day because "Brotli" is a food item, and guess what: it's not broccoli!

I'm kinda sad that the PHP vulnerability happened when it happened, or that it was as big as it was. Because it kinda overshadowed the eMudhra certificate f-up, which is a much more interesting security incident if you ask me.

Don't get me wrong; all security incidents are important and interesting, and I wish that none of this had happened and I'm sending virtual support hugs to everyone managing this. But you have to admit that the PHP vuln was a... pretty standard one. Some old C code that had a bug in memory management, nobody noticed, then it was discovered with AI. Tale as old as time (given time = 1–2 years); almost every project has to deal with stuff like this.

Whereas the eMudhra certificate story is incredibly curious. An HSM producing single-byte private keys? Mozilla "detecting" it, causing legitimate keys to be rolled back? Sudden realization that every other piece of software vendors and bundles CA roots? How fun is that!?

Your typical #npm vulnerability report

RE: https://noc.social/@cloudflare/117411089839814724

Turns out, Deno 2.8 was the last nail in Deno's coffin, not just JSR's. RIP Deno; I really liked the runtime :(

Oh no... Google sadly remembered that it owns Snapseed and redesigned it, making it look and function worse than before :(

I sure hated Yosemite and subsequent macOS redesigns, but, back then, I did quite like the move to Helvetica (and later San Francisco) in UI texts. Yet today, I changed the font face of an app to Lucida Grande, and it instantly felt so... cozy, so nostalgic and just like home. I did not expect I would miss it, but, apparently, I do </3

Es nervt, dass es so wenig Alternativen im Bereich Home Internet gibt, vor allem Glasfaser. Ich wohne in einer Großstadt, und in meiner Wohnung habe ich die Wahl nur zwischen Telekom, Vodafone, und 1&1. O2 und der einzige regionale Anbieter können bei mir nur 50er DSL oder Kabel legen. Am Ende wählt man aus drei Optionen die, die am wenigsten scheiße ist, und ist gezwungen, dabei zu bleiben, weil die Konkurrenz einfach fehlt 😒

RE: https://www.tagesschau.de/wirtschaft/verbraucher/deutschlandticket-preis-110.html

Was ist das denn für ein krummer Preis? Warum nicht direkt 20 Ct. teurer damit's six-seven kostet?

"WARN: Tarball download average speed 13 KiB/s (size 109 KiB) is below 50 KiB/s"

pnpm warnings are not compatible with the harsh German reality

I love buying .de domains on Porkbun because at every step and in every page it goes like "Caution, your registry does weird shit that literally no one else does xD"

Deutsche Bahn's solution to the trolley problem is "Verspätung aufgrund von Personen im Gleis", which might be the most humane one, but it's the one I hate the most

the world if mozilla stops redesigning firefox every month

Does anybody know what happened to repology.org? Their NS have changed, and it now points to localhost. From the looks of it, the domain was suspended :(

Wie kann man sooo wenig Glück haben? 😭😭😭 Egal welchen Zug ich dieses Jahr nehmen will, hat er Verspätung und andere Abenteuer mit am Bord 🥲

Ich bin fast 27 Jahre alt, und ich habe heute das erste Mal wählen können. Nicht einfach ein Kreuz irgendwo setzen, sondern meine Meinung ausdrücken, ohne die Angst zu haben, dass alles eh geklaut und belogen wird.

Wählen können ist ein Privileg. Also wenn ihr in #Niedersachsen wohnt und ein:e EU-Bürger:in seid, geht und macht Gebrauch von eurem Privileg 🗳️

#Kommunalwahl

Tried git history split for the first time today, and it's bloody awesome. The idea of such a tool was enough to sell me on it, but the way it's implemented fits my mental model exactly. It just makes sense.

Kudos to Patrick Steinhardt and the whole #Git team for this!

TIL about the ReVanced drama and Morphe. God, can't people just get along so that I don't have to switch apps so often?

Finally, the last registrar for an obscure TLD I use for one of my domains now supports DNSSEC from any¹ provider! And with ed25519/ed448 support, too!

looking intensely at DENIC

There is one thing that always confused me in SSH, especially when I was a beginner: key fingerprints. No matter if at university or online, I have never properly learned about what they are and why they're useful. It's this funny thing that your key has, and different keys have different fingerprints, or something.

But the same applies to public keys! And the private/public key separation was a much bigger part of the curriculum. Always keep private key secret, and you may share your public key with anyone. And because public keys are non-sensitive, different, and even may have a comment, I have always used those as "identifiers" for my keys.

It becomes hard once you start doing more advanced stuff with SSH. You are troubleshooting your SSH agent, or you just want to see what keys there are, but ssh-add -l prints something you don't know how to verify. Same when you want to see what keys are there in your GitHub account, or to verify the authenticity of the machine you're connecting to. It's always fingerprints, and yet I was never taught about what they are or how to generate one.

I do understand the concept now, of course, but I still have to search the Web for the fingerprint command every time I need it 🥲

RE: https://mastodon.social/@mistersql/117031601599809156

I thought “Why not?” and migrated a few long posts from Fedi to my blog