plg94 · HackerTrans

vor 2 Monatendiscuss

some people just don't have a good memory for acronyms. It's one thing to learn the concept of a privilege escalation, but an entirely different thing to play mental memory with TLAs (three letter acronyms). Acronyms remove all the context from a term which makes them way harder to memorize. A bit like knowing your friends vs knowing their phone numbers.

plg94

vor 2 Monatendiscuss

Understanding a term with the help of context is very different from guessing what the letters of an acronym might mean. The latter is more like a crosswords puzzle, and a totally unneccessary task for the reader.

plg94

vor 2 Monatendiscuss

> Why isn't it the job of the distros to keep up on upstream security disclosures?

They can't, because (responsible) security disclosures are private, _not public_. That's the whole point of the system: notify the developers in private ahead of time (usually 30, 60 or 90 days) so they can write, test and roll-out the fixes before you release the info to the whole world. This is to minimize the time between when bad actors gain access to the exploits vs. when users install the patch. So "keeping up on security disclosures" cannot ever be a 'pull' process.

Usually the maintainers of the big distros are part of (private) security mailinglists and receive such info. Just not in this case it seems.

plg94

vor 2 Jahrendiscuss

> considered classics

Great games, but all you listed are barely 3 years old – can something that young already be considered a "classic"?

plg94

vor 2 Jahrendiscuss

https://en.wikipedia.org/wiki/Seagull_management : come in, make a lot of noise, shit everywhere, leave

plg94

vor 2 Jahrendiscuss

The headstone (https://de.wikipedia.org/wiki/Carl_Friedrich_Gau%C3%9F#/medi...) does not (it does feature the star of David, but I couldn't find any notion that Gauß was jewish).

But there's a statue with that star (https://de.wikipedia.org/wiki/Carl_Friedrich_Gau%C3%9F#/medi...)

plg94

vor 2 Jahrendiscuss

For 17, Gauss noticed that cos(360°/17) can be written only with elementary operations, see https://www.heise.de/imgs/18/2/1/2/3/3/6/4/siebzehneck-b95b5...

Later he proved that all n-gons with $n=2^k*p_1…*p_r$ where the p_i are Fermat-primes (2^(2^m)+1 prime, today we only know of 3, 5, 17, 257, 65537) are constructible. The opposite direction, i.e. all other n are not constructible, was only a few years later proved. Look up "Theorem of Gauss-Wantzel". I only skimmed the proof, but it seems to generalize the concept of constructing the cos of the angle with "Galois-Theory".

(edit: or see https://en.wikipedia.org/wiki/Constructible_polygon)

plg94

vor 2 Jahrendiscuss

I believe if things get too heated, all the parties involved should be forced to meet in person for a weekend to talk things out. I'm sure it would solve like 90% of these stupid conflicts, because people rarely get _that_ riled up when in the same room. Written communication, especially asynchronus ones like email or forums, are just unsuitable to capture all nuances of human behaviour. Someone is tired or hungry and makes a bad joke; next thing you know there's a witchhunt…

(I also don't think they should be allowed to cite things said 5 years ago as a reason to ban someone today. How could that still be relevant?)

plg94

vor 2 Jahrendiscuss

You did have any opportunity to rewrite your sentence to use any other word than f**, one that did not require self-censoring. Yet you did not. Why?

plg94

vor 2 Jahrendiscuss

I don't have a factual answer for you (be interested in one, too), only a cheek-in-tongue one: It's like politics, the only thing you have to do to get elected is to get people to vote for you. And often the vote is only among people who _want_ to be elected (and in a position of power), massively reducing the pool of good candidates.

plg94

vor 2 Jahrendiscuss

wow, you made hackernews turn into tumblr. Well done, great explanation.

plg94

vor 2 Jahrendiscuss

Maybe. That drugstore chain mainly sells hygiene products. Their "main" side-business is printing photos, both digital and on film. (Yes, even in 2024 in Germany it's still possible to hand in your film in a small drugstore and have the photos developed and ready for pick-up a week later.) So I guess printing on normal paper is just a side-side business that developed naturally.

Anyway, the 10c/page (A4 b/w) is still a good estimate, at least when I looked pre-pandemic (it might've increased slightly to 12 or 15c by now). A lot of cities, especially those with a University, have dedicated small "Copyshops" where you can walk in and get your 100+ pages thesis printed and bound within 20min. So the prices and service are aimed mostly at Students. It's true colored pages are significantly more expensive than b/w, but overall that's still cheaper.

plg94

vor 2 Jahrendiscuss

why over 8k??? The linked [dmca notice](https://github.com/github/dmca/blob/master/2024/04/2024-04-2...) lists exactly 12 repos, not 8000. Where did they get this info from?

edit: ah, the number of 8,535 is in the beginning of the notice itself, but due to the large number they did not list all of the forks, I guess the listed ones are the only non-forked repos.

plg94

vor 2 Jahrendiscuss

That doesn't matter, in most jurisdictions stealing trash is still stealing. If I'm disposing chemical waste in your backyard, do you automatically become the owner?

plg94

vor 2 Jahrendiscuss

Yes, for big parts where they know it will come down to the surface they try to aim for water, like they do with all the rocket boosters etc. However that's still risky, so given the choice between (fast descent and aim for ocean) and (slow descent to burn up in atmosphere) they almost always aim for the latter. Plus you can only "aim" something like a rocket booster or a satellite that can still generate a little thrust of its own. This case was more like throwing your heavy backpack from the top of a skyscraper – 3 years ago(!!). That's impossible to control. Plus it has been an emergency solution anyway, see https://www.space.com/space-station-jettisons-huge-space-jun...

plg94

vor 2 Jahrendiscuss

But are you allowed to sell it? I'd think it still belongs to NASA. If an airplane flies over your house and drops an engine into your back yard, you can't just auction it off but have to hand it over to the authorities. Or if someone – accidentally or not – throws his Rolex watch into your window. He'll have to pay for the damage, but the object is still his property.

plg94

vor 2 Jahrendiscuss

I was given [1,2] in the second run. Even easier to see it's impossible.

plg94

vor 2 Jahrendiscuss

that was the whole reason this was caught this early, because Andres Freund was runnig Debian Testing (or Unstable)

plg94

vor 2 Jahrendiscuss

One of the problems with the "money solution" in this case is that xz is a very small, relatively stable software. Sure things like the linux kernel, firefox, gnome or openssh could use huge donations to fund multiple developer day jobs for years. But xz is small, it doesn't need to add a lot of new features constantly. It does need maintenance, but probably only like a couple hours each month – surely not enough to warrant a full-time day job. So what does the dev do to spend the other 90% of his time (and earn the other 90% of the money)? Some people don't like juggling multiple jobs (very stressy), some corporate jobs don't allow it, plus you've done nothing to reduce the Bus-factor (ideally any vital library should have 2,3,… people working on it, but who can take of just 5% of his day job to devote to open source maintenance?)

plg94

vor 2 Jahrendiscuss

You do realize that "that shit" was part of the obfuscated and xz-compressed backdoor hidden as binary test file, right? It was never committed in plain sight. You can go to https://git.tukaani.org/xz.git and look at the commits yourself – while the commits of the attacker are not prime examples of "good commits", they don't have glaringly obvious red flags either. This backdoor was very sophisticated and well-hidden, so your comment misses the point completely.

comments