treffer · HackerTrans

há 6 mesesdiscuss

Or switch to HDR if you have a capable display.

I was pleasantly surprised that HDR also means you can control brightness - it is all software I that case!

And the brightness keys on an external Apple keyboard work.

treffer

há 6 mesesdiscuss

Oh great, I missed that end of the page. The "Round 2 details" links back to the blog and it is hard to see the FAQ on mobile (needs manual scrolling to the end).

Google search and Perplexity failed when I tried, too. Google search has caught up now (haven't retried Perplexity)

A 41.5mm diameter sounds good. That's a whopping 10mm/20% smaller than my current watch. Should be really neat given the thickness.

treffer

há 6 mesesdiscuss

I pre-ordered because I loved the Pebble Round - especially the size and look. My intended use case is for formal dress codes and special events (weddings, new years, ...) wheretny fennix 51mm does not fit in (literally and figuratively).

That said: I can't find full dimensions for the new round 2. I can guesstimate that it should be 10-20% smaller in diameter and less than 2/3 the thickness.

Would you mind sharing full dimensions or even update the post?

And congratulations! I really like this. I hope there will be enough of a market to support this project long term.

treffer

há 9 mesesdiscuss

I had 8 IPs in a hetzner server years ago. One IP had an iptables rule to accept openvpn on any port.

My openvpn config was a long list of commonly accepted ports on either tcp or udp.

Startup would take a while but the number of times it worked was amazing.

treffer

há 9 mesesdiscuss

Interesting. But who is OpenDevicePartnership?

Looking at the members on the repository this seems to be a Microsoft project?

treffer

há 9 mesesdiscuss

Compatibility as I understand it means "mixing this in a project is OK".

This is the case if the 2 license aren't at odds. Usually one license is stricter and you have to adhere to that one for the combined work.

A counter-example is GPLv2 and Apache license. Those 2 are incompatible. This was fixed with GPLv3 and you can often upgrade to GPLv3.

So no, this won't allow you to relicense as GPLv2. But you can use GPLv2 code.

This is especially relevant if you have such code redistribution clauses.

treffer

há 2 anosdiscuss

It just depends on what you use for management.

IIRC the /etc/network/interfaces does a reconfiguration that's pretty disruptive.

Things like brctl and ethtool worked on the fly without issues (note though that I mostly used Arista years ago).

It is usually non-disruptive if it gets applied as deltas. If your config tool does a teardown/recreate then that's disruptive. Within the bounds of ethernet and routing protocols (OSPF DR/DBR changes are disruptive, STP can be fun, ....).

treffer

há 2 anosdiscuss

The actual inclusion code was never in the repo. The blobs were hidden as lzma test files.

So you review would need to guess from 2 new test files that those are, decompressed, a backdoor and could be injected which was never in the git history.

This was explicitly build to evade such reviews.

treffer

há 2 anosdiscuss

Arch Linux switched switched from xz to zstd, with neglectable increase in size (<1%) but massive speedup on decompression. This is exactly the use case of many people downloading ($$$) and decompressing. It is the software distribution case. Other distributions are following that lead.

You should use ultra settings and >=19 as the compression level. E.g. arch used 20 and higher compression levels do exist, but they were already at a <1% increase.

It does beat xz for these tasks. It's just not the default settings as those are indeed optimized for the lzo to gzip/bzip2 range.

treffer

há 2 anosdiscuss

I tried to get the translation to trigger by switching to french and it does not show. You are right.

So it's just odd that the tags and release tarballs diverge.

treffer

há 2 anosdiscuss

Thank you, formatting fixed.

My TLDR is that I would regard all commits by JiaT75 as potentially compromised.

Given the ability to manipulate gitnhistory I am not sure if a simple time based revert is enough.

It would be great to compare old copies of the repo with the current state. There is no guarantee that the history wasn't tampered with.

Overall the only safe action would IMHO to establish a new upstream from an assumed good state, then fully audit it. At that point we should probably just abandon it and use zstd instead.

treffer

há 2 anosdiscuss

1. Everything must be visible. A diff between the release tarball and tag should be unacceptable. It was hidden from the eyes to begin with.

2. Build systems should be simple and obvious. Potentially not even code. The inclusion was well hidden.

3. This was caught through runtime inspection. It should be possible to halt any Linux system at runtime, load debug symbols and map _everything_ back to the source code. If something can't map back then regard it as a potentially malicious blackbox.

There has been a strong focus and joint effort to make distributions reproducible. What we haven't managed though is prove that the project compromises only of freshly compiled content. Sorta like a build time / runtime "libre" proof.

This should exist for good debugging anyway.

It wouldn't hinder source code based backdoors or malicious vulnerable code. But it would detect a backdoor like this one.

Just an initial thought though, and probably hard to do, but not impossibly hard, especially for a default server environment.

treffer

há 2 anosdiscuss

Ubuntu still ships 5.4.5 on 24.03 (atm).

I did a quick diff of the source (.orig file from packages.ubuntu.com) and the content mostly matched the 5.4.5 github tag except for Changelog and some translation files. It does match the tarball content, though.

So for 5.4.5 the tagged release and download on github differ.

It does change format strings, e.g.

   +#: src/xz/args.c:735
   +#, fuzzy
   +#| msgid "%s: With --format=raw, --suffix=.SUF is required unless writing to stdout"
   +msgid "With --format=raw, --suffix=.SUF is required unless writing to stdout"
   +msgstr "%s: amb --format=raw, --suffix=.SUF és necessari si no s'escriu a la sortida estàndard"

There is no second argument to that printf for example. I think there is at least a format string injection in the older tarballs.

[Edit] formatting

comments