barubary

@barubary@infosec.exchange

Indoor European. I know #regex. I write #code (in #C or #Haskell or #Perl or #JavaScript or #bash).

This profile is from a federated server and may be incomplete. Browse more on the original instance.

c47, to vim
@c47@chaos.social avatar

https://www.youtube.com/watch?v=cNbcRXKsXfc

OMG!! This one contains so much interesting information about vim and regex stuff 😮 Super interesting... also the problem itself that gets solved is a nice one!! 😺

barubary,

@c47 Instead of all that crazy macro stuff, you can just use a regex:

(.)%(1@!.1@!.1@!)@=(.)%(2@!.2@!)@=(.)3@!.<br></br>

Which is admittedly unreadable, so here it is with some extra formatting/comments:

(.)  # match and capture (in 1) any single character<br></br>  %(  # group (but don't capture) ...<br></br>    1@!  # not-followed-by whatever is in 1 (i.e. what was matched by the first capturing group)<br></br>    .  # match/advance by any single character<br></br>    1@! .  # same thing: any single character that is not 1<br></br>    1@!  # same thing: ... not followed by 1 agin<br></br>  )@=  # ... end of group, positive lookahead: match any single character followed-by 3 characters that are different<br></br>(.)  # match and capture (in 2) another single character<br></br>  %(  # group (but don't capture)<br></br>    2@! .  # any single character that is not 2<br></br>    2@!  # not followed by 2 again<br></br>  )@=  # ... end of group, positive lookahead<br></br>(.)  # match and capture (in 3) another single character<br></br>  3@!  # not followed by 3<br></br>.  # another single character<br></br>

In essence, we can use (.) followed by 1@!. to say "match some character" followed by "some character that is different from the first one".

We use this to match the first character and ensure that the three next characters are different from the first one:

Axxx<br></br># where x is not equal to A<br></br>

The xxx check is in a look-ahead group, so it doesn't advance the overall match position, which means we can now check against the second character:

ABxx<br></br># where x is not equal to B<br></br># (and in round 1 we've already checked that none of them are equal to A)<br></br>

The same thing repeats for the third character:

ABCx<br></br># where x is not equal to C<br></br>

And the last character can just be matched by . because we've ensured that it is not equal to any of the first three.

SwiftOnSecurity, to random

Me, being brought into a multi-vendor multi-day P1 incident because I’m good at Windows:

“Has anyone looked at the Windows logs?”

Narrator: They had not looked at the Windows logs.

Post-credits scene: The error was in the Windows logs.

barubary,

@swelljoe No idea if it's still there, but a good 20 years ago, one of the entries in the Perl FAQ (reliably findable with perldoc -q 500) was basically "my CGI script is giving me a 500 Internal Server Error, how do I fix it?" The answer was along the lines of "you need to look at the error log of your web server, it could be a lot of things."

barubary, to random

Orphans can't become zombies.

Norore, to random French
@Norore@social.zdx.fr avatar

Dites, les gens qui font du , un Net::LDAP->new() qui ne semble rien renvoyer et où le die() n’est pas levé, ça vous parle ? Je suis sûre de ma syntaxe et du serveur LDAP, ce script marche sur un autre serveur, mais là, le new() ne se fait pas, et je n’ai aucune idée de où je pourrais regarder pour essayer de comprendre ce qu’il se passe…

barubary,

@Norore That description doesn't really make sense to me. I had a look at the Net::LDAP code and it seems like it always returns something, either undef or an object. It's hard to tell more without seeing the script that's giving you trouble.

josephcox, to random

New: people have discovered a bypass that allows them to upload straight up porn to Instagram. You put a timer in front of the video, that's it. This stuff remains up, while sex workers ordinarily get banned from the platform https://www.404media.co/how-to-upload-porn-to-instagram/

barubary,

@josephcox Oops, I first misread that as "... allows them to upload straight porn".

barubary, to random

Microservices are great if you hate types and just want to pass strings around.

bmi, to random German
@bmi@social.bund.de avatar

Unser Gesetzespaket zur Verbesserung von Rückführungen ist im Bundestag verabschiedet worden. Damit schaffen wir die Grundlage dafür, dass Menschen ohne Bleiberecht schneller unser Land verlassen müssen.

Ein notwendiger Schritt, damit wir unserer humanitären Verantwortung für Menschen, die wir vor Krieg und Terror schützen, weiter gerecht werden können.

Mehr Informationen: https://www.bmi.bund.de/SharedDocs/kurzmeldungen/DE/2024/01/bt_verbesserte_rueckfuehrung.html

barubary,

@bmi Unser Gesetzespaket? Damit schaffen wir, dass Menschen unser Land verlassen müssen?

Wer seid "ihr" denn? Wer spricht da, und seit wann gehört dieses Land "euch"? Oder soll hier suggeriert werden, die ganze deutsche Bevölkerung hätte dieses Gesetz geschrieben und beschlossen? Ich fühle mich jedenfalls nicht repräsentiert. Ich bin zwar Teil dieser Gesellschaft, um deren "Akzeptanz von Migration" hier vorgeblich gebuhlt wird, aber ich finde es abstoßend.

Und überhaupt: Was soll dieses Gerede von der "Verbesserung der Rückführungen", wenn im Gesetz dann gar nichts davon steht, die Rückführungen besser zu machen? Stattdessen werden die Befugnisse der Polizei erweitert, die Räume von unbeteiligten dritten zu durchsuchen, um vielleicht doch noch irgendwelche privaten Dokumente zu finden. Und dann soll ohne Ankündigung direkt abgeschoben werden. Was ist daran humanitär? Für wen ist das "besser"?

vagina_museum, to random
@vagina_museum@masto.ai avatar

"Four Torsos" by Félix Vallotton, 1916. Courtesy of Cantonal Museum of Fine Arts, Switzerland.

barubary,

@joborg @vagina_museum Probably "Musée cantonal des Beaux-Arts de Lausanne":
https://www.mcba.ch/en/collection/quatre-torses-four-torsos/

cstross, to random
@cstross@wandering.shop avatar

How 'sleeper agent' AI assistants can sabotage your code without you realizing

Today's safety guardrails won't catch these backdoors, study warns

https://www.theregister.com/2024/01/16/poisoned_ai_models/

barubary,

@TeflonTrout We could call it "github".

barubary, to random

Had some cake today. Ate it, too.

luis_in_brief, to random
@luis_in_brief@social.coop avatar

Put out a post trying to explain the case to normies. Lots of nuance lost in a post of this length, of course, but the tldr is that @conservancy had a very significant win. Some more details, a lot of which wouldn't fit in the post, in 🧵.

https://blog.tidelift.com/will-the-new-judicial-ruling-in-the-vizio-lawsuit-strengthen-the-gpl

barubary,

@karlauerbach "unless the copyright is registered you can't get into court" - I thought that only applied to US copyright holders because foreign creators can't be expected to register their works in the USA. I might be wrong, though.

ovid, to random
@ovid@fosstodon.org avatar

's endorsement of , even after Trump viciously attacked him and Ramaswamy ended his presidential bid, shows the new : feeding the hand that bites them.

Why would anyone vote for this cowardly lot?

barubary,

@ovid Didn't the same thing happen with Ted Cruz last time?

barubary, to random

There is no such thing as a self-made person.

God/Jesus is a logical absurdity.

barubary, to random

I fought the type system and the type system won.

anderseknert, to OpenAI
@anderseknert@hachyderm.io avatar

Someone on LinkedIn pointed out that doesn’t use an LLM for their support chat, but has instead opted to use some extremely limited decision tree. Which is both understandable, telling, and fucking hilarious.

barubary,

@AlSweigart Eh, I can't speak for Rainer, but someone calling themselves "John AI Blockchain Doe 4.0" triggers my sarcasm detector.

pmakholm, to random
@pmakholm@fosstodon.org avatar

As an experiment I would like to try to maintain a blog by exporting threads from Mastodon to a more static format.

I hoped I could find a CLI tool resembling MastoReader, but no luck. Turns out it was really easy to do in quick and dirty Perl. So this is my new blogging pipeline:

https://gist.github.com/pmakholm/e841e3e5686f2751bfde2e33ef398e56

barubary,

@pmakholm Nice.

(Btw, the lines with use strict; and $replies->{$replyTo} ||= []; are redundant.)

barubary,

@pmakholm I'm slightly amused because implicit use strict is old hat to me (it's been there since use v5.12), but implicit use warnings (which your code uses) is fairly new (since 5.36) and I'm still getting used to it.

smxi, to fedora
@smxi@fosstodon.org avatar

More / CPU issues, it looks like / have changed a default standard path in /sys for unknown reasons, thus breaking inxi cpu speed collection. This tripped need to do more refactors, this time to the fake cpu data debugger logic, it was not complete.

Also, a new codeberg issue pointed out that in many I can get basic RAM/RAM array data from udevadm, which appears to dump some dmi data into itself, available to user.

Still tracking down root causes.

barubary,

@adamw The official list is in the "perlmodlib" page: https://perldoc.perl.org/perlmodlib#THE-PERL-MODULE-LIBRARY

barubary, to random

@thunderbird Just updated Thunrderbird. Got a web page asking for donations. Page design is kinda sus (doesn't tell you who's behind it, there are no links with more info or "about us", etc., not sure this is even legal in Germany), but I decided to click the Donate button anyway. Got nothing; button doesn't work, just reloads the page. Might want to fix that.

barubary,
barubary,

@thunderbird Ah, I see. I block third-party trackers and your site tries to load scripts from "fundraiseup.com". If that fails for any reason, all the Donate buttons just become non-functional.

GossiTheDog, to random
@GossiTheDog@cyberplace.social avatar

⚠️ want a highly impactful, actively exploited border gateway zero days situation to wake you up?

Ivanti Pulse Secure aka Ivanti Connect Secure and Ivanti Policy Secure Gateway customers - prepare to deploy mitigations and await follow on patches.

In the wild exploitation, probable nation state - includes authentication (including MFA) bypass and code execution.

Looks like Ivanti have done a really good job identifying.

I call it ConnectAround.

barubary,

@GossiTheDog

../../ directory traversal

What year is it?!

sluttymayo, to random
@sluttymayo@jorts.horse avatar

typo "wowzers" as "wowzera" and it sounds like the name of a genus of flowers, and i'm picturing daisies with owen wilson's face in the middle

barubary,

@sluttymayo king kong vs wowzera

barubary, to random
#!/usr/bin/perl<br></br># 472-byte qrpff, Keith Winstein and Marc Horowitz <sipb-iap-dvd@mit.edu><br></br># MPEG 2 PS VOB file -> descrambled output on stdout.<br></br># usage: perl -I <k1>:<k2>:<k3>:<k4>:<k5> qrpff<br></br># where k1..k5 are the title key bytes in least to most-significant order<br></br><br></br>s''$/=2048;while(<>){G=29;R=142;if((@a=unqT="C*",_)[20]&48){D=89;_=unqb24,qT,@<br></br>b=map{ord qB8,unqb8,qT,_^$a[--D]}@INC;s/...$/1$&/;Q=unqV,qb25,_;H=73;O=$b[4]<<9<br></br>|256|$b[3];Q=Q>>8^(P=(E=255)&(Q>>12^Q>>4^Q/8^Q))<<17,O=O>>8^(E&(F=(S=O>>14&7^O)<br></br>^S*8^S<<6))<<9,_=(map{U=_%16orE^=R^=110&(S=(unqT,"xbntdxbzx14d")[_/16%8]);E<br></br>^=(72,@z=(64,72,G^=12*(U-2?0:S&17)),H^=_%64?12:0,@z)[_%8]}(16..271))[_]^((D>>=8<br></br>)+=P+(~F&E))for@a[128..$#a]}print+qT,@a}';s/[D-HO-U_]/$$&/g;s/q/pack+/g;eval<br></br>
ddosecrets, to random

Announcing the Greenhouse Project - a new anti-censorship initiative from . By acting as a 'publisher of last resort' and ensuring the reporting and source files are preserved, the Greenhouse Project builds on DDoSecrets' previous efforts to reverse the chilling effects of censorship by creating a "warming effect". https://ddosecrets.com/wiki/Appin_Uncensored

After Reuters published an exposé about an Indian hacking firm, a temporary court order forced them to remove the reporting from their website. The article was subsequently removed from the Internet Archive, and other outlets began to censor their coverage as well, removing passages and entire articles. The original Reuters article has now been uncensored by Distributed Denial of Secrets, and is presented here along with the documentation: https://ddosecrets.com/wiki/Appin_Uncensored

Donate to DDoSecrets to keep leaks and publishing alive in 2024: https://donorbox.org/ddosecrets-five-years-later

barubary,

@yala Last time I looked, sites could use robots.txt to exclude pages from the internet archive, even retroactively.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • megavids
  • kavyap
  • DreamBathrooms
  • normalnudes
  • magazineikmin
  • InstantRegret
  • GTA5RPClips
  • thenastyranch
  • Youngstown
  • rosin
  • slotface
  • osvaldo12
  • ngwrru68w68
  • ethstaker
  • JUstTest
  • everett
  • Durango
  • Leos
  • cubers
  • mdbf
  • khanakhh
  • tester
  • modclub
  • cisconetworking
  • anitta
  • tacticalgear
  • provamag3
  • lostlight
  • All magazines