@flying_sheep@lemmy.ml avatar

flying_sheep

@flying_sheep@lemmy.ml

This profile is from a federated server and may be incomplete. Browse more on the original instance.

flying_sheep,
@flying_sheep@lemmy.ml avatar

I own a flat that I rent out to people who make similar amounts of money as I do.

That allows me to take a lower paid job that allows me to do more open source work.

I agree with your second paragraph.

flying_sheep,
@flying_sheep@lemmy.ml avatar

I’m renting to people who rent as a convenience, not because they can’t afford to buy a flat. I offered them decreased rent during COVID and they declined.

flying_sheep,
@flying_sheep@lemmy.ml avatar

Haha I would really like the thought process of the person who downvoted you. Maybe “since I’m forced to live in an immoral system, I can’t live a perfectly moral life and having a phone is OK. But going one iota beyond what I do is immoral”

IDK. I wouldn’t have posted if I wouldn’t have wanted to read people disagreeing with my assessment of the morality of what I do. But I was probably wrong to hope for a more nuanced criticism that actually tries to engage with my arguments instead of just knee-jerk downvoting.

flying_sheep,
@flying_sheep@lemmy.ml avatar

I think it’s hard to morally judge if it’s good or not. I don’t know who would have bought it if not for me: some faceless rent extraction company who keep increasing rent at the maximum legal rate? Or (unlikely in that spot, but possible) a couple who would live there?

As it is now, there’s a couple living there. Software engineers who already said they’ll move on soonish because they think Berlin is cooler. They pay below average rent and the one time something broke, I simply sent a repair person ASAP. Not really people I feel I’m taking advantage of.

XZ Hack - "If this timeline is correct, it’s not the modus operandi of a hobbyist. [...] It wouldn’t be surprising if it was paid for by a state actor." (lcamtuf.substack.com)

Thought this was a good read exploring some how the “how and why” including several apparent sock puppet accounts that convinced the original dev (Lasse Collin) to hand over the baton.

flying_sheep,
@flying_sheep@lemmy.ml avatar

Arch was never affected, as described in their news post about it. Arch users had malicious code on their hard disks, but not the part that would have called into it.

flying_sheep,
@flying_sheep@lemmy.ml avatar

Very funny. Lying to get people riled up is truly the greatest form of humor. Yawn

flying_sheep,
@flying_sheep@lemmy.ml avatar

I mean, teachers are not practicing the science they teach. They only need a textbook level understanding.

flying_sheep,
@flying_sheep@lemmy.ml avatar

Backdoor only gets inserted when building RPM or DEB. So while updating frequently is a good idea, it won’t change anything for Arch users today.

flying_sheep,
@flying_sheep@lemmy.ml avatar

Time to change that tarball thing. Git repos come with built in checksums, that should be the way to go.

flying_sheep,
@flying_sheep@lemmy.ml avatar

In this case I think that’s just Fedora and Debian Sid users or so.

The backdoor only activates during DEB or RPM builds, and was quickly discovered so only rolling release distros using either package format were affected.

flying_sheep,
@flying_sheep@lemmy.ml avatar

Since you didn’t build a RPM or DEB package however, your didn’t compile in the backdoor.

flying_sheep,
@flying_sheep@lemmy.ml avatar

No, read the link you posted:

Arch does not directly link openssh to liblzma, and thus this attack vector is not possible. You can confirm this by issuing the following command:


<span style="color:#323232;">ldd "$(command -v sshd)"
</span>

However, out of an abundance of caution, we advise users to remove the malicious code from their system by upgrading either way.

flying_sheep,
@flying_sheep@lemmy.ml avatar

I think it needs to be

  • rolling release (because it was caught so quickly that it hasn’t made its way into any cadence based distro yet)
  • using the upstream Makefile task to build a RPM or DEB (because the compromised build script directly checks for that and therefore doesn’t trigger for a destdir build like Gentoo’s or Arch’s)
  • using the upstream provided tarball as opposed to the one GitHub provides, or a git clone (because only that contains the compromised Makefile, running autotools yourself is safe)

Points 1 and 2 mean that only rolling release RPM and DEB distros like Debian Sid and Fedora are candidates. I didn’t check if they use the Makefile and the compromised tarballs.

flying_sheep,
@flying_sheep@lemmy.ml avatar

You’re right, there’s more parts to it, especially social engineering. Maybe there’s other ways to hide a payload, but there aren’t many avenues. You have to hide the payload in a binary artefact, which are pretty suspicious when you don’t do it in a (well scrutinized) cryptography lib, or a compression lib.

Then that payload has to be executed for some reason, which means you need a really good reason to embed it (e.g. something like widevine), or have to modify the build script.

Please, for the love of God, VOTE! (pawb.social)

I don’t like Biden either, but anyone with half a brain knows there are two choices in the 2020 election. If we had a sane voting system, voting third party might be worth it, but as it stands, no one but you knows your favorite candidate exists and unless you want to become their campaign manager that will still be true in...

flying_sheep, (edited )
@flying_sheep@lemmy.ml avatar

I’ve seen several in this thread who didn’t read the OP, didn’t engage with its arguments, just stomped their feet and said “but Biden didn’t give us exactly what we want so we’re not gonna”.

How can you reason with people who don’t feel like reading your argument?

flying_sheep,
@flying_sheep@lemmy.ml avatar

Wow what a horrible take. Just think about why this comparison is complete bullshit for a second and you’ll see.

flying_sheep,
@flying_sheep@lemmy.ml avatar

Then don’t engage. Some people apparently need to see this, judging from the comments here.

flying_sheep,
@flying_sheep@lemmy.ml avatar

Hahaha happens to many people who have brown skin or look like a punk or hippie in the eyes of some cop.

My dad used to wear a black leather vest and long hair. He was searched uncountable times.

flying_sheep, (edited )
@flying_sheep@lemmy.ml avatar

I’m German. I really hope you guys don’t vote for the fascist this time, but seeing comments like yours make me extremely happy that my partner emigrated from the US instead of still being there.

flying_sheep, (edited )
@flying_sheep@lemmy.ml avatar

I just think your humble opinion of the legislation being easily reversible is doing a lot of work here.

Are you really that sure that there will be no long term consequences if the guy comes into office who has explicitly stated his intention to become a “dictator for ‘a day’”, is really intent on stacking courts, fucking with elections, calling immigrants “vermin”, and so on?

Because if you’re wrong, there might be a civil war. And MAGA nut jobs statistically have more guns than us leftists.

flying_sheep, (edited )
@flying_sheep@lemmy.ml avatar

I’m aware that more than two parties technically exist in your country. I’m also not under the illusion that voting for one of them in the general election has an effect that’s distinguishable from not voting.

I mean, except for the individual third party voter, who has to leave the house and stand in a queue when voting third party.

It’s great to have a political system that allows for diverse political parties. Sadly the US in not a country where such a system exists.

Under normal circumstances, you won’t be able to ever reach critical mass with a third party, and they won’t give up power.

flying_sheep,
@flying_sheep@lemmy.ml avatar

Bt Eggplants in Bangladesh have higher yields and need less pesticide, which saves the lives of farmers who are too poor to buy protective gear and now need to spray much less pesticide.

onlinelibrary.wiley.com/doi/10.1111/ajae.12162

flying_sheep,
@flying_sheep@lemmy.ml avatar

No, because the kernel has a different goal than most other software. Linux agrees that breaking the userspace from userspace is sometimes necessary.

flying_sheep,
@flying_sheep@lemmy.ml avatar

Successful. Women actually attempt suicide more, but more often choose drug overdoses rather than immediately fatal means.

flying_sheep,
@flying_sheep@lemmy.ml avatar

So that “special release build” is the build you do debugging with. Shouldn’t you just modify the otherwise useless debug profile and turn on all the optimizations necessary to make it usable?

  • All
  • Subscribed
  • Moderated
  • Favorites
  • JUstTest
  • mdbf
  • everett
  • osvaldo12
  • magazineikmin
  • thenastyranch
  • rosin
  • normalnudes
  • Youngstown
  • Durango
  • slotface
  • ngwrru68w68
  • kavyap
  • DreamBathrooms
  • tester
  • InstantRegret
  • ethstaker
  • GTA5RPClips
  • tacticalgear
  • Leos
  • anitta
  • modclub
  • khanakhh
  • cubers
  • cisconetworking
  • megavids
  • provamag3
  • lostlight
  • All magazines