Skip Navigation

carrylex

@ carrylex @lemmy.world

Posts
20
Comments
60
Joined
2 yr. ago

  • 🐧> 🪟

    Jump

  • under Wikipedia's entry for Secure boot

    What's the first thing under the "Secure boot" section? The section that it automatically scrolls to when clicking my link?

  • 🐧> 🪟

    Jump

  • Well the website (and the guy maintaing it) is pretty old. I think the blog posts reach back till Windows Vista. The guy itself wrote some books about Win95 so he has some experience.

    The site is quite popular in Germany and the information is usually good summarized and helpful IMHO.

    Anyway as always I recommend an adblocker when using the internet.

  • 🐧> 🪟

    Jump

  • 🐧> 🪟

    Jump

  • 🐧> 🪟

    Jump

  • AFAIK a new battery + entering the Bitlocker recovery key fixed the problems.

    Usually these batteries hold for years. I have a 15+ year old laptop where I had to replace the battery after ~10 years.

    However the affected laptops are now a few years old, aren't designed properly (I heard weird stuff happening like adding additional RAM somehow causes the display to fail) and somehow just have a CR2016 battery installed, not a bigger CR2032. And yes these are buisness-laptops designed for companies -.-

  • 🐧> 🪟

    Jump

  • Yes, multiple of our Windows laptops today couldn't boot and displayed a BitLocker error message and all affected laptops somehow had an empty BIOS battery...

  • using AWS

    Jump

  • Proprietary vs Open Source Backdoors

    Jump

  • Lemmy is open source, so feel free to go back to Reddit

  • Deleted

    Permanently Deleted

    Jump

  • Hope you have a rule day

    Jump

  • Code analyzer lore

    Jump

  • Can't wait for all the other horror stories getting posted here :D

  • FOSS infrastructure is under attack by AI companies

    Jump

  • IP based blocking is complicated once you are big enough

    It's literally as simple as importing an ipset into iptables and refreshing it from time to time. There is even predefined tools for that.

  • FOSS infrastructure is under attack by AI companies

    Jump

  • While AI crawlers are a problem I'm also kind of astonished why so many projects don't use tools like ratelimiters or IP-blocklists. These are pretty simple to setup, cause no/very little additional load and don't cause collateral damage for legitimate users that just happend to use a different browser.

  • I need to vent about Windows. I want workplaces to use Linux.

    Jump

  • because it takes a like 3 or 4 minutes to boot

    What kind of PC is this? Does it have an SSD?

  • Since when does a clock need a privacy policy?

    Jump

  • Seriously how many times does this have to happen

    Jump

  • Well from my personal PoV there are a few problems with that

    1. You can't detect all credentials reliably, they could be encoded in base64 for example
    2. I think it's kind of okay to commit credentials and configuration used for the local dev environment (and ONLY the local one). E.g. when you require some infrastructure like a database inside a container for your app. Not every dev wants to manually set a few dozen configuration entries when they quickly want to checkout and run the app

  • Seriously how many times does this have to happen

    Jump

  • I also personally ask myself how a PyPI Admin & Director of Infrastructure can miss out on so many basic coding and security relevant aspects:

    • Hardcoding credentials and not using dedicated secret files, environment variable or other secret stores
    • For any source that you compile you have to assume that - in one way or another - it ends up in the final artifact - Apparently this was not fully understood (".pyc files containing the compiled bytecode weren't considered")
    • Not using a isolated build process e.g. a CI with an isolated VM or a container - This will inevitable lead to "works on my machine" scenarios
    • Needing the built artifact (containerimage) only locally but pushing it into a publicly available registry
    • Using a access token that has full admin permissions for everything, despite only requiring it to bypass rate limits
    • Apparently using a single access token for everything
      • When you use Git locally and want to push to GitHub you need an access token. The fact that article says "the one and only GitHub access token related to my account" likely indicates that this token was at least also used for this
    • One of the takeaways of the article says "set aggressive expiration dates for API tokens" - This won't help much if you don't understand how to handle them properly in the first place. An attacker can still use them before they expire or simply extract updated tokens from newer artifacts.

    On the other hand what went well:

    • When this was reported it was reacted upon within a few minutes
    • Some of my above points of criticism now appear to be taken into account ("Takeaways")

  • Implementing RFC 3339 shouldn't really be that hard...

    Jump

  • Just for further clarification, the API works like this:

    • time is the local (client) time (in this case UTC-7)
    • servertimezone is the time zone where the server is located
    • timezoneoffset is the offset of the local time relative to the servertimezone (offset from the servers PoV)

    To get the UTC date you have to do something like this:

     
        
time.minusHours(timezoneoffset).atZone(servertimezone).toUTC()

  • Implementing RFC 3339 shouldn't really be that hard...

    Jump

  • Implementing RFC 3339 shouldn't really be that hard...

    Jump

  • So just for additional context:

    This meme was brought to you by the following API response scheme:

     json
        
{
  "time": "2007-12-24 18:12",
  "servertimezone": "Europe/Vienna",
  "timezoneoffset": -8
}

    when it could have just been

     json
        
{
  "date": "2007-12-24T18:21:00-07:00"
}