Nick @internic@social.cleverlibre.org

What is common knowledge in your field but shocks outsiders?

More than half the CO₂ emissions of the industrial age have been dumped into the atmosphere since 1990.

Here is a Proof of Concept demonstrating the #samba smbd CVE-2023-3961 #vulnerability

1. On victim host running vulnerable Samba set up a unix domain socket only accessible as root user:
$ sudo socat UNIX-LISTEN:/pwned,mode=700,fork stdout

2. On attacking host:
$ smbtorture -U "" -N ncacn_np:victimhost[/pipe/../../../../../pwned] rpc.echo

At least stock Debian install samba allows anonymous exploitation in this manner. This is quite alarming, to say the least.

Note: smbtorture is built as part of samba build procedure – On Debian based systems you can use sudo apt build-dep samba && apt source samba && cd samba-* && dpkg-buildpackage to get it. Specify LD_LIBRARY_PATH as needed to make it find the necessary shared objects.

Note that smbtorture will talk MS-RPC protocol to the unix domain socket, and as such is not directly useful as generic #exploitation tool. #Weaponizing the vulnerability is left as exercise of the reader.

#infosec #proofofconcept

In my opinion, what most people are missing about the @AsahiLinux and @marcan efforts is that most system integrators like Dell, Lenovo don't dedicate even a tenth as much time to Linux support as the Asahi team does These companies usually restrict themselves to ensuring vendor driver availability and some lightweight QA which more often than not results in an experience fraught with quirks from faulty hardware support that you have to add on top of the usual Linux desktop UX caveats.

Remember Blockbuster?

Before sharing a take on #socialmedia, 4 questions to consider:

1) How likely is it that my words will be interpreted as I intended them?

2) Do I have an informed perspective?

3) Might I hurt others, even unintentionally?

4) What communities might I not be seeing on this issue?

"Evacuation orders by Israel to hospitals in northern Gaza are a death sentence for the sick and injured"

Link to full World Health Organization statement: https://www.who.int/news/item/14-10-2023-evacuation-orders-by-israel-to-hospitals-in-northern-gaza-are-a-death-sentence-for-the-sick-and-injured

Meanwhile, the communications minister of #Israel is proposing emergency regulations that would allow police to arrest citizens and journalists who publish content deemed to "harm national morale.” https://www.middleeasteye.net/news/israel-palestine-war-minister-seeks-arrest-journalists-harm-national-morale

People who pull crap like reporting other people because they're "doing Mastodon wrong": you are making Mastodon worse, not better. You are driving people away who have every right to be here. Stop it. If you can't be helpful, don't say anything. I block people like this on sight.

I encourage others to fight back against the HOA types: they're making the Fediverse worse for all of us. Be a friendly, helpful neighbor, not a Church Lady.

https://squawk.social/@Konaburd/111233795497967116

h/t @unchartedworlds
#StopTheHOA

'ChatGPT use shows that the grant-application system is broken' https://www.nature.com/articles/d41586-023-03238-5 - I'd go further; that LLMs can fool bureaucracies with bullshit shows the role of bureaucracy has never been to properly order and regulate, but simply to obfuscate the location of real power

Police in #Illinois say a boy was killed and a woman critically injured after they were stabbed by a man who targeted them because they were Muslim. https://chicago.suntimes.com/news/2023/10/15/23918129/muslim-hate-crime-wadea-al-fayoume-plainfield-joseph-czuba-palestinian-israel-war-murder

Sometimes I think about how much media will be forever lost in decades to come because everything is now on streaming platforms that delete things on a whim instead of physical media.

The fact that pretty much every 90's MTV show has the original music removed, except for— as of last year— Beavis and Butthead, honestly just pisses me entirely the hell off.

Logistically, I understand it, but paramount is rich as fuck, and can afford the fucking licensing for DARIA and THE STATE.

Niche toot perhaps, but why oh why are there no good artist impressions of a low-mass x-ray binary system available?

They’re either ridiculously low-resolution, look like they’ve been drawn with an Etch-a-Sketch, or have zero regard for physics. Often all three.

Am I really going to have to ask AI to make me one?!

(Not helped by trying to search the web while on a train moving at 300kmh, admittedly.)

George Santos threatened to resign from his seat in Congress if there is a deal with the Democrats to elect a Speaker.

In political terms, that’s called a win-win!

The most energetic single particle ever detected, a cosmic ray dubbed the "Oh-My-God" particle, was observed by the Fly's Eye Cosmic Ray Detector #OTD in 1991.

Its energy was about 3.2 x 10²⁰ eV ~ 51 J, equivalent to a baseball moving at almost 60 mph.

https://www.quantamagazine.org/the-particle-that-broke-a-cosmic-speed-limit-20150514/

Image: Olena Shmahalo/Quanta Magazine, using images of the Earth from NASA.

These days I'm primarily using #Firefox on my #Linux desktop (specifically Mint), and I'm curious if #passkey might be a reasonable option for me to use on sites that support it. I have an #Yubikey that I already use for #FIDO #2FA on sites that support it. I also have an Pixel phone with a titan chip, but I'm running #grapheneOS on there, and I'm not sure if that will complicate matters. Any relevant experience on either the phone or desktop front or pointers to relevant information would be appreciated.

Near as I can tell, it sort of sounds like passkey can work on Linux but maybe isn't supported in Firefox yet?

Just noticed a great Mastodon (web) feature: mouse-over emoticons and you get a popup saying what they are. If you are as emoticon-illiterate as me, you'll find this super-useful.

#eclipse #astronomy #math

I transcribed in LaTeX a portion of Dupuis's 1910 "Elements of
Astronomy: Principally on the Mechanical Side" for those, like myself, wondering about the basic science of astronomy.

http://gron.ca/math/dupuis_1910/dupuis.pdf