Dustri

my friend made a write up before about the inadequecies of python: https://dustri.org/b/friends-dont-let-friends-write-production-softwar… Personally, I’ve been pretty happy with python, I think it works wonderfully as a glue language (like bash); I.E: you shouldn’t write a lot of it, you should use it for plumbing. Its fantastic for that.

libpas is now in mimalloc-bench (https://github.com/daanx/mimalloc-bench). Thanks to Julien Voisin (https://dustri.org), which makes about 20 allocators that can be compared on a collection of workloads.

> Internationalisation is hard, like for Пётр Ильич Чайковский (Tchaikovsky) and his 31 different names on MusicBrainz. https://dustri.org/b/horrible-edge-cases-to-consider-when-dealing-with… Also from Wikipedia: Pyotr Ilyich Tchaikovsky (note: Often anglicized as Peter Ilich Tchaikovsky; also standardized by the Library of Congress. His names are also transliterated as Piotr or Petr; Ilitsch or Il'ich; and Tschaikowski, Tschaikowsky, Chajkovskij, or Chaikovsky. He used to sign his name/was known as P. Tschaïkowsky/Pierre Tschaïkowsky in French (as in his afore-reproduced signature), and Peter Tschaikowsky in German, spellings also displayed on several of his scores' title pages in their first printed editions alongside or in place of his native name. The modern transliterations of Russian produce the following results for 'Пётр Ильич Чайковский' — ISO 9: Pëtr Ilʹič Čajkovskij, ALA-LC: Pëtr Ilʹich Chaĭkovskiĭ, BGN/PCGN: Pëtr Il'ich Chaykovskiy.) https://en.wikipedia.org/wiki/Pyotr_Ilyich_Tchaikovsky

https://dustri.org/b/my-experience-with-canonicals-interview-process.h… is one example

I know gitea / forgejo will be a popular suggestion, either self-hosted or via something like Codeberg. Despite also being a GitHub user since 2010 and also "doomscrolling" issues for projects I am involved in, I do host a gitea for personal projects where I don't need the GitHub network effect. It works well and is surprisingly capable! Having said that, I stumbled upon this curious blog post about a security issues in Forgejo: https://dustri.org/b/carrot-disclosure-forgejo.html

The same, for Caddy: https://www.dustri.org/b/serving-a-gzip-bomb-with-caddy.html 10T is probably overkill though.

It seems hard to "disable" the issues mentioned at https://dustri.org/b/upcoming-hardening-in-php.html

OTR uses obsolete insecure crypto unfortunately. https://dustri.org/b/time-to-sunset-otr.html

You are probably thinking of https://dustri.org/b/horrible-edge-cases-to-consider-when-dealing-with…

>It's been a few years now and I don't think any Spectre attack has ever been spotted in the wild https://dustri.org/b/spectre-exploits-in-the-wild.html However, I agree on your points. I just hope it makes Intel's share price dip so I can make more money.

"Every other browser vendor is a for-profit entity, ..." Not the one that authored the text-only browser I am typing this from. Whether Mozilla turns a profit or not makes little difference in this instance. Mozilla does not survive on donations from users. Its employees are not volunteers working for free to defend user privacy. Its generously compensated executives and staff need money from the online ad business, just like employees from the other browser vendors. If Mozilla stopped taking money from Google or some other online ad business partner, then Mozilla employees would lose their jobs. Maybe of interest: https://dustri.org/b/mozilla-is-still-screwing-around-with-privacy-in-…

This feature (or the decisions behind it) does harm non-users. Firefox devs have publicly claimed that it will replace Firefox's current reading list. Before Pocket integration, the integration of Reading List into Firefox Sync was planned, which is a end-to-end encrypted service with very strict ToS -- much stricter than Pocket's current ones: http://dustri.org/b/firefox-youre-supposed-to-be-in-my-pocket-not-the-… Claiming that no money was involved makes the situation much worse -- it implies your core values have changed.

Link is a 404, here's the correct one: http://dustri.org/b/torbundlebrowserorg.html

--- In this session we are going to explore the vulnerabilities documented in this carrot disclosure post at https://dustri.org/b/carrot-disclosure-forgejo.html and try to reproduce the script that explores the chain to gain admin access to forgego. The post mentions just briefly what's been used to create the vuln chain: `SSRF in a lot of places, no CSP/Trusted-Types, a bit of ghetto templating in javascript, cryptographic malpractices, overlooks in the authentication mechanisms (OAuth2, OTP, sessions/access handling, post-compromission recovery, …), a bunch of low-hanging DoS, information leak all over the place, various TOCTOU, … All in all, it took me one evening after work to find a good amount of vulnerabilities (adding to the one I got from looking at gitea at some point in the past), and chain some of them to obtain a full-blown RCE`. There is also the outline of the script call and the output we will use to base the script reproduction: ``` $ python3 ./chain_alpha.py --target http://127.0.0.1:3000 > out.txt $ grep Backdoor out.txt [+] Backdoor admin created: svc_ljeopgid / dukecepapsygiqks!A1 $ tail -n17 out.txt ================================================================ [+] COMMAND EXECUTION CONFIRMED! ================================================================ Server-side hook output (received via git push stderr): remote: ========================================== remote: FORGEJO RCE PoC - Command Execution Proof remote:…

At Webconverger I've been working on whittling these leaking issues down, by wiresharking Firefox, e.g. https://github.com/Webconverger/webconverger-addon/issues/42 https://github.com/Webconverger/webconverger-addon/issues/41 https://github.com/Webconverger/webconverger-addon/issues/43 Though with things like https://bugzilla.mozilla.org/show_bug.cgi?id=1100304 and anti-features like http://dustri.org/b/firefox-youre-supposed-to-be-in-my-pocket-not-the-… you got to wonder if Mozilla has stopped caring about privacy.