Mattias Geniar

Self promotion: https://ma.ttias.be Not daily, but plenty of links to follow-up on. Alternatively, weekly summary of all things Linux & open source (RSS feed available); https://cronweekly.com

Reminds me of that classic OSX root login bypass by not using a password from 3 years ago: https://ma.ttias.be/root-login-without-password-allowed-default-mac-os…

OpenSSH also includes a SOCKS proxy which you can use with no additional software: https://ma.ttias.be/socks-proxy-linux-ssh-bypass-content-filters/ Whether it grants you any significant anonymity is debatable, but it works well for evading content filters and tunneling your traffic onto a more trustworthy network.

When the patches are available, you need to update, and likely reboot. Mattias Geniar talks about using the following command to find processes depending on libc, any of which could be running the vulnerable code, these are core processes that you probably cannot just cycle without a reboot [1]. For me the listing looks something like this: agetty, auditd, dbus-daem, dhclient, init, master, mysqld, rsyslogd, sshd, udevd, xinetd. Many of these deal with hostnames, so I would want to be sure everything is clean, and the best option is likely a reboot. lsof | grep libc | awk '{print $1}' | sort | uniq [1] http://ma.ttias.be/critical-glibc-update-cve-2015-0235-gethostbyname-c…

I was excited to see this as just last night I was using FFmpeg to combine digital (legally owned) movies with multiple parts into a single MKV file. It worked great, the one thing (and this is undoubtedly just a knowledge problem on my part), is I could not get it to copy/include subtitles from both parts. I have a feeling I might need to extract the subtitle files and combine them and then re-include the combined version, but was hoping there would be a solution in this site for doing something like that. Unfortunately, I didn't even see the combine as one of the examples. For reference: One-liner: > ffmpeg -loglevel info -f concat -safe 0 -i <(for f in *.mkv; do echo "file '$(pwd)/$f"; done) -c copy output.mkv Or the method I ended up using, create a files.txt file with each file listed[0] > ffmpeg -f concat -safe 0 -i files.txt -c copy output.mkv files.txt > file 'file 1.mkv' > file 'file 2.mkv' > # list any additional files 0: https://ma.ttias.be/use-ffmpeg-combine-multiple-videos/

Funnily enough, I just tried to do this over the weekend and the results were not ... great. I hit https://unix.stackexchange.com/q/691436/9452 exactly > need to process to file added to a directory, then remove them. Files can be large (20KiB to 5 GiB) and arrive slowly (via scp or ftp). How can I monitor a path (possibly with a systemd.path unit) and only react when the new file has finished writing? And as the question details DirectoryNotEmpty is not adequate because zero byte files still being written will trigger it and there's nothing after. Indeed all the path unit conditions: PathExists=, PathExistsGlob=, PathChanged=, PathModified=, DirectoryNotEmpty= suffers from this. One could do the an old fashioned while inotifywait -r -e close_write "/foo/bar/" but now you need to think about the script dying and restarting it which of course leads back to systemd (see https://ma.ttias.be/auto-restart-crashed-service-systemd/ for more) and then one asks: why can't systemd do this alone?

If you have a VPS, you could probably set up an ssh tunnel. https://ma.ttias.be/socks-proxy-linux-ssh-bypass-content-filters/ If you live somewhere else, you could also probably set up something as simple as a raspberry pi at home (or really any old hardware) and forward the right ports to it. If that's not your level of sophistication, then any VPN that works in Cambodia is probably fine. It's worth remembering that If you don't pay, you are the product. I would never use a free vpn. ExpressVPN used to be great, even for china, but they got bought out by an evil company, also I think they were run out of Hong Kong anyway and I wouldn't trust anything from Hong Kong after China went full fascism. Also you should switch to Firefox. Google wants to end AdBlock with ManifestV3 and they need to lose as many users as possible for doing so. Apple private relay might be the best as far as corporate offerings: https://support.apple.com/en-us/HT212614 Since you're already on a Mac, using more apple products probably won't make your privacy stance any worse. I generally trust Apple more than most companies right now.

I'm planning to launch a newsletter soon for a site I own that gets a moderately decent amount of traffic. Here is a snippet of some handy things I've found: The cost of sending email is a lot on some platforms (Mailchimp is $30/month for 2500 subscribers and $50/month for 5000 subs), but a lot cheaper with Mailgun or Amazon SES. Sendy [0] and Mailcoach [1] are both self-hosted newsletter sending apps that use Mailgun/SES if you want to DIY. There is a handy blog post [2] from the creator of cron.weekly on his newsletter workflow. Don't put "weekly" in the newsletter name because then you're really setting that weekly expectation. At some point, you might not want to be publishing weekly unless you've got some serious automation happening. There are some interesting ideas on newsletter businesses on gaps.com [3]. A year ago I thought that a newsletter should link to my own content. But now? Many, many newsletters are link aggregators. [0] https://sendy.co/ [1] https://mailcoach.app/ [2] https://ma.ttias.be/how-to-cron-weekly-newsletter/ [3] https://gaps.com/six-figure-newsletter/

> Paid my share of dealing with those problems with PHP 5 and 6 Hard to take this seriously when there was no PHP 6. https://ma.ttias.be/php6-missing-version-number/

how many times will I get clickbaited by some cool title only to see AI praise in the article and nothing more? It's tiring and happens way too often related "webdev is fun again": claude. https://ma.ttias.be/web-development-is-fun-again/ Also the "Why it matters" in the article. I thought it's a jab at AI-generated articles but it starts too look like the article was AI written as well

s/w stack penalizes IPv4 by 25 ms to 300 ms. This is not a point to say that v4 is bad, but has been made bad artificially: https://ma.ttias.be/apple-favours-ipv6-gives-ipv4-a-25ms-penalty/

> Just for recap, an IPv4 address written in the textual form consists four decimal numbers separated by the dot character. Not so fast. This entire article relies on a gross assumption of what IPv4 addresses look like. https://ma.ttias.be/theres-more-than-one-way-to-write-an-ip-address/

Once cool trick that most people don't know is that you can also ping IP addresses in octal, hex, and integer! https://ma.ttias.be/silly-little-ip-tricks/ >ping 0x08080808 Pinging 8.8.8.8 with 32 bytes of data: Reply from 8.8.8.8: bytes=32 time=4ms TTL=58 Reply from 8.8.8.8: bytes=32 time=4ms TTL=58 Reply from 8.8.8.8: bytes=32 time=4ms TTL=58 Reply from 8.8.8.8: bytes=32 time=4ms TTL=58

Making something work with a IPv4 octet of 300 (decimal) is a trick I'd like to see... (and I'm not talking about https://ma.ttias.be/theres-more-than-one-way-to-write-an-ip-address/ )

Alternatively, I like the option of creating a SOCKS proxy for this purpose, it's actually quite easy: https://ma.ttias.be/socks-proxy-linux-ssh-bypass-content-filters/

In addition to working on Xen, which enabled EC2/cloud, they were a Debian contributor, https://ma.ttias.be/devuan-debian-fork/

That was indeed a rough time for the language. A big part of that, I think, was the setbacks around the [1] PHP 6 debacle. [1] https://ma.ttias.be/php6-missing-version-number/

One other option is increasing the reserved block count ( https://ma.ttias.be/change-reserved-blocks-ext3-ext4-filesystem-linux/ ). This has the nice side effect of increasing the space available for critical daemons. If you haven't customised this, in a pinch you can still lower it down a bit to buy some time.

> No one is forcing you to change your broken buggy 30-year old shell scripts, you can always continue using them. How about usernames that start with a digit? Am I still allowed to use those? * https://ma.ttias.be/giving-perspective-systemds-usernames-start-digit-…

iPhone’s “Field Test” debug screen: Dial 3001#12345# for the real signal strength [0] [0] https://ma.ttias.be/iphones-field-test-debug-screen-dial-300112345-for…

cron.weekly by Mattias Geniar! https://ma.ttias.be/cronweekly/

How does it cope with non-ASCII characters and various fonts? Suppose you had "ɡoogle.com" instead of "gooble.com" in that demo video (the first "g" is not a regular "g", but " U+0261 LATIN SMALL LETTER SCRIPT G")… Browsers tend to show IDN names in the "xn--…" punycode format, but not always. https://en.wikipedia.org/wiki/IDN_homograph_attack https://unicode.org/cldr/utility/confusables.jsp?a=google&r=None https://ma.ttias.be/show-idn-punycode-firefox-avoid-phishing-urls/

It's a .well-known way to serve additional metadata for a website. https://en.wikipedia.org/wiki/List_of_/.well-known/_services_offered_b… Better link from stedaniels further in comments: https://ma.ttias.be/well-known-directory-webservers-aka-rfc-5785/

Is been an RFC for almost a decade, RFC5785 [0]. Mattias Geniar has a good write up on it [1]. [0] https://tools.ietf.org/html/rfc5785 [1] https://ma.ttias.be/well-known-directory-webservers-aka-rfc-5785/

248 days of uptime by any chance? edit: I saw the same on a fleet of thousands of JVMs which hung on 100% CPU after 248 days very consistently. Closest thing to an explanation I ever got was perhaps it is storing uptime in hundredths of a second (why not ms???) in signed 32 bit integers, see: https://ma.ttias.be/248-days/ In the end we solved it by restarting with a cronjob between 2am and 4am after 247 days...

i have to admin that im not totally familiar with the internal works of kexec, but at least from my knowledge a full service restart is required[0]. The Minix team claims the upgrade happens "without running processes even noticing", that sounds better than restarting all the services. [0] https://ma.ttias.be/kernel-patching-kexec-updating-centos-7-kernel-wit…

I didn't know it was in active use either until I saw your question and decided to research, so thanks!. Why do we need cars? Isn't my horse good enough? :p It's simply a new, experimental technology that offers some benefits over an older one. Yes, speed is one of the benefits, but there are some other advantages listed here: https://ma.ttias.be/googles-quic-protocol-moving-web-tcp-udp/

maybe try this? https://ma.ttias.be/pi-hole-dns-based-blacklist-ads-tracking-raspberry…

Thanks for the clarification, I guess I was confused about how it worked. For those seeking more detail, I found these two links helpful: https://docs.google.com/presentation/d/15e1bLKYeN56GL1oTJSF9OZiUsI-rcx… https://ma.ttias.be/googles-quic-protocol-moving-web-tcp-udp/

https://technet.microsoft.com/en-us/library/security/ms15-034.aspx https://github.com/xPaw/HTTPsys https://ma.ttias.be/remote-code-execution-via-http-request-in-iis-on-w…