Here’s the more constructive part of the (I still think warranted - but likely a bit tone deaf) rant: https://github.com/tukaani-project/xz/pull/181

@[email protected] I had the following enabled for me:

• Targeting in external channels
• Analytics and customer grouping

I had specifically disabled “Item-level purchase data” before, and I’m fairly confident I did not explicitly enable those other two.

The code originally made a copy of a struct before modifying the copy. The original was then used afterwards. I entirely missed the later use and that it was critical that the original struct was used as is. So I passed a subtly modified struct to the later processing, which, in combination with a second bug I had introduced some time earlier, caused all kinds of havoc.

There was another bug I also introduced, which funnily had similar effects. This bug was added months ago, and it affected only older OS versions. I typically only run the bleeding version during development (but I had tested the change with older versions, too). Unfortunately, this issue was random as it depended on stack contents to get triggered, and thus went unnoticed until the additional scrutiny introduced this intense debugging session.

The combination of these factors made this highly frustrating thing to debug, as any kind of A-B testing fails when you have multiple or random issues.

#bugstories

@[email protected] “Nice flow you’ve going there, would be a shame if I had to reboot”

@[email protected] Ooof. I wonder if it’s available in some states though, for example California? They have https://oag.ca.gov/privacy/ccpa

This here is the prime example of why we must stay vigilant about the collection and dissemination of personal information.

Also, while this article only mentions “algorithm”, it’s not difficult to predict that AI models are or will be used for this kind of task.

AI advocates often claim that any plans to regulate AI are just a hindrance to progress. I will take regulation if it will stop this kind of madness.

@[email protected] Sure, those methods might work for now. But if Microsoft follows their reasoning (“We’re removing X from the build to enhance security and user experience of Windows 11. This change ensures that all users exit setup with internet connectivity and a Microsoft Account.”) they will remove these methods eventually as well.

@infinity Yeah, it does for now. I fully expect Microsoft to remove that registry key or the associated functionality next.

After all not doing so would mean that users could accidentally setup the system “without working internet connectivity and a Microsoft Account”.

That would be terrible for security and user experience *cough* business.

@jerry It largely depends on how well the initial impact is cleaned up. I’m hoping we won’t see a ton of backdoors in various components next.

The httpget 0.2 doesn’t quite work in the form it was uploaded.

First it uses hardcoded argv, argc instead of getting from the app invocation (as args in main, the code uses void main).

Second obtaining any data from the socket will result in the app stopping and leaving behind an empty file (if (nread) break;).

This program could never download anything. It is likely some work in progress or modified test version of httpget. Since it includes some windows specific headers and has disabled the unix ones I can only presume it was some earlier attempt to get the tool running on windows.

So while the code has a local stack buffer overflow it can’t be triggered for this early version.

If this trend continues, we will be losing the ability to use secure means of communication with UK friends and colleagues. For example, #signalapp will rather get out of the UK than add backdoors: https://www.bbc.com/news/technology-64584001

“#Nordnet admits that it was possible to trade in other people’s depots during the IT breakdown”

https://www.marketscreener.com/quote/stock/NORDNET-AB-115787339/news/Nordnet-admits-that-it-was-possible-to-trade-in-other-people-s-depots-during-the-IT-breakdown-49034492/

#Nordnet services appear to be back.

Nordnet has a lot of technical issues to sort out. If the malfunction allowed unauthorized parties to operate the accounts it will be quite messy to sort out.

Among with technical part, they will have to deal with the regulatory issues, in particular the Financial Supervisory Authority. They will demand answers.

I still occasionally write some m68k code and apps. These are from 2024:

- Execute code in #amiga color registers: https://sintonen.fi/src/colexec/colexec.asm
- RXS-M-XS 32bit->32bit Permuted Congruential Generator: https://sintonen.fi/src/misc/pcg/_rand.asm
- Minimal modplayer (protracker music player): https://sintonen.fi/src/minimod/ (the replayer routine is mostly from Frank Wille however)

I also participated in very useless size/speedcoding competitions - some of them are still accessible from this old web page: https://amycoders.org/compo/

Note that some of the HTML is a bit broken, for example https://amycoders.org/compo/circlecompo.html - you can view source to see the full routine

#m68k #assembly #sizecoding #speedcoding

@[email protected] Curl will likely address this eventually even though they don’t consider it a vulnerability. See https://github.com/curl/curl/issues/16197

The latest curl version 8.12.0 (released today) is affected.

The details of the #AMD Microcode Signature Verification #Vulnerability are out:

• https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3019.html
• https://github.com/google/security-research/security/advisories/GHSA-4xq7-4mgh-gp6w

#infosec #infosecurity #cybersecurity

In total surprise to no one, #NVIDIA #RTX5080 card is just “meh”: https://www.youtube.com/watch?v=sEu6k-MdZgc