2024-03-31
etc
-
The Dali ship crew is still on board after hitting the Baltimore bridge
-
Crane Linked to CIA Soviet Sub Mission Now on Station at Key Bridge Collapse
Chesapeake, a 1,000-ton lift-capacity derrick barge – the largest crane on the East Coast – arrived by Friday, as well as Ferrell, a 200-ton lift-capacity revolving crane barge, and Oyster, a 150-ton lift-capacity crane barge. The Navy is also sending another 400-ton lift capacity barge, expected to arrive next week, according to a Navy release.
-
Baltimore bridge collapse could lead to record insurance loss, says Lloyd's boss
-
US bridges lack impact protection. After Key Bridge collapse, will that change?
-
Road closed after barge strikes bridge in Sallisaw | 5newsonline.com
-
Birth Rates Are Plummeting in Most Nations, And The World Isn’t Prepared.
Horseshit
Electric / Self Driving cars
celebrity gossip
Trump / War against the Right / Jan6
Pox / COVID / BioTerror AgitProp
Religion / Tribal / Culture War and Re-Segregation
Edumacationalizing / Acedemia Nuts
-
Biden's New Math: 25% = 100% So Free-Lunch For Everybody | ZeroHedge
The Biden administration just issued a new directive. If 25 percent of a school is low income, then everybody gets a free lunch.
Info Rental / ShowBiz / Advertising
TechSuck / Geek Bait
-
Security Alert: Potential SSH Backdoor Via Liblzma
some time ago, an unknown party evidently noticed that liblzma (aka xz) — a relatively obscure open-source compression library — was a dependency of OpenSSH, a security-critical remote administration tool used to manage millions of servers around the world. This dependency existed not because of a deliberate design decision by the developers of OpenSSH, but because of a kludge added by some Linux distributions to integrate the tool with the operating system’s newfangled orchestration service, systemd.
Equipped with this knowledge about xz, the aforementioned party probably invented the persona of "Jia Tan” — a developer with no prior online footprint who materialized out of the blue in October 2021 and started making helpful contributions to the library. Up to that point, xz had a single maintainer — Lasse Collin — who was dealing with health issues and was falling behind. Shortly after the arrival of “Jia”, several apparent sock puppet accounts showed up and started pressuring Lasse to pass the baton; it appears that he relented at some point in 2023.
Since then, “Jia” diligently continued the maintenance work — culminating in February 2024 with the seamless introduction of a sophisticated, well-concealed backdoor tucked inside one of the build scripts. Full analysis of the payload is still pending, but it appears to have targeted the pre-authentication crypto functions of OpenSSH; it’s probably safe to assume that it added “master key” functionality to let the attackers access all affected servers at will.
However, the
xzintrigue is only a symptom of a larger problem in the world of software development: securing the supply chain. In just the past few months, we've seen issues with malicious packages on both PyPi and NPM, the main repositories of 3rd party libraries for Python and Javascript respectively. Fortunately, the malicious packages were relatively unsophisticated and were discovered before significant damage could be done, but they hint at an issue that is only going to grow in significance. Thexzbackdoor is probably the most sophisticated attack - in terms of planning and execution, if not necessarily the source code involved - that we've seen so far (that we know of), involving extensive planning and almost 3 years of preparation and lead time. -
See, this is why I retired early from software engineering
Devon: Fred made a whole set of structs containing raw untyped pointers so he could reinvent polymorphism in C, because he "doesn't like C++".
Foobar, Inc: Yes, isn't he clever? We love Fred!
Devon: And segfaults, apparently.