DDiggler on HN Glance

KeePassXC Debian maintainer has removed all network features 2 years ago

Meanwhile in Arch land (possibly other distros as well), the fwupd package (which I imagine to be a fairly common package to be installed among the user base) has been silently configured to depend on passim, which spins up an open web server on 0.0.0.0:27500[1] without any(!) explicit user consent whatsover. Passim then uses GnuTLS, which is famous for containing more holes than Swiss cheese [2][3].

Absolutely insane to me, and I would not be surprised if there's an xz type of exploit hidden somewhere in the chain.

[1] https://github.com/fwupd/fwupd/issues/6721

[2] https://news.ycombinator.com/item?id=7347500

[3] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=gnutls

0Thread HN

Samsung shifts executives to six-day workweeks to 'inject a sense of crisis' 2 years ago

friendly adjacent neighbors

As a Finn I laughed out loud.

0Thread HN

Looking into an apparently scammy looking zsh plugin manager called “zi” 2 years ago

The "verification" downloads the file twice... seems like one could easily make a custom HTTP server to change the second consecutive response to a malicious one.

0Thread HN