hktonylee

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

At the beginning of 2030, I found this essay in my archives. From what I know today, I think it was very insightful at the moment of writing. And I feel it should be published because it can teach us, Rust developers, how to prevent that sad story from happening again.

What killed Haskell, could kill Rust, too

What killed Haskell, could kill Rust, too. Why would I even mention Haskell in this context? Well, Haskell and Rust are deeply related. Not because Rust is Haskell without HKTs. (Some of you know what that means, and the rest of you will wonder for a very long time). Much of the style of Rust is similar in many ways to the style of Haskell. In some sense Rust is a reincarnation of Haskell, with a little bit of C-ish like syntax, a very small amount.

Is Haskell dead?

Programming as Theory Building

Peter Naur

Peter Naur's classic 1985 essay "Programming as Theory Building" argues that a program is not its source code. A program is a shared mental construct (he uses the word theory) that lives in the minds of the people who work on it. If you lose the people, you lose the program. The code is merely a written representation of the program, and it's lossy, so you can't reconstruct

As the number of different possible states and transitions between states in a user interface grows, managing styles and animations can quickly become complicated. Even a simple login form has many different "user flows":

https://codepen.io/davidkpiano/pen/WKvPBP

State machines are an excellent pattern for managing state transitions in user interfaces in an intuitive, declarative way. We've been using them a lot on the Keyframers as a way to simplify otherwise complex animations and user flows, like the one above.

So, what is a state machine? Sounds technical, right? It’s actually more simple and intuitive than you might think. (Don’t look at Wikipedia just yet… trust me.)

Let’s approach this from an animation perspective. Suppose you’re creating a loading animation, which can be in only one of four states at any given time:

	#!/usr/bin/env -S bash -c "docker run -p 8080:8080 -it --rm \$(docker build --progress plain -f \$0 . 2>&1 \| tee /dev/stderr \| grep -oP 'sha256:[0-9a-f]*')"

	# syntax = docker/dockerfile:1.4.0

	FROM node:20

	WORKDIR /root

	RUN npm install sqlite3

	#!/usr/bin/env bash

	set -e

	cd ~

	sudo -v

	# Make sure system is in a good, updated, clean, state.
	sudo apt-get -y update

	"""
	Built on top of this gist by @karpathy:
	https://gist.github.com/karpathy/00103b0037c5aaea32fe1da1af553355

	stable diffusion dreaming over text prompts
	creates hypnotic moving videos by smoothly walking randomly through the sample space

	example way to run this script:
	$ python stable_diffusion_walk.py --prompts "['blueberry spaghetti', 'strawberry spaghetti']" --seeds 243,523 --name berry_good_spaghetti

	# WSL2 network port forwarding script v1
	# for enable script, 'Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope CurrentUser' in Powershell,
	# for delete exist rules and ports use 'delete' as parameter, for show ports use 'list' as parameter.
	# written by Daehyuk Ahn, Aug-1-2020

	# Display all portproxy information
	If ($Args[0] -eq "list") {
	netsh interface portproxy show v4tov4;
	exit;
	}

	# Put this function to your .bashrc file.
	# Usage: mv oldfilename
	# If you call mv without the second parameter it will prompt you to edit the filename on command line.
	# Original mv is called when it's called with more than one argument.
	# It's useful when you want to change just a few letters in a long name.
	#
	# Also see:
	# - imv from renameutils
	# - Ctrl-W Ctrl-Y Ctrl-Y (cut last word, paste, paste)

	// Tracking cursor position in real-time without JavaScript
	// Demo: https://twitter.com/davywtf/status/1124146339259002881

	package main

	import (
	"fmt"
	"net/http"
	"strings"
	)