Junle Li lijunle

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

This gist includes an enhancement to Debian's snapper package.

The current (as of 2023-07-23) snapper package includes an apt configuration that will automatically take snapper snapshots when you use apt to install/remove/etc. It will add use "apt" as the description of the pre/post snapshot.

With the below changes to the /etc/apt/apt.conf.d/80snapper file and associated dpkg-pre-post-snapper.sh file, snapper will include the full apt command, including the arguments, in the snapshot description.

For example:

$ sudo apt install funky

For a TurrisOS Omnia see WebDAV with Lighttpd on Turris Omnia. Those instructions are slightly different.

This instruction moved to OpenWrt Wiki WebDAV Share

Cask-Upgrade

Small utility to help you manage packages installed via Homebrew Cask as it currently can't upgrade installed packages for you or clean up old versions.

The script will ask you if you want to upgrade applications which has newer versions available. Downloads from previous versions of applications will be removed when an application is updated, like what Homebrew has been doing since version 2.0.0. This behaviour can be disabled by setting the environment variable HOMEBREW_NO_INSTALL_CLEANUP.

Installation

What forces layout / reflow

All of the below properties or methods, when requested/called in JavaScript, will trigger the browser to synchronously calculate the style and layout*. This is also called reflow or layout thrashing, and is common performance bottleneck.

Generally, all APIs that synchronously provide layout metrics will trigger forced reflow / layout. Read on for additional cases and details.

Element APIs

Getting box metrics

elem.offsetLeft, elem.offsetTop, elem.offsetWidth, elem.offsetHeight, elem.offsetParent

	wget https://github.com/xtaci/kcptun/releases/download/v20170525/kcptun-linux-amd64-20170525.tar.gz
	tar xvf kcptun-linux-amd64-20170525.tar.gz
	sudo mv server_linux_amd64 /usr/local/bin/kcptun_server
	sudo mv client_linux_amd64 /usr/local/bin/kcptun_client
	sudo mkdir -p /etc/kcptun

	sudo bash -c "cat <<EOT > /etc/kcptun/server_conf.json
	{
	\"listen\": \":4321\",
	\"target\": \"127.0.0.1:8421\",

	/*
	* By default, Electron (well, underlying Chrome browser) will reject loading external URLs
	* to an <iframe>. To circumvent this limitation, we can manipulate response headers from any
	* http request and feed them to the Electron window.
	*
	* The 'onHeadersReceived' listener is documented here:
	* http://electron.atom.io/docs/api/session/#webrequestonheadersreceivedfilter-listener
	*/

	app.on('ready', () => {

	[user]
	name = Junle Li
	email = [email protected]
	[core]
	excludesfile = ~/.gitignore
	pager = cat
	[gc]
	auto = 0
	[alias]
	br = branch -v

	/**
	* 贪灵Gollum for Baiduyun, Ver.3.4.4
	* 立即执行函数：百度云盘批量转存用户分享。
	*
	* 【特点】
	* - 可保持或无视原分享者的目录结构。
	* - 支持差分转存。
	* - 自动分解转存，可突破单次转存总文件数5000的限制。
	* - 可在分享主页下，进入某文件夹来转存其下级子文件夹。
	* - 支持专辑转存。

	.DS_Store

	node_modules