Nigel Sheridan-Smith wtfiwtz

Security Advisories / Bulletins / vendors Responses linked to Log4Shell (CVE-2021-44228)

Errors, typos, something to say ?

If you want to add a link, comment or send it to me
Feel free to report any mistake directly below in the comment or in DM on Twitter @SwitHak

Other great resources

Royce Williams list sorted by vendors responses Royce List
Very detailed list NCSC-NL
The list maintained by U.S. Cybersecurity and Infrastructure Security Agency: CISA List

ghcr (GitHub Container Registry) quickstart

CLI

To push container images to ghcr, you need peronal access token (PAT) - see how to create PAT

Get PAT (personal access token)

Personal Settings > Developer settings > Personal access tokens

This list was auto-generated on macOS 10.15 (Catalina) using a script that did the following:

grabbed the name of all the .plist files located in the 5 folders used by launchctl:

~/Library/LaunchAgents Per-user agents provided by the user.
/Library/LaunchAgents Per-user agents provided by the administrator.
/Library/LaunchDaemons System wide daemons provided by the administrator.
/System/Library/LaunchAgents OS X Per-user agents.
/System/Library/LaunchDaemons OS X System wide daemons.

ES Modules are terrible, actually

This post was adapted from an earlier Twitter thread.

It's incredible how many collective developer hours have been wasted on pushing through the turd that is ES Modules (often mistakenly called "ES6 Modules"). Causing a big ecosystem divide and massive tooling support issues, for... well, no reason, really. There are no actual advantages to it. At all.

It looks shiny and new and some libraries use it in their documentation without any explanation, so people assume that it's the new thing that must be used. And then I end up having to explain to them why, unlike CommonJS, it doesn't actually work everywhere yet, and may never do so. For example, you can't import ESM modules from a CommonJS file! (Update: I've released a module that works around this issue.)

And then there's Rollup, which apparently requires ESM to be u

Had 15 github followers in 2019? You can get about $4kAUD of crypto for minimal effort.

Explain this scam

That's legitimately a good default position to hold, however, in this case, the free money is a function of time, and not only charity.

In February 2020, in order to promote Handshake (HNS) to developers, an airdrop was offered to any Github user with more than 15 followers. The Airdrop would give you 4246HNS, at the time worth around at $0.08USD per coin, for a total of $339.68USD, pretty generous!

Today, 4246HNS is worth around $4000 dollarydoos, and there are plenty of github users who haven't claimed theirs.

Node.js on Apple Silicon

Node Version Manager (https://github.com/nvm-sh/nvm) works perfectly across native node installations as well as emulated Rosetta installations. The trick I am using here is to install one LTS version of node under Rosetta and another stable version as native binary.

TODO

find a way how to run the same node version on both platforms

Key Points

In general, binaries built just for x86 architecture will automatically be run in x86 mode
You can force apps in Rosetta 2 / x86 mode by right-clicking app, click Get Info, check "Open using Rosetta"
You can force command-line apps by prefixing with arch -x86_64, for example arch -x86_64 go
Running a shell in this mode means you don't have to prefix commands: arch -x86_64 zsh then go or whatever
Don't just immediately install Homebrew as usual. It should most likely be installed in x86 mode.

Homebrew

Not all toolchains and libraries properly support M1 arm64 chips just yet. Although

Retrieving Docker Image Sizes

There are two metrics that are important to consider when discussing the size of Docker images.

Compressed size - This is often referred to as the wire size. This affects how fast/slow images can be pulled from a registry. This impacts the first run experience on machines where images are not cached.
Uncompressed size - This is often referred to as the size on disk. This affects how much local storage is required to support your Docker workloads.

The example commands shown below will work on Windows, MacOS, and Linux.

How to Measure the Compressed Size

Configure Spring Boot Application to serve Custom Static Resource locations

Static resources can be configured using two approaches in Spring Boot

Add custom path in application.properties/application.yaml
Implement WebMvcConfigurer addResourceHandlers() method

First configure your SpringSecurity class to accept requests to this resources

@Override
public void configure(WebSecurity web)

	export TOKEN=$(curl --silent https://ghcr.io/token\?scope\=repository:wolfv/artifact:pull \| jq -r .token)

	curl \
	--silent \
	--request 'GET' \
	--header "Authorization: Bearer $TOKEN" \
	--header "Accept: application/vnd.oci.image.manifest.v1+json" \
	'https://ghcr.io/v2/wolfv/artifact/manifests/1.0'

	echo "\n\nFetching image content now:\n\n"