cultural reviewer and dabbler in stylistic premonitions

  • 1 Post
  • 12 Comments
Joined 3 years ago
cake
Cake day: January 17th, 2022

help-circle


  • Arthur Besse@lemmy.mlMtoLinux@lemmy.mlWhat was Linux like in the 90s
    link
    fedilink
    English
    arrow-up
    2
    ·
    edit-2
    2 months ago

    encryption would prevent the modem from seeing it when someone sends it, but such a short string will inevitably appear once in a while in ciphertext too. so, it would actually make it disconnect at random times instead :)

    (edit: actually at seven bytes i guess it would only occur once in every 72PB on average…)




  • Arthur Besse@lemmy.mlMtoLinux@lemmy.mlA good e-mail client for linux?
    link
    fedilink
    English
    arrow-up
    0
    ·
    edit-2
    3 months ago

    still of Obi-wan Kenobi in Star Wars with subtitle "Now, that's a name I've not heard in a long time. A long time."

    At first i thought, wow, cool they’re still developing that? Doing a release or two a year, i see.

    I used to use it long ago, and was pretty happy with it.

    But looking closer now, what is going on with security there?! Sorry to be the bearer of probably bad news, but... 😬

    The only three CVEs in their changelog are from 2007, 2010, and 2014, and none are specific to claws.

    Does that mean they haven’t had any exploitable bugs? That seems extremely unlikely for a program written in C with the complexity that being an email client requires.

    All of the recent changelog entries which sound like possibly-security-relevant bugs have seven-digit numbers prefixed with “CID”, whereas the other bugs have four-digit bug numbers corresponding to entries in their bugzilla.

    After a few minutes of searching, I have failed to figure out what “CID” means, or indeed to find any reference to these numbers outside of claws commit messages and release announcements. In any case, from the types of bugs which have these numbers instead of bugzilla entries, it seems to be the designation they are using for security bugs.

    The effect of failing to register CVEs and issue security advisories is that downstream distributors of claws (such as the Linux distributions which the project’s website recommends installing it from) do not patch these issues.

    For instance, claws is included in Debian stable and three currently-supported LTS releases of Ubuntu - which are places where users could be receiving security updates if the project registered CVEs, but are not since they don’t.

    Even if you get claws from a rolling release distro, or build the latest release yourself, it looks like you’d still be lagging substantially on likely-security-relevant updates: there have actually been numerous commits containing CID numbers in the month since the last release.

    If the claws developers happen to read this: thanks for writing free software, but: please update your FAQ to explain these CID numbers, and start issuing security advisories and/or registering CVEs when appropriate so that your distributors will ship security updates to your users!




  • Note: for readers who aren’t aware, the notation ^X means hold down the ctrl key and type x (without shift).

    ctrl-a though ctrl-z will send ASCII characters 1 through 26, which are called control characters (because they’re for controling things, and also because you can type them by holding down the control key).

    ^D is the EOF character.

    $ stty -a | grep eof
    intr = ^C; quit = ^\; erase = ^?; kill = ^U; eof = ^D; eol = <undef>;
    $ man stty |grep -A1 eof |head -n2
           eof CHAR
                  CHAR will send an end of file (terminate the input)
    

    Nope, Chuck Testa: there is no EOF character. Or, one could also say there is an EOF character, but which character it is can be configured on a per-tty basis, and by default it is configured to be ^D - which (since “D” is the fourth letter of the alphabet) is ASCII character 4, which (as you can see in man ascii) is called EOT or “end of transmission”.

    What that stty output means is that ^D is the character specified to trigger eof. That means this character is intercepted (by the kernel’s tty driver) and, instead of sending the character to the process reading standard input, the tty “will send an end of file (terminate the input)”.

    By default eof is ^D (EOT), a control character, but it can be set to any character.

    For instance: run stty eof x and now, in that terminal, “x” (by itself, without the control key) will be the EOF character and will behave exactly as ^D did before. (The rest of this comment assumes you are still in a normal default terminal where you have not done that.)

    But “send an end of file” does not mean sending EOT or any other character to the reading process: as the blog post explains, it actually (counterintuitively) means flushing the buffer - meaning, causing the read syscall to return with whatever is in the buffer currently.

    It is confusing that this functionality is called eof, and the stty man page description of it is even more so, given that it (really!) does actually flush the contents of the buffer to read - even if the line buffer is not empty, in which case it is not actually indicating end-of-file!

    You can confirm this is happening by running cat and typing a few characters and then hitting ^D, and then typing more, and hitting ^D again. (Each time you flush the buffer, cat will immediately echo the latest characters that had been buffered, even though you have not hit enter yet.)

    Or, you can pipe cat into pv and see that ^D also causes pv to receive the buffer contents prior to hitting enter.

    I guess unix calls this eof because this function is most often used to flush an empty buffer, which is how you “send an end of file” to the reader.

    The empty-read-means-EOF semantics are documented, among other places, in the man page for the read() syscall (man read):

    RETURN VALUE
          On success, the number of bytes read is returned (zero indicates end of
          file), and the file position is advanced by this number.
    

    If you want to send an actual ^D (EOT) character through to the process reading standard input, you can escape it using the confusingly-named lnext function, which by default is bound to the ^V control character (aka SYN, “synchronous idle”, ASCII character 22):

    $ man stty|grep lnext -A1
           * lnext CHAR
                  CHAR will enter the next character quoted
    $ stty -a|grep lnext
    werase = ^W; lnext = ^V; discard = ^O; min = 1; time = 0;
    

    Try it: you can type echo " and then ctrl-V and ctrl-D and then "|xxd (and then enter) and you will see that this is sending ascii character 4.

    You can also send it with echo -e '\x04'. Note that the EOT character does not terminate bash:

    $ echo -e '\x04\necho see?'|xxd
    00000000: 040a 6563 686f 2073 6565 3f0a            ..echo see?.
    $ echo -e '\x04\necho see?'|bash
    bash: line 1: $'\004': command not found
    see?
    

    As you can see, it instead interprets it as a command.

    (Control characters are perfectly cromulent filenames btw...)
    $ echo -e '#!/bin/bash\necho lmao' > ~/.local/bin/$(echo -en '\x04')
    $ chmod +x ~/.local/bin/$(echo -en '\x04')
    $ echo -e '\x04\necho see?'|bash
    lmao
    see?
    

  • sure. first, configure sudo to be passwordless, or perhaps just to stay unlocked for longer (it’s easy to find instructions for how to do that).

    then, put this in your ~/.bashrc:

    alias sudo='echo -n "are you sure? "; for i in $(seq 5); do echo -n "$((6 - $i)) "; sleep 1; done && echo && /usr/bin/sudo '

    Now “sudo” will give you a 5 second countdown (during which you can hit ctrl-c if you change your mind) before running whatever command you ask it to.



  • Clickbait. The VP Engineering for Ubuntu made a post that he was looking into using the Rust utils for Ubuntu and has been daily driving them and encouraged others to try

    It’s by no means certain this will be done.

    Here is that post. It isn’t certain to happen, but he doesn’t only say that he is daily driving them. He says his goal is to make them the default in 25.10:

    My immediate goal is to make uutils’ coreutils implementation the default in Ubuntu 25.10, and subsequently in our next Long Term Support (LTS) release, Ubuntu 26.04 LTS, if the conditions are right.



OSZAR »