Ariel Millennium Thornton @arielmt@computerfairi.es

Happy Tax Panic Day, USA!

The day we suddenly remember that we need to take numbers the state and federal governments gave us, work some simple arithmetic in complicated formulas for them for reasons involving tax prep industry lobbying, give those numbers back to them, and hope they get the same results when they do the same math.

Falsehoods programmers believe:

* Thinking the gender binary can be encoded in just a single bit.

** In reality, the gender binary word size often exceeds the byte it takes out of your simplistic, need-to-unlearn understanding.

RFC 2232, in case you need standardized details of how to implement DHCP via clothespins on devices without automated DHCP client software or compatible DHCP server software:
https://www.rfc-editor.org/rfc/rfc2322

Sphinx of black quartz, judge my vows!

The quick brown fox jumps over the lazy dog, but the sphinx of black quartz doesn't judge it notable.

The reply to this is a fair point: downgrade to a pre-5.6.0 version regardless. It's too soon to know if this exploit path is the only one present.

Basically, if you have xz-5.6.0 or xz-5.6.1 installed on Linux, downgrade to an earlier version of xz.

If you use an older version of xz, don't use Linux, or somehow do use Linux *without* systemd, you should be fine.

I love how the xz backdoor hinges on Poettering's Daemon in order to work.

The Register
Headline: "Malicious SSH backdoor sneaks into xz, Linux world's data compression library"
Byline: "Red Hat in all caps says STOP USAGE OF ANY FEDORA RAWHIDE INSTANCES"
https://www.theregister.com/2024/03/29/malicious_backdoor_xz/