Viewing profile — kpcyrd

An SSH bastion host allows to request direct-tcpip channels, but is going to restrict other channel types, like pty requests, shell requests, exec requests or other subsystems. The…

Unfortunately Bitchat feels like an unfinished proof of concept. At a festival I got notifications there are "other users nearby", which made me question if and how the app is broa…

This makes the problem harder instead of easier. The most practical conclusion is "the package registry is the VCS, but with stricter rules". Those stricter rules are useful, the r…

This. Capitalism only became problematic the minute it stopped having a cozy spot for software developers~ And even then people prefer blaming the prediction machine instead of rec…

The server actually hosting the rootkit executable is npmjs.com, run by a for-profit company, and they still take about 24h to act on our reports, while reported AUR packages have …

You could try rkhunter or unhide from the official repositories, but I haven't tested this myself and I don't know how well they work with BPF rootkits (and/or this one specificall…

This is essentially what the [extra] repository is. Not using the AUR and sticking to official Arch Linux packages exclusively is a very valid and reasonable choice (that I follow …

This is an "in addition to" problem though, not an "instead of" problem. Having code reviewed the PKGBUILD doesn't mean the upstream software is safe to use, having reviewed the up…

There's no shortage in ideas of how to make the AUR easier to moderate. A "quarantine button", an invite system, a request system for adoption similiar to how orphan requests work,…

This may happen even with `pkgctl build` if a makedepends= (transitively) pulled in the shared library into the build environment, but depends= doesn't. There's warnings in place i…

You don't need vendoring for this, Cargo.lock already gives you locked-dependencies until you run `cargo update`. There is an ongoing RFC to support having cargo intentionally only…

The repository suddenly contains thousands of files that I need to worry about. With regular locked-dependencies (but non-vendored) like Cargo.lock does, I have them contained in a…

You are getting distracted by domain names, your Cargo.lock files already cryptographically address the source code. Either make sure all your Cargo.lock files contain no known-bad…

1) This is only relevant for rustup.rs, most Rust source code is coming from crates.io 2) Most projects have a Cargo.lock that contain sha256 checksums of the source code. You can …

crates.io _is_ the source code repository (: It's explicitly the source of truth that cargo-crev and cargo-vet reviews are based on, linking it to a git repository first is not a s…

This is "only" used for loans and renting, the German government is never going to query the score this company has assigned you. Social services are never impacted. Equifax on the…

You don't think non-consensually revealing somebody's identity is a problem? Resorting to DDoS is not pretty, but "why is my violent behavior met with violence" is a little oblivio…

I stopped programming in python about 8-9 years ago because the tooling was so bad.

Step 1: discontinue the public repository, step 2: sell access to your GPL codebase. The GPL (and even the AGPL) doesn't require you to make your modified source code publicly avai…

I think this was more about "please choose _any_ license" because of the problem outlined here: https://opensource.stackexchange.com/questions/1150/is-my-co...

I feel like this is related to these issues (with somebody attempting this approach for real): https://github.com/chardet/chardet/issues/327 https://github.com/chardet/chardet/issu…

Many of the anti-debugging techniques for desktop binaries do not work on WebAssembly: it can't jump to an address, it can't read the instruction pointer, it can't read/access it's…

Obfuscated javascript could still import a WebAssembly polyfill, if there really was any advantage in doing so: https://github.com/evanw/polywasm Since WebAssembly instructions are…

It's mostly Rust compiled to wasm binaries. There's also TinyGo and you could use C/C++ as well, but those 3 are a lot less common as far as I can tell.

Your open source experience is very different from my open source experience.