{"generator":"GNU social 2.0.2-dev","title":"Conversation","totalItems":15,"items":[{"actor":{"id":"https:\/\/cyberplace.social\/users\/GossiTheDog","displayName":"Kevin Beaumont","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/38360-original-tmp20251103132446.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/38360-96-20251103140751.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/38360-48-20251103133701.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/38360-24-20251103154349.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"38360"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/38360-96-20251103140751.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"Cybersecurity weather person and award winning shitposter. Shitposting is an anagram of Top Insights.  You may be surprised to know I am not representing my employer here and these are not their opinions.I have Direct Messages disabled - you can send them, but I will never receive them.","url":"https:\/\/cyberplace.social\/@GossiTheDog","portablecontacts_net":{"preferredUsername":"GossiTheDog","displayName":"Kevin Beaumont","note":"Cybersecurity weather person and award winning shitposter. Shitposting is an anagram of Top Insights.  You may be surprised to know I am not representing my employer here and these are not their opinions.I have Direct Messages disabled - you can send them, but I will never receive them."}},"content":"<p>The telnetd vuln has a CVE now - CVE-2026-24061<\/p><p>Proof of concept: <a href=\"https:\/\/github.com\/SafeBreach-Labs\/CVE-2026-24061\/blob\/main\/telnet_rce.py\" rel=\"nofollow\">https:\/\/github.com\/SafeBreach-Labs\/CVE-2026-24061\/blob\/main\/telnet_rce.py<\/a><\/p>","generator":{"id":"tag:gnusocial.jp,2026-08-16:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/cyberplace.social\/users\/GossiTheDog\/statuses\/115961088688323642","object":{"id":"https:\/\/cyberplace.social\/users\/GossiTheDog\/statuses\/115961088688323642","objectType":"note","content":"<p>The telnetd vuln has a CVE now - CVE-2026-24061<\/p><p>Proof of concept: <a href=\"https:\/\/github.com\/SafeBreach-Labs\/CVE-2026-24061\/blob\/main\/telnet_rce.py\" rel=\"nofollow\">https:\/\/github.com\/SafeBreach-Labs\/CVE-2026-24061\/blob\/main\/telnet_rce.py<\/a><\/p>","url":"https:\/\/cyberplace.social\/@GossiTheDog\/115961088688323642","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/cyberplace.social\/users\/GossiTheDog\/statuses\/115929480617687454","url":"https:\/\/cyberplace.social\/@GossiTheDog\/115929480617687454"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2026-01-20:objectType=thread:nonce=b6175b50a68119f0","notice_info":{"local_id":"12002299","source":"ActivityPub"}},"published":"2026-01-26T14:22:51+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/cyberplace.social\/@GossiTheDog\/115961088688323642"},{"actor":{"id":"https:\/\/mastodon.ie\/users\/cjwatson","displayName":"Colin Watson","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/154615-original-tmp20260121004410.webp","rel":"avatar","type":"image\/webp","width":82,"height":82},{"url":"https:\/\/gnusocial.jp\/avatar\/154615-96-20260121005855.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/154615-48-20260121005856.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/154615-24-20260121005856.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"154615"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/154615-96-20260121005855.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"Irish geek.  Happily married, father of four, polyamorous, left-wing, Reform Jew by choice.Debian and Ubuntu developer and freelancer, mainly working for Freexian.  Formerly at Canonical on launchpad.net.T\u00e1 m\u00e9 ag foghlaim na Gaeilge.  \u05d0\u05e0\u05d9 \u05dc\u05d5\u05de\u05d3 \u05e2\u05d1\u05e8\u05d9\u05ea.Previously @cjwatson.","url":"https:\/\/mastodon.ie\/@cjwatson","portablecontacts_net":{"preferredUsername":"cjwatson","displayName":"Colin Watson","note":"Irish geek.  Happily married, father of four, polyamorous, left-wing, Reform Jew by choice.Debian and Ubuntu developer and freelancer, mainly working for Freexian.  Formerly at Canonical on launchpad.net.T\u00e1 m\u00e9 ag foghlaim na Gaeilge.  \u05d0\u05e0\u05d9 \u05dc\u05d5\u05de\u05d3 \u05e2\u05d1\u05e8\u05d9\u05ea.Previously @cjwatson."}},"content":"<p><a href=\"https:\/\/hachyderm.io\/@dalias\" class=\"u-url mention\">@dalias<\/a> <a href=\"https:\/\/ioc.exchange\/@leon_p_smith\" class=\"u-url mention\">@leon_p_smith<\/a> <a href=\"https:\/\/cyberplace.social\/@GossiTheDog\" class=\"u-url mention\">@GossiTheDog<\/a> I'm well aware of how it works.  But if you don't have to involve the shell (and I can't see why it would be needed in the case at hand - the templating arrangement doesn't need to be particularly flexible), why bother introducing unnecessary complexity?<\/p>","generator":{"id":"tag:gnusocial.jp,2026-08-16:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/mastodon.ie\/users\/cjwatson\/statuses\/115930471533392180","object":{"id":"https:\/\/mastodon.ie\/users\/cjwatson\/statuses\/115930471533392180","objectType":"note","content":"<p><a href=\"https:\/\/hachyderm.io\/@dalias\" class=\"u-url mention\">@dalias<\/a> <a href=\"https:\/\/ioc.exchange\/@leon_p_smith\" class=\"u-url mention\">@leon_p_smith<\/a> <a href=\"https:\/\/cyberplace.social\/@GossiTheDog\" class=\"u-url mention\">@GossiTheDog<\/a> I'm well aware of how it works.  But if you don't have to involve the shell (and I can't see why it would be needed in the case at hand - the templating arrangement doesn't need to be particularly flexible), why bother introducing unnecessary complexity?<\/p>","url":"https:\/\/mastodon.ie\/@cjwatson\/115930471533392180","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/hachyderm.io\/users\/dalias\/statuses\/115930379938389142","url":"https:\/\/hachyderm.io\/@dalias\/115930379938389142"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/cyberplace.social\/users\/GossiTheDog"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/hachyderm.io\/users\/dalias"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/ioc.exchange\/users\/leon_p_smith"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2026-01-20:objectType=thread:nonce=b6175b50a68119f0","notice_info":{"local_id":"11970272","source":"ActivityPub"}},"published":"2026-01-21T01:57:17+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/mastodon.ie\/@cjwatson\/115930471533392180"},{"actor":{"id":"https:\/\/hachyderm.io\/users\/dalias","displayName":"Rich Felker","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/40873-original-tmp20221202140938.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/40873-96-20221207231635.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/40873-48-20221207231635.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/40873-24-20221207231635.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"40873"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/40873-96-20221207231635.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"C librarian, purveyor of the language&#39;s eldritch horrors. Poppin&#39; shells \ud83e\uddaa","url":"https:\/\/hachyderm.io\/@dalias","portablecontacts_net":{"preferredUsername":"dalias","displayName":"Rich Felker","note":"C librarian, purveyor of the language&#39;s eldritch horrors. Poppin&#39; shells \ud83e\uddaa"}},"content":"<p><a href=\"https:\/\/mastodon.ie\/@cjwatson\" class=\"u-url mention\">@cjwatson<\/a> <a href=\"https:\/\/ioc.exchange\/@leon_p_smith\" class=\"u-url mention\">@leon_p_smith<\/a> <a href=\"https:\/\/cyberplace.social\/@GossiTheDog\" class=\"u-url mention\">@GossiTheDog<\/a> It's needed because -E takes a shell command string with special substitutions (bad interface choice someone made long ago).<\/p>","generator":{"id":"tag:gnusocial.jp,2026-08-16:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/hachyderm.io\/users\/dalias\/statuses\/115930604081885430","object":{"id":"https:\/\/hachyderm.io\/users\/dalias\/statuses\/115930604081885430","objectType":"note","content":"<p><a href=\"https:\/\/mastodon.ie\/@cjwatson\" class=\"u-url mention\">@cjwatson<\/a> <a href=\"https:\/\/ioc.exchange\/@leon_p_smith\" class=\"u-url mention\">@leon_p_smith<\/a> <a href=\"https:\/\/cyberplace.social\/@GossiTheDog\" class=\"u-url mention\">@GossiTheDog<\/a> It's needed because -E takes a shell command string with special substitutions (bad interface choice someone made long ago).<\/p>","url":"https:\/\/hachyderm.io\/@dalias\/115930604081885430","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/mastodon.ie\/users\/cjwatson\/statuses\/115930471533392180","url":"https:\/\/mastodon.ie\/@cjwatson\/115930471533392180"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/cyberplace.social\/users\/GossiTheDog"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/mastodon.ie\/users\/cjwatson"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/ioc.exchange\/users\/leon_p_smith"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2026-01-20:objectType=thread:nonce=b6175b50a68119f0","notice_info":{"local_id":"11970273","source":"ActivityPub"}},"published":"2026-01-21T01:57:15+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/hachyderm.io\/@dalias\/115930604081885430"},{"actor":{"id":"https:\/\/hachyderm.io\/users\/dalias","displayName":"Rich Felker","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/40873-original-tmp20221202140938.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/40873-96-20221207231635.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/40873-48-20221207231635.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/40873-24-20221207231635.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"40873"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/40873-96-20221207231635.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"C librarian, purveyor of the language&#39;s eldritch horrors. Poppin&#39; shells \ud83e\uddaa","url":"https:\/\/hachyderm.io\/@dalias","portablecontacts_net":{"preferredUsername":"dalias","displayName":"Rich Felker","note":"C librarian, purveyor of the language&#39;s eldritch horrors. Poppin&#39; shells \ud83e\uddaa"}},"content":"<p><a href=\"https:\/\/mastodon.ie\/@cjwatson\" class=\"u-url mention\">@cjwatson<\/a> <a href=\"https:\/\/ioc.exchange\/@leon_p_smith\" class=\"u-url mention\">@leon_p_smith<\/a> <a href=\"https:\/\/cyberplace.social\/@GossiTheDog\" class=\"u-url mention\">@GossiTheDog<\/a> As an example to see how this works, run:<\/p><p>sh -c 'echo \"$1\"' sh \"foo bar\"<\/p>","generator":{"id":"tag:gnusocial.jp,2026-08-16:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/hachyderm.io\/users\/dalias\/statuses\/115930379938389142","object":{"id":"https:\/\/hachyderm.io\/users\/dalias\/statuses\/115930379938389142","objectType":"note","content":"<p><a href=\"https:\/\/mastodon.ie\/@cjwatson\" class=\"u-url mention\">@cjwatson<\/a> <a href=\"https:\/\/ioc.exchange\/@leon_p_smith\" class=\"u-url mention\">@leon_p_smith<\/a> <a href=\"https:\/\/cyberplace.social\/@GossiTheDog\" class=\"u-url mention\">@GossiTheDog<\/a> As an example to see how this works, run:<\/p><p>sh -c 'echo \"$1\"' sh \"foo bar\"<\/p>","url":"https:\/\/hachyderm.io\/@dalias\/115930379938389142","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/hachyderm.io\/users\/dalias\/statuses\/115930374630735716","url":"https:\/\/hachyderm.io\/@dalias\/115930374630735716"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/cyberplace.social\/users\/GossiTheDog"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/mastodon.ie\/users\/cjwatson"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/ioc.exchange\/users\/leon_p_smith"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2026-01-20:objectType=thread:nonce=b6175b50a68119f0","notice_info":{"local_id":"11969963","source":"ActivityPub"}},"published":"2026-01-21T01:00:15+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/hachyderm.io\/@dalias\/115930379938389142"},{"actor":{"id":"https:\/\/mastodon.ie\/users\/cjwatson","displayName":"Colin Watson","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/154615-original-tmp20260121004410.webp","rel":"avatar","type":"image\/webp","width":82,"height":82},{"url":"https:\/\/gnusocial.jp\/avatar\/154615-96-20260121005855.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/154615-48-20260121005856.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/154615-24-20260121005856.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"154615"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/154615-96-20260121005855.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"Irish geek.  Happily married, father of four, polyamorous, left-wing, Reform Jew by choice.Debian and Ubuntu developer and freelancer, mainly working for Freexian.  Formerly at Canonical on launchpad.net.T\u00e1 m\u00e9 ag foghlaim na Gaeilge.  \u05d0\u05e0\u05d9 \u05dc\u05d5\u05de\u05d3 \u05e2\u05d1\u05e8\u05d9\u05ea.Previously @cjwatson.","url":"https:\/\/mastodon.ie\/@cjwatson","portablecontacts_net":{"preferredUsername":"cjwatson","displayName":"Colin Watson","note":"Irish geek.  Happily married, father of four, polyamorous, left-wing, Reform Jew by choice.Debian and Ubuntu developer and freelancer, mainly working for Freexian.  Formerly at Canonical on launchpad.net.T\u00e1 m\u00e9 ag foghlaim na Gaeilge.  \u05d0\u05e0\u05d9 \u05dc\u05d5\u05de\u05d3 \u05e2\u05d1\u05e8\u05d9\u05ea.Previously @cjwatson."}},"content":"<p><a href=\"https:\/\/hachyderm.io\/@dalias\" class=\"u-url mention\">@dalias<\/a> <a href=\"https:\/\/ioc.exchange\/@leon_p_smith\" class=\"u-url mention\">@leon_p_smith<\/a> <a href=\"https:\/\/cyberplace.social\/@GossiTheDog\" class=\"u-url mention\">@GossiTheDog<\/a> That's perhaps a mild improvement, but still leaves you open to shell mistakes.  Far better is to construct the correct argv array directly, as an array and _not_ as a string of shell input. <\/p><p>It is notable that the inetutils fix did not take this approach, but instead patches things up with (hopefully correct) argument sanitization.  I'm not going to rag on people for making a mistake once, but after being bitten once they should really know better.<\/p>","generator":{"id":"tag:gnusocial.jp,2026-08-16:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/mastodon.ie\/users\/cjwatson\/statuses\/115930316488044619","object":{"id":"https:\/\/mastodon.ie\/users\/cjwatson\/statuses\/115930316488044619","objectType":"note","content":"<p><a href=\"https:\/\/hachyderm.io\/@dalias\" class=\"u-url mention\">@dalias<\/a> <a href=\"https:\/\/ioc.exchange\/@leon_p_smith\" class=\"u-url mention\">@leon_p_smith<\/a> <a href=\"https:\/\/cyberplace.social\/@GossiTheDog\" class=\"u-url mention\">@GossiTheDog<\/a> That's perhaps a mild improvement, but still leaves you open to shell mistakes.  Far better is to construct the correct argv array directly, as an array and _not_ as a string of shell input. <\/p><p>It is notable that the inetutils fix did not take this approach, but instead patches things up with (hopefully correct) argument sanitization.  I'm not going to rag on people for making a mistake once, but after being bitten once they should really know better.<\/p>","url":"https:\/\/mastodon.ie\/@cjwatson\/115930316488044619","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/hachyderm.io\/users\/dalias\/statuses\/115930226007230487","url":"https:\/\/hachyderm.io\/@dalias\/115930226007230487"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/cyberplace.social\/users\/GossiTheDog"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/hachyderm.io\/users\/dalias"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/ioc.exchange\/users\/leon_p_smith"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2026-01-20:objectType=thread:nonce=b6175b50a68119f0","notice_info":{"local_id":"11969953","source":"ActivityPub"}},"published":"2026-01-21T00:58:55+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/mastodon.ie\/@cjwatson\/115930316488044619"},{"actor":{"id":"https:\/\/hachyderm.io\/users\/dalias","displayName":"Rich Felker","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/40873-original-tmp20221202140938.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/40873-96-20221207231635.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/40873-48-20221207231635.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/40873-24-20221207231635.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"40873"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/40873-96-20221207231635.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"C librarian, purveyor of the language&#39;s eldritch horrors. Poppin&#39; shells \ud83e\uddaa","url":"https:\/\/hachyderm.io\/@dalias","portablecontacts_net":{"preferredUsername":"dalias","displayName":"Rich Felker","note":"C librarian, purveyor of the language&#39;s eldritch horrors. Poppin&#39; shells \ud83e\uddaa"}},"content":"<p><a href=\"https:\/\/mastodon.ie\/@cjwatson\" class=\"u-url mention\">@cjwatson<\/a> <a href=\"https:\/\/ioc.exchange\/@leon_p_smith\" class=\"u-url mention\">@leon_p_smith<\/a> <a href=\"https:\/\/cyberplace.social\/@GossiTheDog\" class=\"u-url mention\">@GossiTheDog<\/a> The approach I described is as an array, not a string of shell input. The expanded command doesn't contain any of the variable input text, just positional references to it.<\/p>","generator":{"id":"tag:gnusocial.jp,2026-08-16:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/hachyderm.io\/users\/dalias\/statuses\/115930374630735716","object":{"id":"https:\/\/hachyderm.io\/users\/dalias\/statuses\/115930374630735716","objectType":"note","content":"<p><a href=\"https:\/\/mastodon.ie\/@cjwatson\" class=\"u-url mention\">@cjwatson<\/a> <a href=\"https:\/\/ioc.exchange\/@leon_p_smith\" class=\"u-url mention\">@leon_p_smith<\/a> <a href=\"https:\/\/cyberplace.social\/@GossiTheDog\" class=\"u-url mention\">@GossiTheDog<\/a> The approach I described is as an array, not a string of shell input. The expanded command doesn't contain any of the variable input text, just positional references to it.<\/p>","url":"https:\/\/hachyderm.io\/@dalias\/115930374630735716","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/mastodon.ie\/users\/cjwatson\/statuses\/115930316488044619","url":"https:\/\/mastodon.ie\/@cjwatson\/115930316488044619"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/cyberplace.social\/users\/GossiTheDog"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/mastodon.ie\/users\/cjwatson"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/ioc.exchange\/users\/leon_p_smith"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2026-01-20:objectType=thread:nonce=b6175b50a68119f0","notice_info":{"local_id":"11969954","source":"ActivityPub"}},"published":"2026-01-21T00:58:54+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/hachyderm.io\/@dalias\/115930374630735716"},{"actor":{"id":"https:\/\/hachyderm.io\/users\/dalias","displayName":"Rich Felker","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/40873-original-tmp20221202140938.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/40873-96-20221207231635.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/40873-48-20221207231635.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/40873-24-20221207231635.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"40873"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/40873-96-20221207231635.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"C librarian, purveyor of the language&#39;s eldritch horrors. Poppin&#39; shells \ud83e\uddaa","url":"https:\/\/hachyderm.io\/@dalias","portablecontacts_net":{"preferredUsername":"dalias","displayName":"Rich Felker","note":"C librarian, purveyor of the language&#39;s eldritch horrors. Poppin&#39; shells \ud83e\uddaa"}},"content":"<p><a href=\"https:\/\/ioc.exchange\/@leon_p_smith\" class=\"u-url mention\">@leon_p_smith<\/a> <a href=\"https:\/\/cyberplace.social\/@GossiTheDog\" class=\"u-url mention\">@GossiTheDog<\/a> But the right solution is not to paste at all. Instead invoke the shell as something like \"sh\", \"-c\", \"expanded_command_here\", \"sh\", [parameters here] and insead of expanding % codes directly in the expanded command, replacing them with \"$1\", \"$2\", etc. to pull the parameters.<\/p><p>None of this is hard. It's something you should already know how to do right if you're invoking a shell from a potentially privileged context with data from another privilege domain. If you don't already know how to do it, you should not be touching software that runs in such a context.<\/p>","generator":{"id":"tag:gnusocial.jp,2026-08-16:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/hachyderm.io\/users\/dalias\/statuses\/115930226007230487","object":{"id":"https:\/\/hachyderm.io\/users\/dalias\/statuses\/115930226007230487","objectType":"note","content":"<p><a href=\"https:\/\/ioc.exchange\/@leon_p_smith\" class=\"u-url mention\">@leon_p_smith<\/a> <a href=\"https:\/\/cyberplace.social\/@GossiTheDog\" class=\"u-url mention\">@GossiTheDog<\/a> But the right solution is not to paste at all. Instead invoke the shell as something like \"sh\", \"-c\", \"expanded_command_here\", \"sh\", [parameters here] and insead of expanding % codes directly in the expanded command, replacing them with \"$1\", \"$2\", etc. to pull the parameters.<\/p><p>None of this is hard. It's something you should already know how to do right if you're invoking a shell from a potentially privileged context with data from another privilege domain. If you don't already know how to do it, you should not be touching software that runs in such a context.<\/p>","url":"https:\/\/hachyderm.io\/@dalias\/115930226007230487","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/hachyderm.io\/users\/dalias\/statuses\/115930211457386898","url":"https:\/\/hachyderm.io\/@dalias\/115930211457386898"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/cyberplace.social\/users\/GossiTheDog"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/ioc.exchange\/users\/leon_p_smith"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2026-01-20:objectType=thread:nonce=b6175b50a68119f0","notice_info":{"local_id":"11969724","source":"ActivityPub"}},"published":"2026-01-21T00:21:27+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/hachyderm.io\/@dalias\/115930226007230487"},{"actor":{"id":"https:\/\/ioc.exchange\/users\/leon_p_smith","displayName":"Leon P Smith","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/theme\/gnusocialjp\/default-avatar-profile.png","rel":"avatar","type":"image\/png","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/theme\/gnusocialjp\/default-avatar-stream.png","rel":"avatar","type":"image\/png","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/theme\/gnusocialjp\/default-avatar-mini.png","rel":"avatar","type":"image\/png","width":24,"height":24}],"profile_info":{"local_id":"280540"}},"image":{"url":"https:\/\/gnusocial.jp\/theme\/gnusocialjp\/default-avatar-profile.png","rel":"avatar","type":"image\/png","width":96,"height":96},"objectType":"person","summary":"Communications engineer and mathematician. Longtime functional programming and Haskell enthusiast, occasional Schemer. Inventor of corecursive queues, postgresql-simple, an aggregate theory of concrete mathematics, and self-documenting cryptography.  Currently aspiring to become an Epistemic Frame Engineer.","url":"https:\/\/ioc.exchange\/@leon_p_smith","portablecontacts_net":{"preferredUsername":"leon_p_smith","displayName":"Leon P Smith","note":"Communications engineer and mathematician. Longtime functional programming and Haskell enthusiast, occasional Schemer. Inventor of corecursive queues, postgresql-simple, an aggregate theory of concrete mathematics, and self-documenting cryptography.  Currently aspiring to become an Epistemic Frame Engineer."}},"content":"<p><a href=\"https:\/\/hachyderm.io\/@dalias\" class=\"u-url mention\">@dalias<\/a> <a href=\"https:\/\/cyberplace.social\/@GossiTheDog\" class=\"u-url mention\">@GossiTheDog<\/a> my understanding is that \"proper quoting\" in a shell context is nigh impossible...<\/p>","generator":{"id":"tag:gnusocial.jp,2026-08-16:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/ioc.exchange\/users\/leon_p_smith\/statuses\/115930206293973381","object":{"id":"https:\/\/ioc.exchange\/users\/leon_p_smith\/statuses\/115930206293973381","objectType":"note","content":"<p><a href=\"https:\/\/hachyderm.io\/@dalias\" class=\"u-url mention\">@dalias<\/a> <a href=\"https:\/\/cyberplace.social\/@GossiTheDog\" class=\"u-url mention\">@GossiTheDog<\/a> my understanding is that \"proper quoting\" in a shell context is nigh impossible...<\/p>","url":"https:\/\/ioc.exchange\/@leon_p_smith\/115930206293973381","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/hachyderm.io\/users\/dalias\/statuses\/115930199009695983","url":"https:\/\/hachyderm.io\/@dalias\/115930199009695983"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/cyberplace.social\/users\/GossiTheDog"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/hachyderm.io\/users\/dalias"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2026-01-20:objectType=thread:nonce=b6175b50a68119f0","notice_info":{"local_id":"11969707","source":"ActivityPub"}},"published":"2026-01-21T00:17:51+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/ioc.exchange\/@leon_p_smith\/115930206293973381"},{"actor":{"id":"https:\/\/hachyderm.io\/users\/dalias","displayName":"Rich Felker","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/40873-original-tmp20221202140938.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/40873-96-20221207231635.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/40873-48-20221207231635.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/40873-24-20221207231635.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"40873"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/40873-96-20221207231635.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"C librarian, purveyor of the language&#39;s eldritch horrors. Poppin&#39; shells \ud83e\uddaa","url":"https:\/\/hachyderm.io\/@dalias","portablecontacts_net":{"preferredUsername":"dalias","displayName":"Rich Felker","note":"C librarian, purveyor of the language&#39;s eldritch horrors. Poppin&#39; shells \ud83e\uddaa"}},"content":"<p><a href=\"https:\/\/ioc.exchange\/@leon_p_smith\" class=\"u-url mention\">@leon_p_smith<\/a> <a href=\"https:\/\/cyberplace.social\/@GossiTheDog\" class=\"u-url mention\">@GossiTheDog<\/a> It's not difficult at all. One trivial way is putting ' at start and end after replacing every ' with '\\''.<\/p>","generator":{"id":"tag:gnusocial.jp,2026-08-16:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/hachyderm.io\/users\/dalias\/statuses\/115930211457386898","object":{"id":"https:\/\/hachyderm.io\/users\/dalias\/statuses\/115930211457386898","objectType":"note","content":"<p><a href=\"https:\/\/ioc.exchange\/@leon_p_smith\" class=\"u-url mention\">@leon_p_smith<\/a> <a href=\"https:\/\/cyberplace.social\/@GossiTheDog\" class=\"u-url mention\">@GossiTheDog<\/a> It's not difficult at all. One trivial way is putting ' at start and end after replacing every ' with '\\''.<\/p>","url":"https:\/\/hachyderm.io\/@dalias\/115930211457386898","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/ioc.exchange\/users\/leon_p_smith\/statuses\/115930206293973381","url":"https:\/\/ioc.exchange\/@leon_p_smith\/115930206293973381"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/cyberplace.social\/users\/GossiTheDog"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/ioc.exchange\/users\/leon_p_smith"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2026-01-20:objectType=thread:nonce=b6175b50a68119f0","notice_info":{"local_id":"11969708","source":"ActivityPub"}},"published":"2026-01-21T00:17:50+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/hachyderm.io\/@dalias\/115930211457386898"},{"actor":{"id":"https:\/\/hachyderm.io\/users\/dalias","displayName":"Rich Felker","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/40873-original-tmp20221202140938.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/40873-96-20221207231635.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/40873-48-20221207231635.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/40873-24-20221207231635.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"40873"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/40873-96-20221207231635.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"C librarian, purveyor of the language&#39;s eldritch horrors. Poppin&#39; shells \ud83e\uddaa","url":"https:\/\/hachyderm.io\/@dalias","portablecontacts_net":{"preferredUsername":"dalias","displayName":"Rich Felker","note":"C librarian, purveyor of the language&#39;s eldritch horrors. Poppin&#39; shells \ud83e\uddaa"}},"content":"RT @dalias For elder security greybeards, you may remember this is almost the exact same bug that Solaris introduced a decade before \ud83e\udee1","generator":{"id":"tag:gnusocial.jp,2026-08-16:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/hachyderm.io\/users\/dalias\/statuses\/115930202032024587\/activity","object":{"id":"https:\/\/cyberplace.social\/users\/GossiTheDog\/statuses\/115929419730986889","objectType":"note","content":"<p>Bug was introduced after this report <a href=\"https:\/\/lists.gnu.org\/archive\/html\/bug-inetutils\/2014-12\/msg00012.html\" rel=\"nofollow\">https:\/\/lists.gnu.org\/archive\/html\/bug-inetutils\/2014-12\/msg00012.html<\/a><\/p>","url":"https:\/\/cyberplace.social\/@GossiTheDog\/115929419730986889","status_net":{"notice_id":null}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2026-01-20:objectType=thread:nonce=b6175b50a68119f0","notice_info":{"local_id":"11969686","source":"ActivityPub","repeat_of":"11968606"}},"published":"2026-01-21T00:15:01+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"title":"dalias repeated a notice by GossiTheDog","verb":"share","url":"https:\/\/hachyderm.io\/users\/dalias\/statuses\/115930202032024587\/activity"},{"actor":{"id":"https:\/\/hachyderm.io\/users\/dalias","displayName":"Rich Felker","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/40873-original-tmp20221202140938.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/40873-96-20221207231635.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/40873-48-20221207231635.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/40873-24-20221207231635.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"40873"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/40873-96-20221207231635.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"C librarian, purveyor of the language&#39;s eldritch horrors. Poppin&#39; shells \ud83e\uddaa","url":"https:\/\/hachyderm.io\/@dalias","portablecontacts_net":{"preferredUsername":"dalias","displayName":"Rich Felker","note":"C librarian, purveyor of the language&#39;s eldritch horrors. Poppin&#39; shells \ud83e\uddaa"}},"content":"<p><a href=\"https:\/\/cyberplace.social\/@GossiTheDog\" class=\"u-url mention\">@GossiTheDog<\/a> No, that's the thing. It doesn't pass it \"as the last parameter\". Instead it wrongly pastes it into the end of a shell command string (and without proper quoting) and tells the shell to parse it as a command. If it psssed it properly as the last parameter everything would be fine.<\/p>","generator":{"id":"tag:gnusocial.jp,2026-08-16:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/hachyderm.io\/users\/dalias\/statuses\/115930199009695983","object":{"id":"https:\/\/hachyderm.io\/users\/dalias\/statuses\/115930199009695983","objectType":"note","content":"<p><a href=\"https:\/\/cyberplace.social\/@GossiTheDog\" class=\"u-url mention\">@GossiTheDog<\/a> No, that's the thing. It doesn't pass it \"as the last parameter\". Instead it wrongly pastes it into the end of a shell command string (and without proper quoting) and tells the shell to parse it as a command. If it psssed it properly as the last parameter everything would be fine.<\/p>","url":"https:\/\/hachyderm.io\/@dalias\/115930199009695983","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/cyberplace.social\/users\/GossiTheDog\/statuses\/115929393014353710","url":"https:\/\/cyberplace.social\/@GossiTheDog\/115929393014353710"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/cyberplace.social\/users\/GossiTheDog"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2026-01-20:objectType=thread:nonce=b6175b50a68119f0","notice_info":{"local_id":"11969678","source":"ActivityPub"}},"published":"2026-01-21T00:14:15+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/hachyderm.io\/@dalias\/115930199009695983"},{"actor":{"id":"https:\/\/cyberplace.social\/users\/chrisp","displayName":"Face Thumb","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/340381-original-tmp20250602134237.webp","rel":"avatar","type":"image\/webp","width":368,"height":368},{"url":"https:\/\/gnusocial.jp\/avatar\/340381-96-20250602135704.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/340381-48-20250602135704.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/340381-24-20250602135704.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"340381"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/340381-96-20250602135704.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"Hobbies:#eattherichThumb warsMad nerdQuote: &quot;Do you bite your thumb at me, sir?&quot;","url":"https:\/\/cyberplace.social\/@chrisp","portablecontacts_net":{"preferredUsername":"chrisp","displayName":"Face Thumb","note":"Hobbies:#eattherichThumb warsMad nerdQuote: &quot;Do you bite your thumb at me, sir?&quot;"}},"content":"<p><a href=\"https:\/\/cyberplace.social\/@GossiTheDog\" class=\"u-url mention\">@GossiTheDog<\/a> I wonder if 3 letter agencies knew about this? And I wonder if they've used it against a handful of industrial sites over the years? And it is probably close to useless these days as most people have hopefully moved on to SSH and VPNs?<\/p>","generator":{"id":"tag:gnusocial.jp,2026-08-16:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/cyberplace.social\/users\/chrisp\/statuses\/115929650901767542","object":{"id":"https:\/\/cyberplace.social\/users\/chrisp\/statuses\/115929650901767542","objectType":"note","content":"<p><a href=\"https:\/\/cyberplace.social\/@GossiTheDog\" class=\"u-url mention\">@GossiTheDog<\/a> I wonder if 3 letter agencies knew about this? And I wonder if they've used it against a handful of industrial sites over the years? And it is probably close to useless these days as most people have hopefully moved on to SSH and VPNs?<\/p>","url":"https:\/\/cyberplace.social\/@chrisp\/115929650901767542","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/cyberplace.social\/users\/GossiTheDog\/statuses\/115929393014353710","url":"https:\/\/cyberplace.social\/@GossiTheDog\/115929393014353710"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/cyberplace.social\/users\/GossiTheDog"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2026-01-20:objectType=thread:nonce=b6175b50a68119f0","notice_info":{"local_id":"11968880","source":"ActivityPub"}},"published":"2026-01-20T21:55:17+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/cyberplace.social\/@chrisp\/115929650901767542"},{"actor":{"id":"https:\/\/cyberplace.social\/users\/GossiTheDog","displayName":"Kevin Beaumont","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/38360-original-tmp20251103132446.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/38360-96-20251103140751.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/38360-48-20251103133701.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/38360-24-20251103154349.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"38360"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/38360-96-20251103140751.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"Cybersecurity weather person and award winning shitposter. Shitposting is an anagram of Top Insights.  You may be surprised to know I am not representing my employer here and these are not their opinions.I have Direct Messages disabled - you can send them, but I will never receive them.","url":"https:\/\/cyberplace.social\/@GossiTheDog","portablecontacts_net":{"preferredUsername":"GossiTheDog","displayName":"Kevin Beaumont","note":"Cybersecurity weather person and award winning shitposter. Shitposting is an anagram of Top Insights.  You may be surprised to know I am not representing my employer here and these are not their opinions.I have Direct Messages disabled - you can send them, but I will never receive them."}},"content":"<p>For elder security greybeards, you may remember this is almost the exact same bug that Solaris introduced a decade before \ud83e\udee1<\/p>","generator":{"id":"tag:gnusocial.jp,2026-08-16:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/cyberplace.social\/users\/GossiTheDog\/statuses\/115929480617687454","object":{"id":"https:\/\/cyberplace.social\/users\/GossiTheDog\/statuses\/115929480617687454","objectType":"note","content":"<p>For elder security greybeards, you may remember this is almost the exact same bug that Solaris introduced a decade before \ud83e\udee1<\/p>","url":"https:\/\/cyberplace.social\/@GossiTheDog\/115929480617687454","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/cyberplace.social\/users\/GossiTheDog\/statuses\/115929419730986889","url":"https:\/\/cyberplace.social\/@GossiTheDog\/115929419730986889"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2026-01-20:objectType=thread:nonce=b6175b50a68119f0","notice_info":{"local_id":"11968689","source":"ActivityPub"}},"published":"2026-01-20T21:12:10+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/cyberplace.social\/@GossiTheDog\/115929480617687454"},{"actor":{"id":"https:\/\/cyberplace.social\/users\/GossiTheDog","displayName":"Kevin Beaumont","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/38360-original-tmp20251103132446.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/38360-96-20251103140751.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/38360-48-20251103133701.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/38360-24-20251103154349.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"38360"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/38360-96-20251103140751.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"Cybersecurity weather person and award winning shitposter. Shitposting is an anagram of Top Insights.  You may be surprised to know I am not representing my employer here and these are not their opinions.I have Direct Messages disabled - you can send them, but I will never receive them.","url":"https:\/\/cyberplace.social\/@GossiTheDog","portablecontacts_net":{"preferredUsername":"GossiTheDog","displayName":"Kevin Beaumont","note":"Cybersecurity weather person and award winning shitposter. Shitposting is an anagram of Top Insights.  You may be surprised to know I am not representing my employer here and these are not their opinions.I have Direct Messages disabled - you can send them, but I will never receive them."}},"content":"<p>Bug was introduced after this report <a href=\"https:\/\/lists.gnu.org\/archive\/html\/bug-inetutils\/2014-12\/msg00012.html\" rel=\"nofollow\">https:\/\/lists.gnu.org\/archive\/html\/bug-inetutils\/2014-12\/msg00012.html<\/a><\/p>","generator":{"id":"tag:gnusocial.jp,2026-08-16:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/cyberplace.social\/users\/GossiTheDog\/statuses\/115929419730986889","object":{"id":"https:\/\/cyberplace.social\/users\/GossiTheDog\/statuses\/115929419730986889","objectType":"note","content":"<p>Bug was introduced after this report <a href=\"https:\/\/lists.gnu.org\/archive\/html\/bug-inetutils\/2014-12\/msg00012.html\" rel=\"nofollow\">https:\/\/lists.gnu.org\/archive\/html\/bug-inetutils\/2014-12\/msg00012.html<\/a><\/p>","url":"https:\/\/cyberplace.social\/@GossiTheDog\/115929419730986889","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/cyberplace.social\/users\/GossiTheDog\/statuses\/115929393014353710","url":"https:\/\/cyberplace.social\/@GossiTheDog\/115929393014353710"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2026-01-20:objectType=thread:nonce=b6175b50a68119f0","notice_info":{"local_id":"11968606","source":"ActivityPub"}},"published":"2026-01-20T20:56:14+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/cyberplace.social\/@GossiTheDog\/115929419730986889"},{"actor":{"id":"https:\/\/cyberplace.social\/users\/GossiTheDog","displayName":"Kevin Beaumont","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/38360-original-tmp20251103132446.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/38360-96-20251103140751.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/38360-48-20251103133701.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/38360-24-20251103154349.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"38360"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/38360-96-20251103140751.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"Cybersecurity weather person and award winning shitposter. Shitposting is an anagram of Top Insights.  You may be surprised to know I am not representing my employer here and these are not their opinions.I have Direct Messages disabled - you can send them, but I will never receive them.","url":"https:\/\/cyberplace.social\/@GossiTheDog","portablecontacts_net":{"preferredUsername":"GossiTheDog","displayName":"Kevin Beaumont","note":"Cybersecurity weather person and award winning shitposter. Shitposting is an anagram of Top Insights.  You may be surprised to know I am not representing my employer here and these are not their opinions.I have Direct Messages disabled - you can send them, but I will never receive them."}},"content":"<p>lol <a href=\"https:\/\/seclists.org\/oss-sec\/2026\/q1\/89\" rel=\"nofollow\">https:\/\/seclists.org\/oss-sec\/2026\/q1\/89<\/a><\/p><p>The telnetd server invokes \/usr\/bin\/login (normally running as root) passing the value of the USER environment variable received from the client as the last parameter.<\/p><p>If the client supply a carefully crafted USER environment value being the string \"-f root\", and passes the telnet(1) -a or --login parameter to send this USER environment to the server, the client will be automatically logged in as root bypassing normal authentication processes.<\/p>","generator":{"id":"tag:gnusocial.jp,2026-08-16:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/cyberplace.social\/users\/GossiTheDog\/statuses\/115929393014353710","object":{"id":"https:\/\/cyberplace.social\/users\/GossiTheDog\/statuses\/115929393014353710","objectType":"note","content":"<p>lol <a href=\"https:\/\/seclists.org\/oss-sec\/2026\/q1\/89\" rel=\"nofollow\">https:\/\/seclists.org\/oss-sec\/2026\/q1\/89<\/a><\/p><p>The telnetd server invokes \/usr\/bin\/login (normally running as root) passing the value of the USER environment variable received from the client as the last parameter.<\/p><p>If the client supply a carefully crafted USER environment value being the string \"-f root\", and passes the telnet(1) -a or --login parameter to send this USER environment to the server, the client will be automatically logged in as root bypassing normal authentication processes.<\/p>","url":"https:\/\/cyberplace.social\/@GossiTheDog\/115929393014353710","status_net":{"notice_id":null}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2026-01-20:objectType=thread:nonce=b6175b50a68119f0","notice_info":{"local_id":"11968571","source":"ActivityPub"}},"published":"2026-01-20T20:49:26+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/cyberplace.social\/@GossiTheDog\/115929393014353710"}],"links":[{"url":"https:\/\/gnusocial.jp\/conversation\/6077516","rel":"alternate","type":"text\/html"}]}