Notices by Jonathan Wight (schwa@mastodon.social), page 3

What's the best GUI tool to get a "time machine" like view of a file in git…

Xcode's history view is mostly what i need - but it's gotten really flakey in latest beta (and pre-betas refuse to run on macOS beta).

I'm trying to understand the (recent) lifetime of a file, find out how i fucked it up and then pull in changes from prior versions.

Still have rendering issues :-(

Apple shit-canning “Apple Pay later” is great news. These types of consumer microloans are incredibly irresponsible and predatory.

I’m not optimistic what they’re replacing it with will be any better but here’s hoping.

It was shameful that they felt they needed to get into this market in the first place though.

https://www.theverge.com/2024/6/17/24180340/apple-pay-later-shutting-down-months-after-launch

“His unit had been decimated, he said, with only 12 out of 100 soldiers still alive as they came under constant Ukrainian fire and drones in Vovchansk, a prime target of Russia’s advances.”

“They just chop us up. We are sent under machine guns, under drones in daylight, like meat. And commanders just shout ‘forward and forward’,” Andreev said in a video message.

-

Russia is gonna Russia…

@dwineman @inthehands I honestly don't think “the market” cares one whit about user privacy.

@inthehands "deftly juiced”?

@inthehands it was handled very clumsily by Apple. They were very careful to highlight all the privacy protection. And then they tossed that out with “oh hey you can use Siri with ChatGPT”

Apple fucked up

@inthehands they suddenly stopped talking about privacy when the ChatGPT button was rolled out.

This week’s spike of AAPL pricing is visible on pretty much every time range graph you care to look at.

It’s massive. Maybe their biggest short term gain ever?

And considering how the stock normally behaves after wwdc keynotes it’s a huge outlier.

Unfortunately this is going to send the message that adding creepy implementations of AI, with all that negative baggage it brings with it, was the right strategy.

I installed Bartender and installed Jordan Baird's Ice open source replacement for it.

I also sponsored their development on github… when I sponsored it - I was the 2nd name in the list… now another 50 folks have also sponsored it.

I guess the shitty behavior of the previous and current Bartender owners annoyed a lot of people.

https://github.com/sponsors/jordanbaird

I swear the Bay Area is trying to kill me.

The iPhone 15 Plus is (depending on configuration) more expensive than a MacBook Air.

It naturally follows that I should of course be able to run macOS on my phone.

This is the logic.

“I want macOS running on my iPad Pro”

Yes grandad. Of course you do grandad.

Announcing AppleID Pro. 0.2mm thinner and won't arbitrarily force you to change your password at random intervals.

What's wild about this is…

… either the contributor was playing the long game - gained the trust of maintainers via legit work just to get to this point…

… or the legit work wasn't legit and they introduced other vulnerabilities over the course of 2+ years - and this exploit was the first one they got caught doing…

…or was legitimately contributing until they themselves were compromised (ship this vulnerability or we break your legs…)

* And promptly snuck a backdoor into xz via the release package (*) (backdoor isn't present in code)
* On some Linux distros sshd is patched for to work with systemd (to allow other services to know when sshd is/isnt running)… and that patch links in xz('s library)…
* And now sshd is compromised - send a specially crafted xz archive to sshd and you're in…

(* edited.)

My attempt to summarise what happened:

* xz is an archive file format widely used on various Linux distributions for packaging and other purposes
* The primary (unpaid hobbyist) maintainer isn't able to maintain it effectively (health issues/frequent internet breaks).
* A contributor over the course of 2+ years has submitted hundreds of (originally believed legit but now considered sus) patches and gained trust of maintainer.
* Contributor was given ability to sign releases…

1/

Well reading about the xz ssh backdoor turned into one heck of a rabbit hole this morning.

@sommer oh yay. It me

@inthehands