Notices by Morten Linderud (foxboron@chaos.social), page 3

I'm mind blown you can compromise a release CI/CD system with two malicious branch names. Like how.

https://github.com/ultralytics/ultralytics/issues/18027

#Security #SupplyChainSecurity

Badge pimping?

Some @kpcyrd stickers available if you find me :)

@ryanc @Dtl @viq

I tried getting ffmpeg to output Hackers through caca but it wasn't super easy as you need to render each frame from the nurses driver.

@Dtl @viq @ryanc

Love it. Totes doing that.

https://github.com/Foxboron/ssh-the-planet

@ryanc

This is funny. I wrote a SSH server that writes out the script to Hackers while ignoring Ctrl-C.

@mjg59

How are you exposing the yubikey to the browser? Are you using uhid or is there other ways?

Days since `sbctl` soft-bricked a machine because of terrible OEM firmware: 0

Don't buy a slimbook.

#SecureBoot #Linux #sbctl #slimbook

@mort @gregkh

Using CVE counts as an argument this way has always been bogus though, regardless of what is currently happening.

Someone pointed out that rpm strips packages faster than pacman so a little bit of xargs hacking later and I've shaved off 1.5/2 seconds of the pacman package building.

https://gitlab.archlinux.org/pacman/pacman/-/merge_requests/175

#rpm #pacman #ArchLinux

@clacke @dch @mjg59

We don't have several independently developed compilers, so we are only getting weak proofs of DDC. We are still reliant on different versions of GCC.

https://reproducible-builds.org/news/2019/12/21/reproducible-bootstrap-of-mes-c-compiler/

NixOS isn't bootstrappable yet as it's a WIP, so only really Guix.

@dch @mjg59

I find it a bit weird how reflections on trusting trust is being forced into these discussions, almost like it's a solved problem. But it very much isn't, and existing distro toolchains are still very opaque.

@forteller
Du glemte å sensurere handle i første svar :)

@forteller
Hvordan ellers skal dem gjennomføre vedlikehold?

The LKML has adapted to the situation at camp.

We are passing these around the table.

Do they look fine @torvalds @gregkh?

#Linux #cccamp23 #ccamp2023

@gregkh @torvalds
Please merge the following patch!

#cccamp23 #ccamp2023 #Linux

@aeva
The repository handling scripts in Arch Linux is around 20 years old now. Rewritten twice over three different VCS tools.

It's also been developed in cvs, SVN and git, and the all the history is preserved!

I have several times run the git log looking at the 20 year old code wondering how they did stuff way back when to make sense of current repo handling.

@mattl @msw
AGPL