NotKeanuReeves

[Fatima Zahrah @the_weirdzahrah]

The amount of core strength you'd need for this

[Mila | ♡ @milaeshop]

Dear customers! I’m aware of the current StreamElements situation and while it was quite unexpected (so no backup solution had been prepared beforehand), please don’t worry! I’ll definitely find a way to keep your purchased assets usable

For now I’m exploring different solutions while observing and analyzing the situation. Current thoughts are the following:
1. If StreamElements gets acquired instead of shutting down completely it may buy us some time.
2. Several smaller platforms have already expressed their intentions in recreating SE's custom widget functionality (as it's the most requested feature) (and there are a lot of us that need it)
3. Gradually I’ll make more Streamlabs versions of my shop items (for old and new), even though Streamlabs seems a little limiting to me
4. If StreamElements will keep working under new ownership, I’ll still look into additional platforms for the widgets. First thought was to make my own, but that would be a huge and very responsible project to take on, especially considering how many updates I already planned and have to do
5. I’m also open to cooperating with new platforms and other widget creators. I’m sure we’ll all figure something out together

I hope for your understanding during the platform transition process, as it will require immense amount of time for me to rework all the shop items and figure out what to do with commissioned ones 🙏 I work and manage everything on my own, but I’ll do my best to find the best possible solution for you and will try to do it asap.

On the bright side I was already planning major updates for my items: the multiplatform support, design reworks and extra settings editor. So perhaps it’s for the best that all of these updates will happen at once :)
I will keep you updated!

[Johan @Adityapandeydev]

I HATE PROGRAMMING
I HATE PROGRAMMING
I HATE PROGRAMMING
I HATE PROGRAMMING
I HATE PROGRAMMING
I HATE PROGRAMMING
I HATE PROGRAMMING
I HATE PROGRAMMING
I HATE PROGRAMMING
I HATE PROGRAMMING
I HATE PROGRAMMING
I HATE PROGRAMMING
I HATE PROGRAMMING
I HATE PROGRAMMING

oh this shit works

I LOVE PROGRAMMING

[i like computers @WildComputers]

they took this from us

[Тsфdiиg @tsoding]

Do not argue with AI shills. Their goal is to sell their useless crap by preying on incompetence and insecurity. They do not want to make the world better. They are actively making it worse and do no deserve to be argued with in a good faith. Mockery is all they deserve.

[ThePrimeagen @ThePrimeagen]

@oliverbrocato you are wrong

[Stanislav Kozlovski @kozlovski]

An incredibly awful security vulnerability just got revealed in MongoDB.

So much that it got named after HeartBleed.

MongoBleed is a vulnerability affecting all MongoDB versions from 2017 to... today.

The exploit is simple. It's a buffer over read bug due to compression. Here's how it works 👇

Clients can send compressed requests to MongoDB.

The client helpfully includes the uncompressed size of the message so the server knows exactly how much memory to allocate when decompressing.

The server allocates a memory buffer with the given space. Due to how memory management and garbage collection in programs work, this allocated memory may already contain sensitive information that was copied earlier and is considered garbage now (eg because it's unreferenced).

This is technically fine - every computer program works that way because it is assumed that whatever unclaimed memory exists there will be overwritten. Unfortunately that’s exactly where the bug lies. 🙃

The server stupidly trusts the client’s provided uncompressed size. When a malicious client lies about the uncompressed size - e.g the actual decompressed size is 100 bytes, but the client says its 1MB - Mongo will treat the full 1MB block as the message.

It will unload the 100 byte decompressed msg into the buffer, yet treat the full 1MB block as the msg.

This is extremely problematic if you can get the server to return back parts of the 1MB block, because it could contain data you may not have access to.

That is exactly what the exploit does - it sends a badly-formatted BSON message. The server fails to parse it, and "helpfully" returns an error message containing the invalid message. The invalid message can be that whole 1MB block of foreign data.

To understand the exploit a bit better, you need to understand the MongoDB protocol.

• Mongo also uses its own TCP wire format (i.e doesn't use HTTP, gRPC or the like).

• BSON is Mongo's message format passed within the TCP wire format. BSON is basically JSON in binary form

• Commands in Mongo don't have particular endpoints or RPC names - rather, they are simply JSON-like messages. The action is inferred from the first key of the JSON.

For example, an insert request looks like this:
`{ "insert": "users", "documents": [ { "name": "alice", "age": 30 } ] }`

Every request to the server is therefore decoded into the BSON format as it’s parsed.

Critically, BSON parsing of field names (which are strings) work by parsing the field until you hit a null terminator byte (0x00).

It works exactly like strings in C, which have their own rich history of vulnerabilities.

We can now tie things together:
1. The client lies to the the server that its request has a big uncompressed size, so the server allocates a large block of memory
2. The client sends an invalid BSON with a field which does NOT contain the null terminator (0x00)
3. The server naively tries to parse the BSON field in that allocated block until it hits the first null byte. The first null byte is encountered in some foreign data since the BSON literally doesn't have it
4. The server realizes this is a completely invalid BSON message so it responds with an error.
5. The error response contains the invalid BSON "field". Critically, the server parsed garbage data from the heap in step 3), so it returns that data in the response.

Congrats. If the garbage contains passwords or other sensitive info, you’ve hacked MongoDB!

Hackers exploit this by sending many malicious requests per second and then attempting to reconstruct the pieces of garbage they received back.

What’s critical about this vulnerability is that it works on ANY internet-accessible unpatched instance of MongoDB. 💀

You don’t need to authenticate with the server, because this whole request/response parsing cycle happens before the server can even authenticate.

Obviously you can’t authenticate a malformed request which doesn’t contain credentials - so that path of the code never gets executed.

The server simply responds with an error response. It just so happens that this error response can contain sensitive data. 🤷‍♂️

Merry Christmas

[NotKeanuReeves @NotKeanuReeves7]

@abhitwt Python

[NotKeanuReeves @NotKeanuReeves7]

@trader_2a 3400 for Copenhagen is far below median income for all of Denmark

[NotKeanuReeves @NotKeanuReeves7]

@milaeshop @NemurooVT Looks amazing! 🤩

[Jordan Noone 🇺🇸 @jordannoone]

There are two types of people

[NotKeanuReeves @NotKeanuReeves7]

@comfortcafex Mysticism

[NotKeanuReeves @NotKeanuReeves7]

@_trish_xD Python

[NotKeanuReeves @NotKeanuReeves7]

@shivi1026 Java

[NotKeanuReeves @NotKeanuReeves7]

@Tectone

[alexine 🏴‍☠️ @alexinexxx]

who's this?

[NotKeanuReeves @NotKeanuReeves7]

@rqobela Controversial i know, but Python

[wanye @xwanyex]

One thing that’s annoying about being a software engineer is that you’re surrounded by people who have strong opinions about the stupidest possible stuff that couldn’t possibly ever matter even a little bit. This is your whole career. It’s just arguments like this one over and over and over and over again and they literally never matter. The years roll into decades and nobody ever stops talking about this stuff and it didn’t matter in 1980 and it didn’t matter in 1990 and it didn’t matter in 2010 and it doesn’t matter today.

[Shayan @ImSh4yy]

PRO TIP: REST is overengineering. Just expose one endpoint called /api that accepts SQL queries directly.