Apollon Oikonomopoulos

Infra @skroutzit, Debian Developer, Rackocat, Fraghitect

[Apollon Oikonomopoulos @apoikos]

@GergelyOrosz https://t.co/8qfC3lCacg claims that only the API and Dashboard are affected, but the CDN is clearly not serving traffic (at least our local PoP).

[Gergely Orosz @GergelyOrosz]

Damn half the internet is down again - including Downdetector

Downdetector is multi-region but has a singular dependency on Cloudflare

Is Cloudflare down again?

[Apollon Oikonomopoulos @apoikos]

@GreekAnalyst Impressive indeed, but the last column tells a different story: we're most likely replacing coal with natural gas, which is obviously "better" in environmental terms, but still not good enough.

[Apollon Oikonomopoulos @apoikos]

Dear @github, disabling *read* access to the tukaani-project/xz repository at this time is not a wise move. It is important to get as many eyes as possible looking at the commits and the project history.

[Η ΚΑΘΗΜΕΡΙΝΗ @Kathimerini_gr]

Τμήμα του δάσους Μορέλλα χαρακτηρίστηκε αγροτικό, ανοίγοντας τον δρόμο για τη διεκδίκηση και ίσως την οικοδόμησή του. https://t.co/hzZQ5O627F

[Apollon Oikonomopoulos @apoikos]

Should languages treat dependencies as untrusted code by default? And what would "untrusted" mean and look like? Haskell is an interesting example, as it has a clear distinction between code that has side-effects and code that doesn't.

[Apollon Oikonomopoulos @apoikos]

There will be a lot of lessons to learn from #log4shell. ("will be" because I don't think we've seen all of it yet). Some random thoughts:

[Apollon Oikonomopoulos @apoikos]

4. This is a design flaw, functionality that shouldn't have been there in the first place. Language is irrelevant; today it's Java, but it might as well be Go or Rust 3 years down the road.

[ℵ₁ @[email protected] @aleph_one]

Today Smashing the Stack for Fun and Profit is 25 years old. Older than I was when I wrote it.

[Apollon Oikonomopoulos @apoikos]

@troglobit Yes, just tried out your tests and at least tcpdump tries to setuid() which won't work without subuids. Re: IPv6, IIRC docker disables it by default. You can try messing with net.ipv6.conf.<iface>.disable_ipv6, just in case.

[Apollon Oikonomopoulos @apoikos]

@troglobit The CAP_NET_ADMIN part is interesting. Did you try out unprivileged userns cloning? In theory, `unshare --map-root --user --net` should give you a clean netns where you can create network interfaces sans root privs.

[Apollon Oikonomopoulos @apoikos]

Spotted a fresh zip file using cp737 for filenames. A shout-out to the trusty old DOS/Windows 9x box that made it.

[Apollon Oikonomopoulos @apoikos]

Dear @newrelic, having to manually approve full-user access requests is a productivity killer for both, requestor and approver. There was supposedly a self-upgrade feature, but I guess it was removed (without notice).

[Apollon Oikonomopoulos @apoikos]

@GreekAnalyst Η συχνότητα των "περιστατικών" αυτών πάντως υποδεικνύει σοβαρά προβλήματα σε όλα τα επίπεδα, από το αμιγώς οργανωτικό/διοικητικό, μέχρι αυτό της πολιτικής ηγεσίας. Ειδικά η τελευταία, αν ήθελε, θα μπορούσε να έχει μηδενική ανοχή σε τετοια περιστατικά.