cultural reviewer and dabbler in stylistic premonitions

  • 28 Posts
  • 79 Comments
Joined 3 years ago
cake
Cake day: January 17th, 2022

help-circle




  • Why memorize a different command? I assume sudoedit just looks up the system’s EDITOR environment variable and uses that. Is there any other benefit?

    I don’t use it, but, sudoedit is a little more complicated than that.

    details

    from man sudo:

    When invoked as sudoedit, the -e option (described below), is implied.
    
           -e, --edit
                   Edit one or more files instead of running a command.   In  lieu
                   of  a  path name, the string "sudoedit" is used when consulting
                   the security policy.  If the user is authorized by the  policy,
                   the following steps are taken:
    
                   1.   Temporary  copies  are made of the files to be edited with
                        the owner set to the invoking user.
    
                   2.   The editor specified by the policy is run to edit the tem‐
                        porary files.  The sudoers policy  uses  the  SUDO_EDITOR,
                        VISUAL  and  EDITOR environment variables (in that order).
                        If none of SUDO_EDITOR, VISUAL  or  EDITOR  are  set,  the
                        first  program  listed  in the editor sudoers(5) option is
                        used.
    
                   3.   If they have been modified, the temporary files are copied
                        back to their original location and the temporary versions
                        are removed.
    
                   To help prevent the editing of unauthorized files, the  follow‐
                   ing  restrictions are enforced unless explicitly allowed by the
                   security policy:
    
                    •  Symbolic links  may  not  be  edited  (version  1.8.15  and
                       higher).
    
                    •  Symbolic links along the path to be edited are not followed
                       when  the parent directory is writable by the invoking user
                       unless that user is root (version 1.8.16 and higher).
    
                    •  Files located in a directory that is writable by the invok‐
                       ing user may not be edited unless that user is  root  (ver‐
                       sion 1.8.16 and higher).
    
                   Users are never allowed to edit device special files.
    
                   If  the specified file does not exist, it will be created.  Un‐
                   like most commands run by sudo, the editor is run with the  in‐
                   voking  user's  environment  unmodified.  If the temporary file
                   becomes empty after editing, the user will be  prompted  before
                   it is installed.  If, for some reason, sudo is unable to update
                   a file with its edited version, the user will receive a warning
                   and the edited copy will remain in a temporary file.
    

    tldr: it makes a copy of the file-to-be-edited in a temp directory, owned by you, and then runs your $EDITOR as your normal user (so, with your normal editor config)

    note that sudo also includes a similar command which is specifically for editing /etc/sudoers, called visudo 🤪




  • Arthur Besse@lemmy.mlMtoLinux@lemmy.mlWhat was Linux like in the 90s
    link
    fedilink
    English
    arrow-up
    2
    ·
    edit-2
    19 days ago

    encryption would prevent the modem from seeing it when someone sends it, but such a short string will inevitably appear once in a while in ciphertext too. so, it would actually make it disconnect at random times instead :)

    (edit: actually at seven bytes i guess it would only occur once in every 72PB on average…)


  • Arthur Besse@lemmy.mltoOpen Source@lemmy.mlEU OS
    link
    fedilink
    English
    arrow-up
    6
    ·
    20 days ago

    As I wrote in the thread about this last month on !linux@lemmy.ml:

    I wonder how much work is entailed in transforming Fedora in to a distro that meets some definition of the word “Sovereign” 🤔

    Personally I wouldn’t want to make a project like this be dependent on the whims of a US defense contractor like RedHat/IBM, especially after what happened with CentOS.

    and, re: “what do you mean ‘redhat is a defense contractor’?!”: here are some links.

    screenshot of RedHat PDF saying: Compress the kill cycle with Red Hat Device Edge.
Deploy on any aircraft, pod,
sensor, or C2 node
 Ability to comply with
cybersecurity requirements
Executive summary
The U.S. Air Force and its mission partners are fielding new mission capabilities on airframes and
command-and-control (C2) nodes to compress the kill chain. The find, fix, track, target, engage,
assess (F2T2EA) process requires ubiquitous access to data at the strategic, operational and tactical
levels. Red Hat® Device Edge embeds captured, analyzed, and federated data sets in a manner that
positions the warfighter to use artificial intelligence and machine learning (AI/ML) to increase the
accuracy of airborne targeting and mission-guidance systems. Challenges of edge computing on
aircraft and other tactical C2 edge nodes include delivering consistent capabilities on diverse
hardware (new and old, connected and disconnected), meeting airworthiness security requirements,
and efficiently sustaining software at scale. The Air Force can meet these requirements with
Red Hat Device Edge, the edge-optimized software platform that is hardware agnostic.
Opportunity: Use edge technology to defeat the adversary
The Air Force and its partners are developing innovative capabilities on airborne and ground systems
to gain battlespace advantage, including:
 Coalescing and stratifying data to feed AI/ML at the edge to increase the accuracy of
targeting and mission-guidance systems and compresses the mean time to detect (MTTD),
make sense and act across all warfighter domains.
 Delivering near real-time data from sensor pods directly to airmen, accelerating the
sensor-to-shooter cycle.
 Supporting Agile Combat Employment (ACE) in the highly contested
21st-century battlespace.
 Sharing near real-time sensor fusion data with joint and multinational forces to increase
awareness, survivability, and lethality.
“With Red Hat Device
Edge Lockheed Martin
is leading the infusion
of cutting-edge
commercial technology
into military capabilities
that deliver advanced
solutions to our
customers. Unlocking
these AI technologies
can help national
security decision
makers stay ahead of
adversaries, enabling
a safer and more
secure world.”
Justin Taylor
Vice President, F-22 technology,
Lockheed Martin 1
1 Red Hat press release. “Lockheed Martin, Red Hat Collaborate to Advance Artificial Intelligence for Military Missions,”
25 Oct. 2022.

    (source)











  • Arthur Besse@lemmy.mlMtoLinux@lemmy.mlA good e-mail client for linux?
    link
    fedilink
    English
    arrow-up
    5
    ·
    edit-2
    1 month ago

    still of Obi-wan Kenobi in Star Wars with subtitle "Now, that's a name I've not heard in a long time. A long time."

    At first i thought, wow, cool they’re still developing that? Doing a release or two a year, i see.

    I used to use it long ago, and was pretty happy with it.

    But looking closer now, what is going on with security there?! Sorry to be the bearer of probably bad news, but... 😬

    The only three CVEs in their changelog are from 2007, 2010, and 2014, and none are specific to claws.

    Does that mean they haven’t had any exploitable bugs? That seems extremely unlikely for a program written in C with the complexity that being an email client requires.

    All of the recent changelog entries which sound like possibly-security-relevant bugs have seven-digit numbers prefixed with “CID”, whereas the other bugs have four-digit bug numbers corresponding to entries in their bugzilla.

    After a few minutes of searching, I have failed to figure out what “CID” means, or indeed to find any reference to these numbers outside of claws commit messages and release announcements. In any case, from the types of bugs which have these numbers instead of bugzilla entries, it seems to be the designation they are using for security bugs.

    The effect of failing to register CVEs and issue security advisories is that downstream distributors of claws (such as the Linux distributions which the project’s website recommends installing it from) do not patch these issues.

    For instance, claws is included in Debian stable and three currently-supported LTS releases of Ubuntu - which are places where users could be receiving security updates if the project registered CVEs, but are not since they don’t.

    Even if you get claws from a rolling release distro, or build the latest release yourself, it looks like you’d still be lagging substantially on likely-security-relevant updates: there have actually been numerous commits containing CID numbers in the month since the last release.

    If the claws developers happen to read this: thanks for writing free software, but: please update your FAQ to explain these CID numbers, and start issuing security advisories and/or registering CVEs when appropriate so that your distributors will ship security updates to your users!


  • Nope.

    Nope, it is.

    It allows someone to use code without sharing the changes of that code. It enables non-free software creators like Microsoft to take the code, use it however they like, and not have to share back.

    This is correct; it is a permissive license.

    This is what Free Software prevents.

    No, that is what copyleft (aims to) prevent.

    Tired of people calling things like MIT and *BSD true libre/Free Software.

    The no True Scotsman fallacy requires a lack of authority about what what constitutes “true” - but in the case of Free/Libre software, we have one: https://en.wikipedia.org/wiki/The_Free_Software_Definition

    If you look at this license list (maintained by the Free Software Foundation’s Licensing and Compliance Lab) you’ll see that they classify many non-copyleft licenses as “permissive free software licenses”.

    They’re basically one step away from no license at all.

    Under the Berne Convention of 1886, everything is copyrighted by default, so “no license at all” means that nobody has permission to redistribute it :)

    The differences between permissive free software licenses and CC0 or a simple declaration that something is “dedicated to the public domain” are subtle and it’s easy to see them as irrelevant, but the choice of license does have consequences.

    The FSF recommends that people who want to use a permissive license choose Apache 2.0 “for substantial programs” because of its clause which “prevents patent treachery”, while noting that that clause makes it incompatible with GPLv2. For “simple programs” when the author wants a permissive license, FSF recommends the Expat license (aka the MIT license).

    It is noteworthy that the latter is compatible with GPLv2; MIT-licensed programs can be included in a GPLv2-only work (like the Linux kernel) while Apache 2.0-licensed programs cannot. (GPLv3 is more accommodating and allows patent-related additional restrictions to be applied, so it is compatible with Apache 2.0.)