Oriel Jutty

I don't know who needs to hear this, but: A Linux process can voluntarily restrict the files it (and any children it spawns) may access (and how) using the landlock(7) API. Also, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) prevents a process from gaining privileges by executing a setuid program. This seems like a great way to lock down worker processes that parse untrusted user input. If set up correctly, even if an attacker manages to take over, the attacker is limited in what they can do because they might not be allowed to write or execute any files, for example. #linux #landlock

@davidgerard@circumstances.run Source: https://www.smbc-comics.com/?id=2526 by @ZachWeinersmith@mastodon.social

@flyingsaceur@ioc.exchange @rujasu@kind.social Now I'm wondering if the name is a reference to Gradius, which maybe was supposed to be Gladius (because Japanese)?

@nuintari@mastodon.bsd.cafe The list part can be written fully left-to-right: ($bar->baz->@*) Whether that's an improvement is in the eye of the beholder.

@raktheundead@techhub.social @maybe_mbk@mastodon.social @Cregg@gamedev.lgbt @zzt@mas.to @gamingonlinux@mastodon.social That's the one, but I prefer to refer to "Knoll's law of media accuracy", which came first: Everything you read in the newspapers is absolutely true except for the rare story of which you happen to have firsthand knowledge. My issue with the "Gell-Mann amnesia effect" is that the term was coined in a speech by a climate denialist where he argued that you no one knows the future for certain, so all speculation is baseless and pointless, and the media is frequently wrong about all kinds of things. His examples included Y2K and global warning: We need to start remembering that everybody who said that Y2K wasn't a real problem was either shouted down, or kept off the air. The same thing is true now of issues like species extinction and global warming.

@troed@swecyb.com How do you "license" code which you did not write and of which you are not the copyright holder?

@bruce@darkmoon.social ... digging deeper: Running PERLDOCDEBUG=2 perldoc strict (and then hitting q to exit less) on my machine shows a tmp file being written, followed by a call to /usr/bin/less < /tmp/XXXXXXXXXX. Is your /tmp directory OK and readable/writeable? Or is perldoc using a different directory on your machine?

WTF is $Pod::Simple::Text::FREAKYMODE? #perl

@mjd@mathstodon.xyz asking it to solve a not-too-difficult but open problem of game theory, and to write a paper about it. This it did Facts not in evidence. It apparently produced a paper, but he doesn't say it solved the problem.

@mjd@mathstodon.xyz @vnikolov@ieji.de Ah. Looks like "Lodz University of Technology" https://p.lodz.pl/en is the official English version of "Politechnika Łódzka" https://p.lodz.pl/

@bruce@darkmoon.social Are PERLDOC and/or PERLDOC_PAGER set in your environment?

@bruce@darkmoon.social Weird. I've never seen that one. Do perldoc -m strict and perldoc -lm strict produce the same error?

@marocddot@hachyderm.io Not necessarily sans CPAN: https://metacpan.org/dist/App-FatPacker/view/bin/fatpack can bundle pure-perl dependencies into your script file for deployment.

@isotopp@infosec.exchange Nein. Die Halluzinationen gelangen nicht in den Code; die Halluzinationen sind der Code. Das ist ja gerade das lustige an LLMs: 100% des Outputs sind Halluzination, weil das das einzige ist, was die Maschine produzieren kann.

@isotopp@infosec.exchange "Halluzinationen" – also Abweichungen zwischen dem, was man erwartet und was das Modell produziert Das ist m.M.n. ein Definitionsfehler. "Halluzinationen" ist all das, was ein Sprachmodell ohne Zusammenhang zur Realität (oder zumindest einem Modell der Realität), quasi im Vakuum, produziert (fabuliert?). Das kann dann im Ergebnis zufällig richtig sein (also mit der Realität übereinstimmen), aber der Prozess war trotzdem halluzinatorisch.

@mjd@mathstodon.xyz Probably a member of the same cult that decided Lisp should have declare, declaim, and proclaim statements, all different. Or =, eq, eql, equal, and equalp. #lisp

@mjd@mathstodon.xyz cf. https://infosec.exchange/@hzulla/116957029050682159

@hmwilker@social.tchncs.de @feorag@wandering.shop Yes, assuming we're talking about the pastry: https://de.wikipedia.org/wiki/Schweinsohr_%28Geb%C3%A4ck%29

@feorag@wandering.shop Not to be confused with https://de.wikipedia.org/wiki/Teetz_(Kyritz)

https://invent.kde.org/svin shows "This user is blocked" for me. Does this mean svin has been banned from that Gitlab instance? #kde

@Thayer@mastodon.social Finally. Bias automation at scale. Just what I've always wanted.

@jernej__s@infosec.exchange @David_Kelly_SF@mstdn.ca Hah, that page messes with all sorts of input events: Key presses, mouse clicks, touch events, ... all because (according to the source code): 'You are not allowed to copy content or view source' and "Content is protected !!"

@foolishowl@social.coop Sounds reasonable to me. For private stuff I generally use v5.36 at minimum, plus whatever newer features I find convenient. For things I publish I tend to be more conservative, but I don't go out of my way to stay compatible with a 10 year old version of perl. If things happen to work, great; if not, no big deal. (Also, writing for anything before v5.20 is pointless unless you have some ancient systems you absolutely must support.)

@zzt@mas.to They should post exclusively on 4chan.

@cpansec@fosstodon.org How do I get incorrect/misleading information in a CVE fixed? Specifically, CVE-2026-13577: "[...] silently falls back to a built-in rand-derived session id when both Math::Random::ISAAC::XS and Crypt::URandom are unavailable" should be "silently falls back to a built-in rand-derived session id when either Math::Random::ISAAC::XS or Crypt::URandom are unavailable." Or perhaps better: "silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available."

RE: https://fosstodon.org/@haskell/116999316073427294 I prefer fast recursion

me when I post imps — a mongoose

@PorkBBQ@dice.camp @nuintari@mastodon.bsd.cafe Postfix dereferencing first appeared in perl 5.20, released in May 2014. It's more than 12 years old at this point. (It officially left "experimental" status in perl 5.24, released in May 2016. Still more than a decade.)

Are You Smarter Than A Millionaire

@simontatham@hachyderm.io I've had similar thoughts. I think recursive algorithms come most naturally when you have a recursive problem/data structure, like a tree. So I think good introductory examples would be recursively searching a directory for all .png files or eval'ing an expression tree in a calculator.

RE: https://infosec.exchange/@wdormann/116965837513850094 TIL installing SharePoint updates does not update SharePoint.

@pozorvlak@mathstodon.xyz Yeah, sure. It's not the climate collapse, not the rise of fascism, not the threat of worldwide war, no: The really scary thing is the statistical word completion machine (that someone hooked up to a shell and gave an internet connection).

RE: https://mathstodon.xyz/@pozorvlak/116968236641276698 Somehow this commentary is very funny to me. (And I think it absolutely was a marketing stunt.)

@mjd@mathstodon.xyz "What I’ve checked of it so far checks out." I understand this to mean he did some spot checks, but didn't verify the results himself. See also his reply to you: "at least historically before AI was as good as it is today and I'd want to do a bit more work to ensure all the results are correct -- but I did check some of them at least".

@KoosPol@mastodon.nl @djb@mastodon.cr.yp.to https://en.wikipedia.org/wiki/Cryptographic_hash_function#Illustration

@foone@digipres.club document.write('<form> ... </form>')

@ChristineMalec@mstdn.ca Out of interest, does your screen reader stumble over things like emoji, quotation marks, and all-caps words in alt text?

RE: https://spectre.asta.lgbt/@aud/statuses/01M218903KJRMAKC42CV0Y5WYE Huh. I think I've changed. I may actually care more about people now. (Also, so far I've successfully managed to avoid being in any sort of leadership position.)

Party Rock! https://www.youtube.com/watch?v=k8IbZTVE95s #recordcollector1972

On the command line, sometimes I want to tell a tool (e.g. grep) to look in all directories except for one or two. This can be done with shell wildcards/globs. All entries in the current directory: grep -r 'honk honk' * Subdirectories only: grep -r 'honk honk' */ All subdirectories except for _build: grep -r 'honk honk' !(_build)/ All subdirectories except for _build and cache: grep -r 'honk honk' !(_build|cache)/ #bash

@cstross@wandering.shop Clearly it's talking about keyboard drivers.

Toolkit - Lateralize

@mjg59@nondeterministic.computer I see the bible is back.

@rrwo@infosec.exchange Is this exploitable if the base string ends with a slash, like rewrite => 'https://example.com/'

I simply wouldn't get addicted to cocaine. I'm too intelligent.

@offseq@infosec.exchange Unlike what this website claims, you need to install both Math::Random::ISAAC::XS and Crypt::URandom to not be vulnerable.

@mjd@mathstodon.xyz Reminds me of https://web.archive.org/web/20041108121656/http://www.research.ibm.com/people/d/dfb/papers/Bacon01Concurrent.pdf which contains a few proofs of correctness (of the concurrent version of their algorithm), but their basic single-threaded algorithm has a use-after-free bug.

do you prefer your pizza cut or uncut 🍕