Aleksa Sarai 暗号君

RE: @amutable@mastodon.social

It is my enormous pleasure to announce that I am joining an amazing team (@pid_eins@mastodon.social @blixtra@hachyderm.io @daandemeyer@mastodon.social @brauner@mastodon.social @zbyszek@fosstodon.org @pothos@fosstodon.org @michaelvogt@mastodon.social @davidstrauss@mastodon.social @rodrigo_rata@mastodon.social @jrocha@floss.social) at @amutable@mastodon.social, building the future of Linux systems with a foundation of verifiable integrity and determinism. I can't wait for you all to see what we're working on!

It is proven! I am cyphar on Keybase: https://keybase.io/cyphar/sigchain#2526fdc1d7e6178b9e4eeb3609db977a1b52ab7e7067035a215191bd97fce1cb0f

@sir@cmpwn.com "Please reward your delivery driver with a tip." That's very strange to me, we don't have a tip culture in Australia. Isn't that sort of blatantly making clear that they don't pay their drivers humanely?

@sir@cmpwn.com What does that have to do with +x on directories to get their contents?

@sir@cmpwn.com Like getdents(2)? I assume it's because it's sort of like an implied stat(2) but with linux_dirent rather than stat_t. Sure, you only leak the d_type but it might be important.

@sir@cmpwn.com While it is nice, they usually don't go through the distribution's approval process for mirrors. I think if they're just acting as *normal* mirrors it's fine, but the problem is that they aren't official mirrors and they make themselves the default.

Does anyone know of research into heuristically detecting compression bombs, using something like entropy profiles or compression ratios?

I *know* you're an exploit goddammit! Why is it not working inside a container? It works under unshare...

#umoci 0.3.0 released with OCI v1.0 support. Exciting times. #skopeo 0.1.23 also has come out with support for v1.0 as well. https://github.com/openSUSE/umoci/releases/tag/v0.3.0

@sir@cmpwn.com "Welcome to Reddit!" 😆