Hacker News on Saturday, 30 March 2024

XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."(bsky.app)

1207 points by junon 2 years ago | 743 comments

Bluesky post by Filippo Valsorda sharing preliminary analysis that the xz backdoor enables gated, unreplayable RCE via a hooked RSA_public_decrypt verifying an Ed448 signature.

Xz: Can you spot the single character that disabled Linux landlock?(git.tukaani.org)

478 points by dhx 2 years ago | 268 comments

A gitweb diff of xz's CMakeLists.txt adding a Landlock sandbox feature test, which contains a stray '.' character that silently breaks the check and disables Landlock.

Xz: A microcosm of the interactions in open source projects(robmensching.com)

468 points by transpute 2 years ago | 267 comments

Rob Mensching blog post, adapted from a Twitter thread, reflecting on the xz/liblzma backdoor as a microcosm of interactions in open source projects.

IrfanView(irfanview.com)

446 points by omnibrain 2 years ago | 268 comments

Homepage of IrfanView, a fast, compact freeware graphic viewer for Windows, offering downloads, plugins, skins, and support information.

Xz/liblzma: Bash-stage Obfuscation Explained(gynvael.coldwind.pl)

439 points by ecliptik 2 years ago | 90 comments

Gynvael Coldwind's blog post explaining the obfuscation techniques used in the bash stages of the xz/liblzma backdoor that affected OpenSSH.

Roll-Invert-Unroll: An easier way to replace a duvet cover(danverbraganza.com)

435 points by nvader 2 years ago | 243 comments

A personal blog post by Danver Braganza describing the "roll-invert-unroll" technique for putting a cover onto a duvet more easily.

Garbage collection for systems programmers (2023)(bitbashing.io)

364 points by ingve 2 years ago | 202 comments

A 2023 Bit Bashing blog post arguing that garbage collection techniques, such as read-copy-update, are useful and already common in systems programming.

Someone has been attempting to DDoS us for weeks and we do nothing(tableplus.com)

283 points by spacebuffer 2 years ago | 159 comments

Running OCR against PDFs and images directly in the browser(simonwillison.net)

248 points by simonw 2 years ago | 43 comments

About the Tailscale.com outage on March 7, 2024(tailscale.com)

236 points by tatersolid 2 years ago | 118 comments

Prolog language for PostgreSQL proof of concept(github.com)

199 points by triska 2 years ago | 74 comments

Paint.net(getpaint.net)

198 points by lazyjeff 2 years ago | 92 comments

Notes on El Salvador(mattlakeman.org)

195 points by yorwba 2 years ago | 136 comments

Git as a debugging tool(lucasoshiro.github.io)

175 points by lucasoshiro 2 years ago | 53 comments

Mamba Explained(thegradient.pub)

165 points by andreyk 2 years ago | 42 comments

Toni Morrison's Rejection Letters(lareviewofbooks.org)

161 points by blegh 2 years ago | 68 comments

Veloren, an open source game, release 0.16(veloren.net)

155 points by AngelOnFira 2 years ago | 13 comments

Why Has Figma Reinvented the Wheel with PostgreSQL?(medium.com)

150 points by magden 2 years ago | 66 comments

The Mongolian Meta(docs.google.com)

143 points by deletionist 2 years ago | 38 comments

An unusual 7400-series chip implemented with a gate array(righto.com)

140 points by codezero 2 years ago | 30 comments

How GitHub replaced SourceForge as the dominant code hosting platform(graphite.dev)

138 points by fosterfriends 2 years ago | 120 comments

Kolmogorov Complexity and Compression Distance (2023)(smunshi.net)

135 points by rgbimbochamp 2 years ago | 82 comments

Full-scale file system acceleration on GPU [pdf](dl.gi.de)

134 points by west0n 2 years ago | 39 comments

When will the eclipse happen? A multimillennium tale of computation(writings.stephenwolfram.com)

129 points by nsoonhui 2 years ago | 23 comments

The jobs being replaced by AI – an analysis of 5M freelancing jobs(bloomberry.com)

127 points by mooreds 2 years ago | 70 comments

Debian on xz-utils: revert to version that does not contain changes by bad actor(bugs.debian.org)

126 points by Timshel 2 years ago | 109 comments

Iowa fertilizer spill kills nearly all fish across 60-mile stretch of rivers(nytimes.com)

125 points by campuscodi 2 years ago | 11 comments

Mathematician Who Made Sense of the Universe's Randomness Wins Math's Top Prize(smithsonianmag.com)

115 points by wilshiredetroit 2 years ago | 54 comments

Significant performance and correctness improvements to the kernel(redox-os.org)

113 points by akyuu 2 years ago | 12 comments

DeWitt and Stonebraker's "MapReduce: A major step backwards" (2009)(craig-henderson.blogspot.com)

112 points by mooreds 2 years ago | 92 comments

The Canadian government's plan to plant two billion trees(cbc.ca)

104 points by voisin 2 years ago | 85 comments

Some notes on Firefox’s media autoplay settings in practice as of Firefox 124(utcc.utoronto.ca)

103 points by ingve 2 years ago | 88 comments

Proteins let cells remember how well their last division went(arstechnica.com)

98 points by donatzsky 2 years ago | 9 comments

Models all the way down(knowingmachines.org)

98 points by jdkee 2 years ago | 25 comments

The Ken Thompson Hack(wiki.c2.com)

98 points by stephc_int13 2 years ago | 27 comments

Linear Algebra of Types (2019)(philipzucker.com)

94 points by g0xA52A2A 2 years ago | 7 comments

Reported Supply Chain Compromise Affecting XZ Utils Data Compression Library(cisa.gov)

94 points by taubek 2 years ago | 12 comments

The roller ship was not an effective way to cross the high seas(hackaday.com)

89 points by Stratoscope 2 years ago | 25 comments

Xz format inadequate for long-term archiving (2022-02-02)(nongnu.org)

89 points by oriettaxx 2 years ago | 18 comments

US appeals court kills ban on plastic containers contaminated with PFAS(theguardian.com)

83 points by mdp2021 2 years ago | 54 comments

How well can LLMs write COBOL?(bloop.ai)

83 points by ggordonhall 2 years ago | 56 comments

Novo Nordisk facing pressure as study finds $1k drug can be made for $5(fortune.com)

81 points by paulpauper 2 years ago | 111 comments

From scratch OpenGL and shaders with raw Xlib(hereket.com)

81 points by libcheet 2 years ago | 39 comments

Popular songs are simpler and more repetitive than they used to be(science.org)

80 points by nradov 2 years ago | 68 comments

Why Ireland's housing bubble burst(worksinprogress.co)

78 points by PaulHoule 2 years ago | 70 comments

Return-to-Office Mandates: How to Lose Your Best Performers(sloanreview.mit.edu)

75 points by geox 2 years ago | 56 comments

The Set-Up-to-Fail Syndrome (1998)(hbr.org)

75 points by maximilianburke 2 years ago | 31 comments

Tom's Essay (2008)(archive.nytimes.com)

75 points by neom 2 years ago | 10 comments

NetBSD 10.0 Released(netbsd.org)

69 points by schmonz 2 years ago | 20 comments

Jails banned visits in "quid pro quo" with prison phone companies, lawsuits say(arstechnica.com)

67 points by LinuxBender 2 years ago | 14 comments

GitHub Disabled the Xz Repo(pony.social)

66 points by luu 2 years ago | 47 comments

20 years ago Far Cry was released(en.wikipedia.org)

64 points by doener 2 years ago | 52 comments

Ask HN: Anybody Using Htmx on the Job?

63 points by Dansvidania 2 years ago | 33 comments

Bpfman: An eBPF Manager(bpfman.io)

63 points by signa11 2 years ago | 2 comments

Type Inference Was a Mistake(borretti.me)

61 points by anatoly 2 years ago | 77 comments

Personal 'invisibility shield' goes on sale, starting under $70(newatlas.com)

57 points by Brajeshwar 2 years ago | 38 comments

White space killed an enterprise app (2019)(uxdesign.cc)

56 points by tosh 2 years ago | 41 comments

British water company dumps sewage, claims "no right to swim in the sea"(inews.co.uk)

54 points by hilux 2 years ago | 28 comments

Tiny orchid flowers pollinated by tiny flies(phys.org)

52 points by wglb 2 years ago | 7 comments

App scans your pile of Lego and uses ML to suggest projects(boingboing.net)

51 points by skanderbm 2 years ago | 22 comments