• 3 Posts
  • 210 Comments
Joined 1 year ago
cake
Cake day: June 6th, 2023

help-circle
  • Our physics department used KDE managed over network shares implemented by one professor in his free time, in complete defiance of the rest of the university which used windows.

    Even now they’re still holding out strong, whilst Microsoft eats the rest of the university alive.
    (sidenote: I get it, tech support in Linux is vritually non-existent, whilst tech-support in Windows is everywhere)




  • The questionable commit:

        {
          // Add the first line of localized text...
          cupsFilePrintf(fp, "*%s.%s %s/", lang->language, ppd_option, ppd_choice);
          while (*text && *text != '\n')
          {
            // Escape ":" and "<"...
            if (*text == ':' || *text == '<')
              cupsFilePrintf(fp, "<%02X>", *text);
            else
              cupsFilePutChar(fp, *text);
            text ++;
          }
          cupsFilePuts(fp, ": \"\"\n");
        }
    

    Can someone explain to me how this allows arbitrary code execution? As far as I can see, all it does iterate through a string and markup some special characters.

    Edit: Okay, after reading the blog post, and this fantastic bug report, it sounds like to print to a CUPS server, you send it a message on port 631 using an IPP (some print protocol) server. CUPS then requests attributes of the IPP server, one of which being the print filter command to run (“Foomatic-rip”) to use to convert a PS or PDF into native print code. By requesting attributes, an exploit involving string escaping through the use of unexpected spaces or quotes can override the Foomatic print command. Arbitrary text can be supplanted, which will then be executed by the CUPS server.





  • Yup, or even a simple notify-send. Trying to work out which environment variables are needed to get the damn thing to focus on the window in question which may or may not be an X11 window within Wayland. The magic formula I’ve learned so far:

    DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$(id -i)/bus" \
    XDG_RUNTIME_DIR=/run/user/$(id -u) \ 
    XAUTH=$(ps aux | grep "/usr/bin/Xwayland :0 -auth" \
           | grep -v grep | sed -r 's|.*-auth ([^ ]*).*$|\1|') \
    DISPLAY=:0 \
    XAUTHORITY=$XAUTH  <finally your command here>
    

    (oh and sometimes you might need to preface that all with a sudo, oh and there’s no guarantee that the Display is at :0, even if no other display is in use). Eaaazyyy peaaaazyyy

    I will say that wtype is the one wayland automation tool that does not need any preamble. It just works out of the box, genuinely good engineering by the developers on that project.




    • Rush Hour: The Lion King

      • Carter and Lee take on a nefarious plot to overthrow the king in the African savannah, ultimately foiling Scar’s plot and ensuring Simba inherits the throne, whilst working undercover in the Hyena underworld.
    • Kung Pow: LotR

      • The Fellowship of the Fist must face off against Lord Sauron, but first Frodo must train under True Master Gandalf to achieve his destiny.
    • Harry: Potter

      • Detective Harry Calahan must infiltrate a secluded military school in the Scottish countryside as the new DADA teacher, in order to take down an organisation known only as “Dumbledore’s Army” led by a single battle-scarred teen known only as The Potter.

    Top-tier recommendations, good sir





  • I used to have lieer’s gmi (read: mbsync with gmail tag syncing) paired with notmuch. It’s good when it works, but it’s annoying to need a service in the background.

    I used to use Gnus, but Gnus is sometimes weirds out if your tag filters are too complex for it



  • I love it, but the configuration is messy. Many packages are out of date, but the Scheme syntax makes it easy to update them and build them on your system.

    Problem is, getting these updates merged with the upstream never happens generally speaking (I have several open patches), so you end up having two working trees in your local Guix repo, and heaven forbid you run guix pull on the wrong branch.





  • Keyboard Phones

    Is there any keyboard phone out there with some decent specs?

    The F(x) Tec Pro1x looks really promising, but I’ve seen many youtube video reviews relating to its various hardware issues (intermittent connectivity, speakers clipping, others I cant remember). Can anyone with one tell me if it’s worth it? I just want something I can type my idle thoughts into, sync my org-mode notebooks, and type on the web.

    The Astro Slide 5G looks really good, but I want a phone I hold and type instead of a keyboard I need to place down. Also the price is astronomical.

    Ideally I would just shove more RAM and CPUs on my Nokia N900 and be happy as a clam, but that world doesn’t exist.

    Also: Anyone know of any phones with a good hardware keyboard case add on? A shell with a keyboard that hooks in via bluetooth or USB?

    Regular Phones

    On the non-keyboard front, I’m looking for a device that has a decent Lineage community around it, but also that the hardware is open enough to be mainlined by PostMarketOS.

    I’m currently putting together a table of the various PmOS phones, their hardware specs, their PmOS compatibility, and the Lineage images they support.

    But in the meantime, if I can get some recommendations here too. Nothing fancy: over 4 cores, 2GB ram, and can slide easily into a pocket.

    I like the idea of the SHIFT6mq, due to its upgradability, but want to hear from any happy users before I do