The “tank” has an immobile or mostly immobile turret, depending on the particular design of this piece of battlefield ingenuity. Units appear to be making these modifications at the frontline to improve survivability against FPV drones but there isn’t a standard package.

Really? I think you should punch Nazis in the fucking face.

The same day as they announce they’re not doing the system shock native client eh?

Contrast that with CLI where if you forgot or don’t know any command there is little help or indicator of what’s available and what can be done without external help.

man would like to have words with your strawman.

No, this is egregious, even for Dan. Don’t feel bad. I called him out on the forums/article comments.

I’m looking at bringing Dillo back into Gentoo atm. I had to read 15k lines of code, and that’s just what’s different since the last release…

I’m a huge proponent of Gentoo Linux as a learning experience. It’s a great way to learn how the components of a system work together and the distro enables an amazing amount of configurability for your system.

Even following a handbook install in a VM can be a good experience if you’re interested.

I may be a touch biased, but I feel like you might enjoy trying Gentoo one day, especially with the recent official binary package host.

I once spent a month automating the production of repositories for each kernel version supported on our HPC and rested every step exhaustively in isolation.

When I was satisfied I ran it with root permissions and hosed the VMs it was running on because a recursive chmod evaluated to /.

Oops.

Pipewire is great .

Write out syslogs to disk or better yet mirror to grayling or something, there might be valuable information right before the reboot.

I’ve also had weirdness where the CPU/iGPU was just faulty and the IME would halt the system. That took weeks to diagnose.

Definitely reach out to support!

You don’t have to!

If a downstream distribution wants your software they will build and package it themselves and maintain that infrastructure.

You could provide an example rpm spec (etc) to make their lives easier but it’s not on you to provide a binary package that works everywhere; you released the source code so any given user / distro can compile it for themselves.

Just make sure that your build infrastructure and docs are up to speed, and ideally implement some CI/CD and testing to catch any breaking changes.

You don’t think that by just putting the name of a license in some prose that LLM companies will ignore it and not use it in training data, right?

They most certainly will not. For all they know you’re just helpfully linking to the creative commons.

I don’t think your plan is workable, but if you’re going to persist at least add some boilerplate: “the above content of this comment is licensed under…”

Could you elaborate?

TL;DR don’t worry (for now) - it only impacts rpm and deb builds and impacted releases only really made it into OpenSuSe tumbleweed - if you’re running bleeding edge maybe you need to worry a little.

A laymans explanation about what happens is that the malicious package uses an indirect linkage (via systemd) to openssh and overrides a crypto function which either:

• allows access to the system to a particular key
• allows remote code execution with a particular key

Or both!

I have secondhand info that privately the reverse engineering is more advanced, but nobody wants to lead with bad info.

As for what you should do? Unless you’re running an rpm or deb based distro and you have version 5.6.0 or 5.6.1 of xz-utils installed, not much. If you are, well, that comes down to your threat model and paranoia level: either upgrade (downgrade) the package to a non-vulnerable version or dust off and nuke the site from orbit; it’s the only way to be sure.

there is no good answer

There is clearly a worst option.

Sanctions. Russia is still short critical materiel.

I use Traefik for all of my containerised services. It’s fantastic.

I’m sorry, but no. PluralKit only really impacts a tiny minority of the userbase to begin with. It isn’t enough to cause people outside that group to choose the platform, nor is it enough for people outside of that minority to avoid moving to whatever the next big thing is.

At least weekly.