Tootfinder

@servelan@newsie.social
2024-04-05 00:59:08

Baltimore shipping channel to open by end of May - National Zero
https://nationalzero.com/2024/04/04/baltimore-shipping-channel-to-open-by-end-of-may/

Baltimore shipping channel to open by end of May - National Zero
The US Army Corps of Engineers released a plan to clear the shipping channel blocked by the collapse of the Francis Scott Key Bridge by the end of May, a schedule that would require the reloading of hundreds of containers that remain on the MV Dali onto barges and then removing the wreckage, the Baltimore Banner reports. “We are working quickly and safely to clear the channel and restore full service at this port that is so vital to the nation. At the same time, we continue to keep faith with…

@BBC2MusicBot@mastodonapp.uk
2024-04-05 23:31:05

🔊 #NowPlaying on BBCRadio2's #RomeshRanganathan:ForTheLoveOfHipHop
Westside Connection:
🎵 Gangsta Nation (feat. Nate Dogg)
#WestsideConnection
https://open.spotify.com/track/5riuy3KfL7XIRHKCZYRL7F
https://djsaywhaat.bandcamp.com/track/westside-connection-gangsta-nation-8bars

@servelan@newsie.social
2024-04-05 01:03:44

Everybody complaining about Biden should consider that we are pressuring a sovereign nation to change how it treats its ersatz citizenry when we have little to no standing to do so - just like not having standing in court cases.
Israel agrees to increase humanitarian aid delivery to Gaza under U.S. pressure
htt…

Israel agrees to increase humanitarian aid delivery to Gaza under U.S. pressure
The steps include opening Erez crossing in northern Gaza and using the Port of Ashdod as a hub for aid delivery.

@radioeinsmusicbot@mastodonapp.uk
2024-03-04 06:16:58

🔊 Auf radioeins läuft...
Nation of Language:
🎵 Spare Me The Decision
#NowPlaying #NationofLanguage
https://open.spotify.com/track/055hvmkl2KJAg0o3wMJXrF
https://nationoflanguage.bandcamp.com/track/spare-me-the-decision

@zachleat@zachleat.com
2024-04-02 14:04:25

My takeaway from the #xz backdoor is that I will now treat any and all “is this still being maintained”-esque messages in open source repositories with the hostility merited a nation-state supply-chain attack on open source as a concept.

@tenderlove@mastodon.social
2024-03-30 20:59:36

"open source needs more funding!"
*nation state pays for backdoor*
"not like that!"

@kexpmusicbot@mastodonapp.uk
2024-05-05 09:01:31

🔊 #NowPlaying on #KEXP's #VarietyMix
Terminal Nation:
🎵 Echoes of the Devil’s Den
#TerminalNation #newRelease 🆕 album
#Bandcamp
🎶 #Show #playlist 👇
#KEXP #playlist 👇
https://open.spotify.com/playlist/6VNALrOa3gWbk794YuIrwg

@matzeschmidt@masto.ai
2024-03-03 10:34:29

Total strangers or "bullied off the network". #Mastodon turns out to be no island of happiness. Everyones network costs a sight of a public space or forum that is disparate and ensemble. The great welcoming of this part of the Fediverse seems to rely on "internal knowledge that’s not really written down anywhere". Practise and text, law?, are informal in terms of open reading. Don&…

Content Nation Backlash Highlights Mastodon's Toxicity
It turns out, if people in an online community really don't like what you're doing, they can turn to harassment, threats, or worse to try to shut you down.

@tenderlove@mastodon.social
2024-03-30 20:59:36

"open source needs more funding!"
*nation state pays for backdoor*
"not like that!"

@KingShawn@mastodon.social
2024-04-26 17:34:17

Need a good news story? This little orca is free and back out in to the open ocean! 🥰
https://press.coop/@CBCNews/112338532034535300

CBC News :press: (@CBCNews@press.coop)
Orca calf swims out of lagoon after being trapped for a month The Ehattesaht First Nation says a killer whale calf that had been trapped in a remote Vancouver Island lagoon for more than a month is now free after it swam out on its own early Friday morning. #press https://www.cbc.ca/news/canada/british-columbia/killer-whale-orca-calf-lagoon-vancouver-island-bc-free-1.7186129?cmp=rss&utm_source=press.coop

@radioeinsmusicbot@mastodonapp.uk
2024-02-26 17:07:14

🔊 Auf radioeins läuft...
The White Stripes:
🎵 Seven Nation Army
#NowPlaying #TheWhiteStripes
https://open.spotify.com/track/3dPQuX8Gs42Y7b454ybpMR
https://knsti.bandcamp.com/track/the-white-stripes-seven-nation-army-knsti-bootleg

@fgraver@hcommons.social
2024-03-26 18:02:04

Who Owns Donald Trump? | The Nation https://www.thenation.com/article/politics/donald-trump-debts-corruption/

Who Owns Donald Trump?
The former president’s financial troubles open up rich opportunities for political attack.

@BBC1MusicBot@mastodonapp.uk
2024-05-03 06:35:20

🔊 #NowPlaying on BBCRadio1's #Breakfast with #GregJames
The White Stripes:
🎵 Seven Nation Army
#BBCR1 #TheWhiteStripes
https://open.spotify.com/track/3dPQuX8Gs42Y7b454ybpMR
https://knsti.bandcamp.com/track/the-white-stripes-seven-nation-army-knsti-bootleg

@kcarruthers@mastodon.social
2024-04-16 08:52:48

Glencore’s Hail Creek open cut coal mine released more methane pollution in 16 days than the company reported over an entire year.
https://www.thenewdaily.com.au/news/national/2024/04/16/coal-gas-giants-notice-methane-plume…

Coal, gas giants on notice over methane plume
A report has found a coal mine released as much methane as eight million cows.

@radioeinsmusicbot@mastodonapp.uk
2024-04-29 03:27:40

🔊 Auf radioeins läuft...
Nation of Language:
🎵 Spare Me The Decision
#NowPlaying #NationofLanguage
https://open.spotify.com/track/055hvmkl2KJAg0o3wMJXrF
https://nationoflanguage.bandcamp.com/track/spare-me-the-decision

@cdarwin@c.im
2024-03-17 20:10:14

The unholy triad of 2024: Christian nationalism, Jan. 6 and Donald Trump
Trump is supported by a Christian nationalist movement that had strong ties to the Jan. 6 perpetrators
— the jailed ones he calls “hostages,” whom he will free if elected.
Christian Nationalism is
the belief that America is a Christian nation whose divine destiny must be preserved, even if that entails open rebellion against lawful constitutional authority.
This belief flies in the face o…

The unholy triad of 2024: Christian nationalism, Jan. 6 and Donald Trump
Primarily among Trump’s white evangelical supporters, Christian Nationalism has experienced mainstream growth and acceptability in recent years.

@kexpmusicbot@mastodonapp.uk
2024-02-23 01:18:04

🔊 #NowPlaying on KEXP's #DriveTime
Nation of Language:
🎵 Spare Me the Decision
#NationofLanguage
https://open.spotify.com/track/055hvmkl2KJAg0o3wMJXrF
https://nationoflanguage.bandcamp.com/track/spare-me-the-decision

@radioeinsmusicbot@mastodonapp.uk
2024-02-27 18:32:19

🔊 Auf radioeins läuft...
Nation of Language:
🎵 Spare Me The Decision
#NowPlaying #NationofLanguage
https://open.spotify.com/track/055hvmkl2KJAg0o3wMJXrF
https://nationoflanguage.bandcamp.com/track/spare-me-the-decision

@BBC1MusicBot@mastodonapp.uk
2024-05-03 06:35:20

🔊 #NowPlaying on BBCRadio1's #Breakfast with #GregJames
The White Stripes:
🎵 Seven Nation Army
#BBCR1 #TheWhiteStripes
https://open.spotify.com/track/3dPQuX8Gs42Y7b454ybpMR
https://knsti.bandcamp.com/track/the-white-stripes-seven-nation-army-knsti-bootleg

@kexpmusicbot@mastodonapp.uk
2024-02-23 01:18:04

🔊 #NowPlaying on KEXP's #DriveTime
Nation of Language:
🎵 Spare Me the Decision
#NationofLanguage
https://open.spotify.com/track/055hvmkl2KJAg0o3wMJXrF
https://nationoflanguage.bandcamp.com/track/spare-me-the-decision

@radioeinsmusicbot@mastodonapp.uk
2024-02-27 05:07:15

🔊 Auf radioeins läuft...
Nation Of Language:
🎵 On Divison St
#NowPlaying #NationOfLanguage
https://open.spotify.com/track/353uoaeULMS88FV1HXETXo
https://nationoflanguage.bandcamp.com/track/on-division-st

@rene_mobile@infosec.exchange
2024-03-30 21:58:50

My current take on the #xz situation, not having read the actual source backdoor commits yet (thanks a lot #Github for hiding the evidence at this point...) besides reading what others have written about it (cf. #rustlang for such central library dependencies would maybe (really big maybe) have made it a bit harder to push a backdoor like this because - if and only if the safety features are used idiomatically in an open source project - reasonably looking code is (a bit?) more limited in the sneaky behavior it could include. We should still very much use those languages over C/C for infrastructure code because the much larger class of unintentional bugs is significantly mitigated, but I believe (without data to back it up) that even such "bugdoor" type changes will be harder to execute. However, given the sophistication in this case, it may not have helped at all. The attacker(s) have shown to be clever enough.
6. Sandboxing library code may have helped - as the attacker(s) explicitly disabled e.g. landlock, that might already have had some impact. We should create better tooling to make it much easier to link to infrastructure libraries in a sandboxed way (although that will have performance implications in many cases).
7. Automatic reproducible builds verification would have mitigated this particular vector of backdoor distribution, and the Debian team seems to be using the reproducibility advances of the last decade to verify/rebuild the build servers. We should build library and infrastructure code in a fully reproducible manner *and* automatically verify it, e.g. with added transparency logs for both source and binary artefacts. In general, it does however not prevent this kind of supply chain attack that directly targets source code at the "leaf" projects in Git commits.
8. Verifying the real-life identity of contributors to open source projects is hard and a difficult trade-off. Something similar to the #Debian #OpenPGP #web-of-trust would potentially have mitigated this style of attack somewhat, but with a different trade-off. We might have to think much harder about trust in individual accounts, and for some projects requiring a link to a real-world country-issued ID document may be the right balance (for others it wouldn't work). That is neither an easy nor a quick path, though. Also note that sophisticated nation state attackers will probably not have a problem procuring "good" fake IDs. It might still raise the bar, though.
9. What happened here seems clearly criminal - at least under my IANAL naive understanding of EU criminal law. There was clear intent to cause harm, and that makes the specific method less important. The legal system should also be able to help in mitigating supply chain attacks; not in preventing them, but in making them more costly if attackers can be tracked down (this is difficult in itself, see point 8) and face risk of punishment after the fact.
H/T @… @… @… @… @…

@radioeinsmusicbot@mastodonapp.uk
2024-02-25 11:15:10

🔊 Auf radioeins läuft...
Nation of Language:
🎵 Spare Me The Decision
#NowPlaying #NationofLanguage
https://open.spotify.com/track/055hvmkl2KJAg0o3wMJXrF
https://nationoflanguage.bandcamp.com/track/spare-me-the-decision

@kexpmusicbot@mastodonapp.uk
2024-04-28 23:25:41

🔊 #NowPlaying on KEXP's #VarietyMix
The White Stripes:
🎵 Seven Nation Army
#TheWhiteStripes
#Bandcamp

@rene_mobile@infosec.exchange
2024-03-30 21:58:50

My current take on the #xz situation, not having read the actual source backdoor commits yet (thanks a lot #Github for hiding the evidence at this point...) besides reading what others have written about it (cf. #rustlang for such central library dependencies would maybe (really big maybe) have made it a bit harder to push a backdoor like this because - if and only if the safety features are used idiomatically in an open source project - reasonably looking code is (a bit?) more limited in the sneaky behavior it could include. We should still very much use those languages over C/C for infrastructure code because the much larger class of unintentional bugs is significantly mitigated, but I believe (without data to back it up) that even such "bugdoor" type changes will be harder to execute. However, given the sophistication in this case, it may not have helped at all. The attacker(s) have shown to be clever enough.
6. Sandboxing library code may have helped - as the attacker(s) explicitly disabled e.g. landlock, that might already have had some impact. We should create better tooling to make it much easier to link to infrastructure libraries in a sandboxed way (although that will have performance implications in many cases).
7. Automatic reproducible builds verification would have mitigated this particular vector of backdoor distribution, and the Debian team seems to be using the reproducibility advances of the last decade to verify/rebuild the build servers. We should build library and infrastructure code in a fully reproducible manner *and* automatically verify it, e.g. with added transparency logs for both source and binary artefacts. In general, it does however not prevent this kind of supply chain attack that directly targets source code at the "leaf" projects in Git commits.
8. Verifying the real-life identity of contributors to open source projects is hard and a difficult trade-off. Something similar to the #Debian #OpenPGP #web-of-trust would potentially have mitigated this style of attack somewhat, but with a different trade-off. We might have to think much harder about trust in individual accounts, and for some projects requiring a link to a real-world country-issued ID document may be the right balance (for others it wouldn't work). That is neither an easy nor a quick path, though. Also note that sophisticated nation state attackers will probably not have a problem procuring "good" fake IDs. It might still raise the bar, though.
9. What happened here seems clearly criminal - at least under my IANAL naive understanding of EU criminal law. There was clear intent to cause harm, and that makes the specific method less important. The legal system should also be able to help in mitigating supply chain attacks; not in preventing them, but in making them more costly if attackers can be tracked down (this is difficult in itself, see point 8) and face risk of punishment after the fact.
H/T @… @… @… @… @…