Home | Notifications | New Note | Local | Federated | Search | Logout
Federated Timeline
:hosimiya_mion::star_stroke:@hos1miya@misskey.0sakana.xyz (2026-10-21 19:58:23)
4つどころじゃなかった
---Attachments---
image: https://misskey.0sakana.xyz/files/webpublic-efd79051-074f-4730-ab98-a338f63fbae7
:hosimiya_mion::star_stroke:@hos1miya@misskey.0sakana.xyz boosted:
@yume_yu@misskey.dev (2026-10-21 19:51:50)
Cloudflareは10月21日、有料プラン向けのマネージドルールセットと、無料プランでも使えるフリールールセットに、WAF（不正なアクセスを防ぐ仕組み）の緊急ルールを追加しました。異常なリクエストのパターンを検知するためのもので、どちらの一覧にも「Anomalous Execution」（異常な実行）という名前のルールが4つ載っています。ただし、PHPの脆弱性への対応だとは書かれていません。
https://markenote.jp/article/5004
dave@dthompson@toot.cat boosted:
@mgorny@social.treehouse.systems (2026-10-21 11:28:56)
It's kinda funny that the certificate compromise comes just after another round of upstreams bashing at distro packaging.
Let me get this straight for the people in the back. In a perfect world, you'd just upgrade a single package on your system and be good. Unfortunately, we're far removed from even a reasonably good world.
Pretty much everything that matters in #Python uses certifi. dev-python/certifi in #Gentoo is a fork that uses system certs, so our system install is good. But in every virtual environment (venv, conda, etc.), you need to upgrade certifi.
certifi is also bundled in a bunch of packages, including pip. dev-python/pip in Gentoo has certifi unbundled, but you need to upgrade pip in your virtual environments (using vulnerable pip!). On Gentoo systems, you also need to upgrade dev-python/ensurepip-pip, which is the upstream wheel which we couldn't figure out how to unbundle.
pip is also bundled in Python to bootstrap venvs. In Gentoo, we're configuring Python to use our system dev-python/ensurepip-pip package, so as soon as you upgrade it, you're good. But where this isn't the case, you need to wait for new Python releases and upgrade, because otherwise venvs will start with vulnerable pip. On the plus side, you can remember to upgrade it after creating a new venv.
Lock files are particularly popular in the Python world, and a dependency cooldown is the new fad. You will need to update certifi in them, and exclude it from dependency cooldown.
Many #RustLang packages (think uv) also use a bundled certificate store. All these packages need a lockfile update and rebuilding, meaning downstream patching or new upstream release. So yes, everyone (including Gentoo users, because Rust doesn't really support dynamic linking, great design for #security) need to update uv, and possibly wait to discover more random Rust packages that are vulnerable.
I'm also going to guess that all flatpakers are affected, all popular browsers, and possibly everyone else w
:petthex_javasparrow:しゅいろ:petthex_javasparrow:(本物)@syuilo@misskey.io (2026-10-21 19:56:38)
Misskeyはメンテしないで大丈夫なのかという疑問が散見されますが、Misskeyは今回の脆弱性の影響を受けるシステム(PHP)は使用していないので、大丈夫です:ba_kokona_facea_stamp:
ただし、もし今後Misskeyの使用しているシステムでも深刻な脆弱性が見つかるなどした場合は、サーバー運営者の判断で予防的なメンテナンスがされる可能性はあります:ba_kokona_facea_stamp:
Masanori Ogino 𓀁@omasanori@mstdn.maud.io (2026-10-21 19:56:04)
barebox 2026.10.0 🎉
https://github.com/barebox/barebox/releases/tag/v2026.10.0
ねこかぜ@nekokaze9625@mk.nekokaze.cc (2026-10-21 19:55:57)
世の中がセキュリティリスクをビジネスリスクとしてまともに認識してくれたシンギュラリティ的瞬間かもしれない
dave@dthompson@toot.cat boosted:
@ricci@discuss.systems (2026-10-21 06:17:41)
Ken Thompson, 1983: wouldn't it be awful if someone snuck secret code into a compiler that broke our ability to trust the output of a computer
AI Guy, 2026: wouldn't it be cool if we stuck something we know can't be trusted into every part of the computer
Coro@Coro@mstdn.maud.io (2026-10-21 19:54:25)
wikipedia も PHP だと思うけど止めてないな
NextGraph@nextgraph@fosstodon.org (2026-10-21 19:52:13)
FOSDEM'27 devroom for Local First has been approved 🎉
CfP will be published within few days.
Follow @localfirst for more details :)
Looking forward meeting you all again at upcoming FOSDEM!
:hosimiya_mion::star_stroke:@hos1miya@misskey.0sakana.xyz (2026-10-21 19:52:02)
2027年は全人類の個人情報がパブリックに！
Reply to @yume_yu@misskey.dev
まっつん (xˊ•.•ˋ)@yume_yu@misskey.dev (2026-10-21 19:51:50)
Cloudflareは10月21日、有料プラン向けのマネージドルールセットと、無料プランでも使えるフリールールセットに、WAF（不正なアクセスを防ぐ仕組み）の緊急ルールを追加しました。異常なリクエストのパターンを検知するためのもので、どちらの一覧にも「Anomalous Execution」（異常な実行）という名前のルールが4つ載っています。ただし、PHPの脆弱性への対応だとは書かれていません。
https://markenote.jp/article/5004
まっつん (xˊ•.•ˋ)@yume_yu@misskey.dev (2026-10-21 19:51:30)
んえ...cloudflareがちょっと守ってくれるマジ?
https://developers.cloudflare.com/changelog/post/2026-10-21-emergency-waf-release-free/
:hosimiya_mion::star_stroke:@hos1miya@misskey.0sakana.xyz (2026-10-21 19:51:25)
WordPressじゃん
RE: https://misskey.0sakana.xyz/notes/askrfvve3b
:hosimiya_mion::star_stroke:@hos1miya@misskey.0sakana.xyz (2026-10-21 19:50:09)
いいえ、ひかりです(不安定な停車駅を見ながら)
コシヌケ1040@ksnk@pawoo.net (2026-10-21 19:50:04)
お〜、なんだぁ？ 秋田やばいの？
:hosimiya_mion::star_stroke:@hos1miya@misskey.0sakana.xyz boosted:
@Akasha@voskey.icalo.net (2026-10-21 19:47:37)
絵が上手くなったり、下手になったりする
こだまでしょうか
コシヌケ1040@ksnk@pawoo.net boosted:
@UN_NERV@unnerv.jp (2026-10-21 19:48:29)
【NHKニュース速報 19:48】
レベル５特別警報「氾濫」 秋田県
子吉川 最大級の警戒
#ニュース #NHKニュース速報
特務機関NERV@UN_NERV@unnerv.jp (2026-10-21 19:48:29)
【NHKニュース速報 19:48】
レベル５特別警報「氾濫」 秋田県
子吉川 最大級の警戒
#ニュース #NHKニュース速報
:hosimiya_mion::star_stroke:@hos1miya@misskey.0sakana.xyz (2026-10-21 19:47:49)
イラストAIとか音楽AIより余程LLMの方が害悪
向上向上向上向上向上向上向上向上向上向上向上向上向上@Akasha@voskey.icalo.net (2026-10-21 19:47:37)
絵が上手くなったり、下手になったりする
こだまでしょうか
:hosimiya_mion::star_stroke:@hos1miya@misskey.0sakana.xyz (2026-10-21 19:47:06)
LLMも結局人間に害しか及ばさないじゃん、はよ滅ぼせ
Phoronix@phoronix@masto.ai (2026-10-21 19:39:05)
Fwupd Working Toward Proper Android Integration
Google Chromebooks already have a mandate for nice Fwupd support with the Linux Vendor Firmware (LVFS) while now there is work on improving the Android integration for Fwupd/LVFS...
https://www.phoronix.com/news/Fwupd-To-Android-Integration
---Attachments---
image: https://s3.masto.ai/media_attachments/files/117/478/466/874/214/631/original/dfd3d79333b5fcdb.webp
川音リオ@KawaneRio@misskey.io (2026-10-21 19:29:44)
こんな画面初めて見た
---Attachments---
image: https://media.misskeyusercontent.com/io/df69857b-09cb-409d-b360-d0820fb6b4aa.webp
Coro@Coro@mstdn.maud.io boosted:
@orumin@mstdn.maud.io (2026-10-21 12:42:22)
インドの eMudhra が発行した中間証明書の秘密鍵が 0x04 で簡単に詐称されてしまっているインシデント、完全に xkcd 221 >>
xkcd: Random Number - https://xkcd.com/221/
Coro@Coro@mstdn.maud.io (2026-10-21 19:27:29)
???
---
> セキュリティ研究者のスコット・ヘルム氏は自身のブログで、鍵の1つは「4」、ほかに「56」「115」というものもあり、ノートPCで1秒もかからず全て復元できたと報告している。
認証局eMudhraの中間証明書、秘密鍵が「数ミリ秒」で復元可能な脆弱性 大手各社が緊急遮断 - ITmedia NEWS
https://www.itmedia.co.jp/news/article/2610/21/2000002444/
Reply to @Coro@mstdn.maud.io
Coro@Coro@mstdn.maud.io (2026-10-21 19:19:07)
Unitree のロボが車を持ち上げとる...
---
Unitree Introducing: H2-X Kung Fu Legend Guardian by unitreerobotics
https://youtu.be/Y3zb4o47yqA
Masanori Ogino 𓀁@omasanori@mstdn.maud.io boosted:
@ovoip@mi.shiromaru.work (2026-10-21 13:37:26)
#真夏日らしいので水着を再掲しようぜ
---Attachments---
image: https://mi-assets.shiromaru.work/drive/webpublic-3a4f740b-cc75-4774-a6d3-08c309aca05c.png
image: https://mi-assets.shiromaru.work/drive/webpublic-280942af-eacf-4b8e-9542-feebdc1c53b9.png
image: https://mi-assets.shiromaru.work/drive/20adb650-c353-4d55-bdd3-47c00f0746e7.webp
Masanori Ogino 𓀁@omasanori@mstdn.maud.io boosted:
@gamebokusan@misskey.io (2026-10-21 19:06:36)
10年の過去記事をさかのぼって、当時の物価を知ろう！ ー ゲムぼく。
https://gameboku.com/archives/26103303.html
10年前の何気ない記事もいま見るとびっくりすることが判明（本日の記事）
---Attachments---
image: https://media.misskeyusercontent.com/io/webpublic-2b4bfdec-08fc-4159-92b3-6fcf9136366b.webp
image: https://media.misskeyusercontent.com/io/webpublic-d3510b16-1d9f-4f1b-984c-14dc270b86dc.webp
image: https://media.misskeyusercontent.com/io/webpublic-81391a02-7645-4f26-a662-43c1cabdde7a.webp
image: https://media.misskeyusercontent.com/io/webpublic-d2dce1ef-736b-4bd2-8e74-71ff37016b2e.webp
Masanori Ogino 𓀁@omasanori@mstdn.maud.io boosted:
@ramen_nobil@misskey.io (2026-10-21 19:01:00)
けもみみ×水着はいいぞ
#真夏日らしいので水着を再掲しようぜ
---Attachments---
image: https://media.misskeyusercontent.com/io/eb8b43f5-9229-4640-91b9-4d569d176507.webp?sensitive=true
image: https://media.misskeyusercontent.com/io/2fdcb498-116f-4399-a8ab-31dad7af804b.webp?sensitive=true
image: https://media.misskeyusercontent.com/io/8bedb14d-0305-4d57-847f-8949c6bea122.webp?sensitive=true
Phoronix@phoronix@masto.ai (2026-10-21 19:09:04)
Meta Makes Improvements To Kernfs Scalability With Linux 7.4
Kernfs as the functions/frameworks used for creating pseudo file-systems on Linux like sysfs and configfs have seen some nice scalability work carried out by Meta. After Meta engineers discovered some system daemons getting stuck for minutes on their massive fleet of servers, they uncovered some scalability bottlenecks within Kernfs that now look to be resolved for Linux 7.4...
https://www.phoronix.com/news/Linux-7.4-Kernfs-Scalability
---Attachments---
image: https://s3.masto.ai/media_attachments/files/117/478/348/846/783/251/original/bab8fc966d1aa675.webp
Older Notes