Alt account of @Badabinski

Just a sweaty nerd interested in software, home automation, emotional issues, and polite discourse about all of the above.

  • 0 Posts
  • 70 Comments
Joined 1 year ago
cake
Cake day: June 9th, 2024

help-circle






  • ngl, I do wish it was still used. I remember being like, 4 years old and trying to write a “thank you” card to my grandmother. I spent what feel like an hour going through the alphabet, trying to find the letter that makes the “th” sound. Apparently my mom found me laying on the floor sobbing and repeating the alphabet, which is both funny and sad lol

    Many years have passed, but a tiny grain of resentment at the English language remains. The thorn would have prevented that.














  • I dunno, I’d slow your roll on that. Hanlon’s razor came to notoriety in the field of computer science for a reason. I’ve done software dev professionally for over ten years now and you wouldn’t believe the stupid shit I’ve seen people write. The only thing that sucks more than a computer is the human writing software for it.

    For those unfamiliar, here’s Hanlon’s razor:

    Never attribute to malice that which is adequately explained by stupidity.

    EDIT: After a quick look at the CVEs, this definitely sounds like a big ol’ fuckup. It sounds like there might be some unsafe defaults in polkit as well?

    EDIT: Here’s the report from the actual researchers which is MUCH more cogent than OP’s article: https://www.openwall.com/lists/oss-security/2025/06/17/4

    It’s chaining two separate oopsies together. This overview on GitHub also provides more details about the libblockdev side of things: https://github.com/advisories/GHSA-mpgj-hch9-5rvx

    Specifically, this section:

    However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.

    That really doesn’t sound like something intentional to me. That sounds like a HUGE oopsy-woopsy fucky-wucky, to get technical about it.