I want to be more active here. How is everyone? It's Either this or mastodon!

wearewaylandnow.com

March stats #running

Check your systems for #xz#cve20243094github.com/robertdebock...

Downhill #running#trailrunningmastodon.social/@eyenx/11220...

Fucking wild mastodon.social/@AndresFreun...

Yeah ok this was 100% found by sheer luck. mastodon.social/@AndresFreun...bsky.app/profile/look...

I'm watching some folks reverse engineer the xz backdoor, sharing some *preliminary* analysis with permission. The hooked RSA_public_decrypt verifies a signature on the server's host key by a fixed Ed448 key, and then passes a payload to system(). It's RCE, not auth bypass, and gated/unreplayable.

Hmmm

y'know, i used IRC for 20+ years and it never made me wait 5 minutes to "download an update."