| 19 Jul 2022 |
 j-k | I'm on the "OSS-SIRT SIG" call which is the "Open Source Software - Security Incident Response Team SIG"
I'm hoping there will eventually be an easy way for us to report "yeah this CVE is resolved in nixpkgs" rather than us having to create our own list 😅 | 13:46:06 |
| j-k | There's some work on "VINCE, the Vulnerability Information and Coordination Environment" which might help us do this reporting in the future
https://github.com/CERTCC/VINCE
https://www.kb.cert.org/vince/ | 13:46:57 |
 K900 | I feel like I'm reading a government document | 13:47:37 |
| j-k | yep, a lot of these calls are like that.
some of the calls also go off on weird paths re-inventing stuff nix already solves, except in ways that don't actually work/help | 13:49:19 |
| 24 Jul 2022 |
|  jkxyz joined the room. | 18:34:54 |
| jkxyz left the room. | 18:37:55 |
| 26 Jul 2022 |
|  tinybronca changed their display name from tinybronca to tailrec. | 14:38:49 |
| tinybronca changed their display name from tailrec to tinybronca. | 15:42:51 |
 Artturin | https://github.com/NixOS/nixpkgs/issues/182890 | 19:07:46 |
| 27 Jul 2022 |
 Sandro 🐧 | adding a scanner for that won't help to much because all of the patches we fetchpatch. | 14:11:41 |
| 28 Jul 2022 |
 hexa | I'm somewhat unavailable until Mid-August and won't be able to really take care of security issues. | 23:19:06 |
 Winter (she/her) | This PR switches a package (fxload) from the original sources from 2002 to a fork from 2013, which (apparently) contains fixes to make the change in this PR work. How do we feel about this? | 23:51:35 |
| 29 Jul 2022 |
 @andreas.schraegle:helsinki-systems.de | LGTM. replacing ancient abandoned software with slightly less ancient and also abandoned software is rarely an issue. Do you think the newer version is likely to contain any (security) issues that the older one didn't? | 00:45:10 |
| Winter (she/her) | don't think so | 01:03:47 |
| Winter (she/her) |
This is a branch from the fxload project, originally part of the linux-hotplug SourceForge project which seems to be abandoned. This branch incorporates the patch from Steven J. Magnani that adds support for Cypress FX3 USB 3.0 endpoint to the fxload utility. It has been tested on Ubuntu 12.04 with the FX3 development kit (part number CYUSB3KIT-001). Oddly, as of January 2013 Cypress doesn't include this utility with its (open source) Linux SDK but requires developers to purchase a copy of MS Windows to be able to program the board. This SourceForge project contains no new code.
| 01:04:22 |
| Winter (she/her) | Redacted or Malformed Event | 01:08:41 |
| Winter (she/her) | Redacted or Malformed Event | 01:09:17 |
| Winter (she/her) | (Deleted messages since I was running into something due to a typo.) | 01:11:10 |
 @v0id:nltrix.net | (/nix/store/brdc9kjd2xbgkh250ql2660pgqkrxwqw-tor-browser-bundle-bin-11.5/share/tor-browser/firefox:14017): GLib-WARNING **: 00:49:00.678: getpwuid_r(): failed due to: Permission denied.
[Child 14017, MediaDecoderStateMachine #1] WARNING: Decoder=7fa87a84d000 state=DECODING_METADATA Decode metadata failed, shutting down decoder: file /var/tmp/build/firefox-b2ffba38205d/dom/media/MediaDecoderStateMachine.cpp:366
[Child 14017, MediaDecoderStateMachine #1] WARNING: Decoder=7fa87a84d000 Decode error: NS_ERROR_DOM_MEDIA_METADATA_ERR (0x806e0006) - static MP4Metadata::ResultAndByteBuffer mozilla::MP4Metadata::Metadata(mozilla::ByteStream *): Cannot parse metadata: file /var/tmp/build/firefox-b2ffba38205d/dom/media/MediaDecoderStateMachine.cpp:3562
(/nix/store/brdc9kjd2xbgkh250ql2660pgqkrxwqw-tor-browser-bundle-bin-11.5/share/tor-browser/firefox:14298): GLib-WARNING **: 00:51:44.862: getpwuid_r(): failed due to: Permission denied.
| 01:23:23 |
| @v0id:nltrix.net | seems like somebody fuzzed 11.5 tor-browser-bundle-bin mp4 decoder, upgrade to >11.5 | 01:24:18 |
| @v0id:nltrix.net | * seems like somebody fuzzed 11.5 tor-browser-bundle-bin mp4 decoder, upgrade to >11.5? | 01:24:26 |
| @v0id:nltrix.net | I think there is 11.5.1 as shown here https://repology.org/project/tor-browser/versions | 01:25:40 |
| @v0id:nltrix.net | * I think there is 11.5.1 as shown here https://repology.org/project/tor-browser/versions, did not look into the warning I must admit. | 01:27:05 |
| Winter (she/her) | In reply to @v0id:nltrix.net
I think there is 11.5.1 as shown here https://repology.org/project/tor-browser/versions, did not look into the warning I must admit. https://github.com/NixOS/nixpkgs/pull/183117 | 01:35:02 |
| K900 | Since people here might be interested too: I have a mostly working secure boot PoC with bootspec, rEFInd and sbctl at https://gitlab.com/K900/bootis | 06:08:18 |
| K900 | It is very much PoC and might set your computer on fire but please try it and tell me if it did | 06:08:42 |
| Winter (she/her) | What advantages does this provide over Graham's impl? | 06:09:03 |
| K900 | refind instead of sd-boot, and sbctl has some really nice failsafes to prevent you from breaking your system by accident | 06:10:38 |
| Winter (she/her) | oh cool | 06:11:33 |
| Winter (she/her) | (fwiw i wasn't saying that to like, bash your work, was just curious) | 06:11:48 |
