| 27 Jul 2022 |
 Sandro 🐧 | adding a scanner for that won't help to much because all of the patches we fetchpatch. | 14:11:41 |
| 28 Jul 2022 |
 hexa | I'm somewhat unavailable until Mid-August and won't be able to really take care of security issues. | 23:19:06 |
 Winter (she/her) | This PR switches a package (fxload) from the original sources from 2002 to a fork from 2013, which (apparently) contains fixes to make the change in this PR work. How do we feel about this? | 23:51:35 |
| 29 Jul 2022 |
 @andreas.schraegle:helsinki-systems.de | LGTM. replacing ancient abandoned software with slightly less ancient and also abandoned software is rarely an issue. Do you think the newer version is likely to contain any (security) issues that the older one didn't? | 00:45:10 |
| Winter (she/her) | don't think so | 01:03:47 |
| Winter (she/her) |
This is a branch from the fxload project, originally part of the linux-hotplug SourceForge project which seems to be abandoned. This branch incorporates the patch from Steven J. Magnani that adds support for Cypress FX3 USB 3.0 endpoint to the fxload utility. It has been tested on Ubuntu 12.04 with the FX3 development kit (part number CYUSB3KIT-001). Oddly, as of January 2013 Cypress doesn't include this utility with its (open source) Linux SDK but requires developers to purchase a copy of MS Windows to be able to program the board. This SourceForge project contains no new code.
| 01:04:22 |
| Winter (she/her) | Redacted or Malformed Event | 01:08:41 |
| Winter (she/her) | Redacted or Malformed Event | 01:09:17 |
| Winter (she/her) | (Deleted messages since I was running into something due to a typo.) | 01:11:10 |
 @v0id:nltrix.net | (/nix/store/brdc9kjd2xbgkh250ql2660pgqkrxwqw-tor-browser-bundle-bin-11.5/share/tor-browser/firefox:14017): GLib-WARNING **: 00:49:00.678: getpwuid_r(): failed due to: Permission denied.
[Child 14017, MediaDecoderStateMachine #1] WARNING: Decoder=7fa87a84d000 state=DECODING_METADATA Decode metadata failed, shutting down decoder: file /var/tmp/build/firefox-b2ffba38205d/dom/media/MediaDecoderStateMachine.cpp:366
[Child 14017, MediaDecoderStateMachine #1] WARNING: Decoder=7fa87a84d000 Decode error: NS_ERROR_DOM_MEDIA_METADATA_ERR (0x806e0006) - static MP4Metadata::ResultAndByteBuffer mozilla::MP4Metadata::Metadata(mozilla::ByteStream *): Cannot parse metadata: file /var/tmp/build/firefox-b2ffba38205d/dom/media/MediaDecoderStateMachine.cpp:3562
(/nix/store/brdc9kjd2xbgkh250ql2660pgqkrxwqw-tor-browser-bundle-bin-11.5/share/tor-browser/firefox:14298): GLib-WARNING **: 00:51:44.862: getpwuid_r(): failed due to: Permission denied.
| 01:23:23 |
| @v0id:nltrix.net | seems like somebody fuzzed 11.5 tor-browser-bundle-bin mp4 decoder, upgrade to >11.5 | 01:24:18 |
| @v0id:nltrix.net | * seems like somebody fuzzed 11.5 tor-browser-bundle-bin mp4 decoder, upgrade to >11.5? | 01:24:26 |
| @v0id:nltrix.net | I think there is 11.5.1 as shown here https://repology.org/project/tor-browser/versions | 01:25:40 |
| @v0id:nltrix.net | * I think there is 11.5.1 as shown here https://repology.org/project/tor-browser/versions, did not look into the warning I must admit. | 01:27:05 |
| Winter (she/her) | In reply to @v0id:nltrix.net
I think there is 11.5.1 as shown here https://repology.org/project/tor-browser/versions, did not look into the warning I must admit. https://github.com/NixOS/nixpkgs/pull/183117 | 01:35:02 |
 K900 | Since people here might be interested too: I have a mostly working secure boot PoC with bootspec, rEFInd and sbctl at https://gitlab.com/K900/bootis | 06:08:18 |
| K900 | It is very much PoC and might set your computer on fire but please try it and tell me if it did | 06:08:42 |
| Winter (she/her) | What advantages does this provide over Graham's impl? | 06:09:03 |
| K900 | refind instead of sd-boot, and sbctl has some really nice failsafes to prevent you from breaking your system by accident | 06:10:38 |
| Winter (she/her) | oh cool | 06:11:33 |
| Winter (she/her) | (fwiw i wasn't saying that to like, bash your work, was just curious) | 06:11:48 |
| K900 | Oh yeah I know | 06:11:56 |
| K900 | No worries | 06:11:58 |
| K900 | But my main motivation is to just use sbctl for key management | 06:12:31 |
| K900 | Because it does it better than any other tool I've seen | 06:12:39 |
| Winter (she/her) | dare I ask why you use objcopy | 06:12:58 |
| Winter (she/her) | oh i see | 06:13:13 |
| Winter (she/her) | huh, interesting. | 06:13:22 |
| K900 | Instead of sbctl? There's a bug with that that I need to poke upstream about | 06:13:30 |
| Winter (she/her) | no to set like cmdline and stuff | 06:13:53 |
