mastodon - Link to source

#curl 8.18.0 has been released. This release fixes 2 medium and 4 low level vulnerabilities:
- CVE-2025-13034: No QUIC certificate pinning with GnuTLS curl.se/docs/CVE-2025-13034.ht…
- CVE-2025-14017: broken TLS options for threaded LDAPS curl.se/docs/CVE-2025-14017.ht…
- CVE-2025-14524: bearer token leak on cross-protocol redirect curl.se/docs/CVE-2025-14524.ht…
- CVE-2025-14819: OpenSSL partial chain store policy bypass curl.se/docs/CVE-2025-14819.ht…
- CVE-2025-15079: libssh global knownhost override curl.se/docs/CVE-2025-15079.ht…
- CVE-2025-15224: libssh key passphrase bypass without agent set curl.se/docs/CVE-2025-15224.ht…

I discovered the last 2 vulnerabilities.

Download curl 8.18.0 from curl.se/download.html

#vulnerabilityresearch #vulnerability #cybersecurity #infosec

curl - No QUIC certificate pinning with GnuTLS - CVE-2025-13034

curl.se
#infosec #cybersecurity #vulnerability #curl #vulnerabilityresearch
This entry was edited (5 days ago)
in reply to Frau Naja

mastodon - Link to source

Marco Zehe

@FrauNaja Die Verkehrsbehörde hat gestern das Streuen mit Salz auf Geh- und Nebenwegen bis 21.01. wieder erlaubt, so zu lesen im Newsletter "Elbvertiefung" der zeit Hamburg von heute. Ich kann nur sagen, dass mein Hund, den ich zwischen 2002 und 2011 hatte, gerade in den Anfangsjahren definitiv im Winter desöfteren Probleme mit rissigen Ballen wegen Salz hatte. Und ja, manche Eigentümer vergessen anscheinend, dass sie auch eine Räumpflicht der Gehwege vor ihren Gebäuden haben.
@Frau Naja

mastodon - Link to source

Nos dice @santoral que hoy está de santo una forma de consumir drogas.

Santoral: Santo principal del día 7 de enero:
- San Raimundo de Peñafort

Otros santos:
- San Alderico
- Beato Ambrosio Fernández
- San Canuto Lavard
- San Ciro
- San Crispino Obispo
- San José Tuân
- San Luciano Mártir
- Beata María Teresa Haze
- Beato Mateo Guimerá
- San Polieuto
- San Tilón
- San Valentín obispo de Retia
- San Valentiniano

@Santoral

mastodon - Link to source

#dobréRáno přátelé #fediverse ☀️
Včera první jízda na Zwiftu přes Apple TV. Ať si o Applu myslí kdo chce co chce, ale propojení zařízení mají fakt zvládnuté skvěle.

První zapnutí Apple TV?
Chceš nastavit pomocí iPhonu — prostě ho přiložíš a nic dalšího neřešíš.

Pak už jen nainstalovat Zwift, přihlášení řešené přes iPhone, hesla pohodlně z Bitwardenu, žádné ťukání na dálkovém ovladači.

Apple TV jsem chtěl hlavně kvůli aplikaci Zwift pro chytrý trenažér.
Na Android TV Zwift není. Zrcadlení z Androidu do TV sice jde, ale obraz se seká nebo úplně zamrzne.
Zkoušel jsem i USB-C → HDMI kabel, jenže ten telefon vysaje hned baterku.Fairphone to ještě jakž takž zvládne — dvě hodiny dá.S Pixelem bych byl rád za hodinu.
Výsledek?
Za pět minut od zapnutí jsem seděl na kole. 🚴‍♂️
#zwift

#fediverse #dobrerano #zwift

mastodon - Link to source
No i chuj - nadal nie mogę wejść w powiadomienia. Tym samym jakiekolwiek pisanie mija się z celem, bo ani nie wiem czy do kogokolwiek dotrę (wygląda jakbym wszyscy nagle mnie wyciszyli), ani nie wiem, czy ktokolwiek zobaczy, że coś komentuję - więc po co komentować. Ewentualnych odniesień tutaj - też nie zobaczę, bo musiałbym siedzieć i śledzić jakieś reakcje. Tyle czasu (ani potrzeby) to ja nie mam. Ponieważ nie wiem co nie działa i jak sobie z tym poradzić - mam to w dupie, poczekam aż się naprawi. Albo pójdę na inną instancję, serwer czy jak to się tam nazywa.
O ile będę umiał oczywiście:)

mastodon - Link to source

This is in relation to that warning I received this morning. To make a long story short, it seems that some people have been offended by some of my posts, and rather than just blocking me or unfollowing me and moving on, they reported me. At no time did I personally insult anyone, promote violence or illegal activities, threaten anyone, etc. I respect the administrators for letting me know about this, and said that I wouldn't post such things in the future. They have every right to do what they did, or even to ban me, since it is their instance and I agreed to follow their rules. I must make that very clear.

However, I am seeking a less restrictive environment. I honestly didn't think I needed one, since most of my posts are about animals, science, technology, etc. But if I can't share an opinion, even a strongly-worded one, without receiving a warning just because some people were offended, this is probably not a great match for me. It's worth noting that I constantly see posts (from other instances) full of obscenities, negative opinions about politicians, the rich, corporations and their heads, users of various operating systems, etc.

Anyway, I would prefer to stay on Mastodon because it's fully accessible, and I would like an instance with a large number of characters (this one is 16,000). If it helps, I am not a gamer, programmer, activist, don't follow politics, etc. I certainly don't want to join a place full of hate, but I do want to join one where I am free to be myself. For now, enjoy the completely wholesome posts with no more personal opinions about anything except opera, though I'll probably limit those too, in case I don't like a given singer.

in reply to Andre Louis

mastodon - Link to source

Georgiana Brummell

@FreakyFwoof At first, I thought it would be fine, since the person who runs this also runs Friendica, where I have another account. But rule 1 gives ample opportunity for people to say they're offended by harmless jokes, my views on the singular they, etc. Obviously, I do not target people or deliberately insult them. But considering what happened here, I don't want more trouble. Only two posts were shown, but others were reported, and I'm not sure what they were. Maybe, something like "modern people give me a headache", "why does that need a content warning", or "many people today dress badly". I have no idea. These are just guesses. But they are also simply opinions.
@Andre Louis

pleroma - Link to source

> leave Twitter to get away from the unaccountable content moderation team

> Mastodon wants you to not see posts without content moderators checking first

We did it everyone we finally achieved feature parity with the best microblogging platform, and this time people volunteer to make it worse instead!
RT: mastodon.social/users/staff/st…

Mastodon.social Staff (@staff@mastodon.social)

We plan to disable the "live feeds" of the local and federated timelines on mastodon.social within in the next couple of weeks. They are already disabled on mastodon.online.
Mastodon.social Staff (Mastodon)

mastodon - Link to source

Monal 6.4.17 (Build 1072, PR #1541) released.

- Removed christmas special again
- Added Estonian and Telugu translations
- Fixed random black video feed on video calls
- Make it harder for spammers to mention everybody: ignore mentions if more than 5 participants are mentioned per message
- Properly display Visitor role in Channels
- Add "Request Voice" button to contact details of moderated Channels

#Monal #ios #macos #xmpp #im #chat #messaging

#xmpp #ios #chat #MACOS #monal #messaging #im

mastodon - Link to source

After my assembly #39c3 talk on the topic, here’s a more in-depth analysis on the #security of data and metadata in #XMPP : blog.mathieui.net/xmpp-and-met…

I’m sure I missed a lot of things, but since the only reference on the topic is the - now defunct - infosec handbook website with the "admin in the middle" article, I guess that could be useful to somebody.

XMPP and metadata

blog.mathieui.net
#xmpp #security #39c3

mastodon - Link to source
Krásné dobré ráno mastodoňané! 🙋‍♀️🐶🐈
Stále -13. Dobře, kromě pyžama a zimní bundy jsem si vzala ještě šálu. Baldín to vzal tryskem a Artur se sápal na vchodové dveře s hlasitým nadáváním. Dneska v práci končím o chvilku dřív a s pár lidmi jedeme za bývalým majitelem a zakladatelem firmy. Bylo mu devadesát. Narodil se ve stejný den jako já, jen jiný rok. Úžasný pán. Už je jako věchýteček, ale hlavu má jasnou a čistou. V podstatě všechno, čím firma disponuje a co má, je jeho práce. Těšíme se za ním všichni.
Vy si taky najděte důvod k radosti pro tento den. Bude se vám lépe vstávat. 😊
#dobre_rano
#dobréRáno
#dobre_rano #dobrerano

mastodon - Link to source

If anyone's looking for a fun illustration project or an opportunity to get into the GNOME artwork style: Crosswords needs some illustrations for the "How to Play" instructions :)

gitlab.gnome.org/jrb/crossword…

Example from Sudoku:

#gnome #icons #illustrations

Screenshot of Sudoku, with the "How to Play" dialog in the foreground. The dialog consists of a slideshow with tips, the current page has an illustration of some rows, a scissor and ruler. and a green/blue background. Below the illustration there's the text "Rows and Columns: Each row and column must contain unique numbers without duplicates".

Add artwork for the hints dialog (#361) · Issues · Jonathan Blandford / Crosswords · GitLab

Currently, the hints dialog has no artwork, just the main icon repeated on each page. It would be good to get better artwork for this. Sudoku has some...
GitLab
#gnome #illustrations #icons
This entry was edited (6 days ago)

mastodon - Link to source

On the topic of bad takes against Flatpak, my personal favorite is "Flatpak is bad because it works badly with my NVIDIA GPU's drivers"

Consider the following: NVIDIA GPU's (proprietary) drivers work badly on Linux

Under no circumstances should volunteers in the FOSS community ever be placed in a position that forces them to bend over large corporations, even if it hurts the user experience. Besides, the ones who are actually hurting users is the corporations by making it hard for everyone.

This is also true with Fedora's hostility towards proprietary drivers. This kind of hostility should be encouraged. As a community, we should collectively shame entities that push proprietary garbage as a dependency on Linux, so long it doesn't harm security.
vt.social/users/trafotin/statu…

Trafotin

2025-12-31 17:26:11

mastodon - Link to source

"I will never use Flatpaks because I have to type `flatpak run com.example.Application`. It's insane Flatpak developers don't change it!"

Except you can add `/var/lib/flatpak/exports/bin` to your $PATH. This way, you can type `com.example.Application` in your terminal, dmenu, everywhere. Also if you aren't using completions and insist on doing everything in the terminal, you have bigger problems.

Shout out to the Evil Skeleton (@TheEvilSkeleton) , who blogged about this 3 years ago. tesk.page/2022/09/28/what-not-…

GNOME Calculator launched using the fish shell.

What Not to Recommend to Flatpak Users

Whenever I browse through the web, I find many “tips and tricks” from various blog writers, YouTubers and others who recommend users to take steps that either they aren’t supposed to, or have better alternatives.
TheEvilSkeleton

This entry was edited (6 days ago)
in reply to Sergey Bugaev

mastodon - Link to source

Hakan Bayındır

@bugaevc
I'll kindly disagree with you here. Considering both AMD and Intel can write drivers which doesn't infringe on any patents and doesn't expose any of their secret sauce (AMD Catalyst and AMDGPU are completely different codebases), NVIDIA is the only one who acts like this and creates a special firmware to cripple their cards so open drivers can't enable the whole GPU.

NVIDIA revised hardware to be able to lock them down further while AMD changed hardware to unlock it.

@Sergey Bugaev

mastodon - Link to source
Been reviewing Spanish with duolingo. Of course they now have an AI conversationalist that you call on the phone. I'm ahead in my knowledge for lots of things, but I'm getting to a point in lessons where I need to follow there ordering. In today's call with Lilly, the stoner girl that knows how to speak Spanish, I threw some complex words and ideas at her to see if she would keep me at the level of my lessons. Turns out she sounds like a stoner, but when she asked me how I was and then I said I was tired. Somehow we got onto the topic of what I like to do before bed and I told her I liked reading. Then we went all Spanish crazy and talked about scifi and fantasy books we liked. Impressive for those that need to practice Spanish conversation.

mastodon - Link to source
Remember Eye Yay, the public domain player I posted a couple weeks ago? It's been updated with VoiceOver support! Like me, you can enjoy countless hours of OTR from archive.org!
| apps.apple.com/app/id675510251…

Eye Yay - Public domain player App - App Store

Download Eye Yay - Public domain player by Bucket Brigade Software Limited on the App Store. See screenshots, ratings and reviews, user tips, and more games…
App Store

reshared this

pleroma - Link to source

> “It’s hard to imagine increases beyond 300,000 to 400,000 barrels a day in the next year, just given the degraded state of the infrastructure, especially the upgraders,” Daan Struyven, co-head of global commodities research at Goldman Sachs, said at the Goldman Sachs Energy, CleanTech and Utilities Conference.

DING DING DING

You want the truth about this ask the investors who finance this shit and actually understand the risk. They aren't lying

pleroma - Link to source

> U.S. Interior Secretary Doug Burgum said on Tuesday that an increased flow of Venezuelan heavy oil to the U.S. Gulf would be "great news" for job security, future gasoline prices in the U.S. and for Venezuela.

You don't make gasoline from heavy sour crude, why can't we have journalists that do their goddamn jobs and call these people out on their lies

mastodon - Link to source

With a budget, colleagues and I would:

⚡️Reduce volunteer cash advances for events

⚡️Improve the #OpenZFS test suite and documentation

⚡️Organize East coast USA and European OpenZFS summits

⚡️Continue to improve #bhyve

⚡️Continue to improve community Audio/Video wisdom and equipment

⚡️Consider cloud service backup/export challenges (I got Google Drive mirroring to work!)

The money is out there but is firewalled.

If you believe in these same goals, please reach out to potential supporters.

In 2025 I introduced colleagues to over half a million USD in employment opportunities. Now I am forced to think about myself.

❤️

#openzfs #bhyve

mastodon - Link to source

This is the document, Trump does not want you to see.

In 1916, under President Woodrow Wilson, the United States signed the purchase of the Virgin Islands from Denmark, in a convention in which the United States recognised Denmark's right to the whole of Greenland.

Danish MP's of The Defence Committee will convene in the Sensitive Compartmented Information Facility at 18:00 to discuss the defence of Greenland.

Full text: govinfo.gov/content/pkg/STATUT…

In proceeding this day to the signature of the Convention respect- Greenland recognized. ing the cession of the Danish West-Indian Islands to the United States of America, the undersigned Secretary of State of the United States of America, duly authorized by his Government, has the honor to declare that the Government of the United States of America will not object to the Danish Government extending their political and economic interests to the whole of Greenland. ROBERT LANSING.
⇧