• 1 Post
  • 17 Comments
Joined 1 year ago
cake
Cake day: June 27th, 2023

help-circle






  • The whole idea behind Manjero’s update scheme is just generally a landmine. LTS releases typically work by maintaining a older branch that gets updates. In this way you delay features not patches. If you run Firefox on such a system it will be Firefox LTS with this week’s patches (this is kinda important for security reasons). Manjaro doesn’t do this instead it just holds everything back artificially one or two weeks.

    Bluntly doing this with a browser or other security critical software should be a crime.

    Manjero just generally feels very amaturish and its history of taking down Arch’s servers is not helping here.





  • #2 is also the most insideous to update. Add another indented line to one of the conditions and the cotrol flow completely breaks while visually appearing fine.

    C and a number of other languages have annoying pair of parallel syntax systems that makes it easy for people to read code one way and computers to compile it another. People read the indentation and newlines while compilers count braces and semicolons. #2 gets rid of the braces and makes control flow driven by semicolons making human visual inspection more likely to fail








  • I feel personally attacked. Yes I’ve actually done this (minus sending them money). I had a server (that I am pretty sure sent headers to the effect that it ran x86) which had some logs indicating someone had tried to download an arm IOT botnet onto it. So I downloaded it and tried running it through a decompiler. I found a UPX stub. The rest was compressed. So I tried the UPX unpacker. This didn’t work because it was built with a modified copy of UPX. So I hauled out a raspberry pi, reflashed the OS and tried running it in GDB in hopes of just dumping the unpacked bit from memory. Nothing. So I downloaded qemu and set up an aarch 64 arm 9 image still nothing. So I tried 32 bit arm again in qemu. At this point I gave up