34
submitted 2 days ago* (last edited 2 days ago) by [email protected] to c/[email protected]

Threat actors are utilizing an attack called "Revival Hijack," where they register new PyPi projects using the names of previously deleted packages to conduct supply chain attacks.

The technique "could be used to hijack 22K existing PyPI packages and subsequently lead to hundreds of thousands of malicious package downloads," the researchers say.

If you ever install python software or libraries using pip install then you need to be aware of this. Since PyPI is allowing re-use of project names when a project is deleted, any python project that isn't being actively maintained could potentially have fallen victim to this issue, if it happened to depend on a package that was later deleted by its author.

This means installing legacy python code is no longer safe. You will need to check every single dependency manually to verify that it is safe.

Hopefully, actively maintained projects will notice if this happens to them, but it still isn't guaranteed. This makes me feel very uneasy installing software from PyPI, and it's not the first time this repository has been used for distributing malicious packages.

It feels completely insane to me that a software repository would allow re-use of names of deleted projects - there is so much that can go wrong with this, and very little reason to justify allowing it.

[-] [email protected] 19 points 4 days ago

I love that the local translation feature is getting regular small updates to make it more useable. It's a great feature.

[-] [email protected] 7 points 4 days ago

Porges believes

This is an interesting article and yet you've chosen to quote the most speculative unscientific part of it from the final paragraph.

"Have you tried going outside" is not a scientific cure for depression.

[-] [email protected] 5 points 6 days ago

Note to readers: Don't install python dependencies for random python projects of unknown provenance. PyPI is regularly being used as a vector for distributing malware. See recent news stories here: https://www.bleepingcomputer.com/tag/pypi/

You should manually check every package listed in requirements.txt and verify that it is a trustworthy python library.

[-] [email protected] 0 points 6 days ago

Sorry but your satire isn't funny enough for me to continue reading when the page gets gradually darker as I scroll down so that it can show me a popup asking me to subscribe to your newsletter or whatever the fuck.

[-] [email protected] 4 points 6 days ago

AI is definitely capable of making great music right now.

Got any links?

[-] [email protected] 65 points 3 months ago

I lost my earbuds in a remote town in Chile, so tried buying a new pair at the airport before flying out.

...

True Apple lightning devices are more expensive to make.

...

I wish @Apple would devote an employee or two to cracking down on such a technological, psychological abomination as this.

He wants to take away a budget option from developing countries where people can't afford the expensive version of the proprietary technology, and he wants Apple to be the one to do it?

Fuck this guy.

[-] [email protected] 111 points 3 months ago

It was more than just a special icon for a folder, it had special behaviour too. Without looking it up (in the spirit of the meme), I seem to remember that it would automatically sync the files any time that you insert the floppy disk, kind of like having Dropbox but without the internet. The idea being that you would have files on your computer that you could take with you somewhere else (in your briefcase, on a floppy disk) and all instances of that briefcase would automatically sync the latest updates of the files without you having to manually copy them and work out which was the latest version of a file.

[-] [email protected] 78 points 4 months ago

a really odd way of using Git

Git was literally designed for kernel development.

23
submitted 5 months ago by [email protected] to c/[email protected]

Description: "Featured is a playthrough of a blitz chess game between Rodrigo Vasquez and Vladimir Kramnik from an Early Titled Tuesday event which was held on October 17th, 2023. Kramnik recently admitted, via a YouTube comment on this topic of fair play surrounding him, that he played several tournaments under someone else’s chess.com account. This act violates chess.com’s Fair Play Policy. Kramnik played under Denis Khismatullin’s account, “Krakozia”. I share reasons why this is a violation of fair play policy, how a player can be negatively impacted because of it, and provide Kramnik’s YouTube comments where he attempts to explain it all."

294
submitted 11 months ago by [email protected] to c/[email protected]

cross-posted from: https://lemmy.ml/post/4912712

Most people know at this point that when searching for a popular software package to download, you should be very careful to avoid clicking on any of the search ads that appear, as this has become an extremely common vector for distributing malware to unsuspecting users.

If you thought that you could identify these malicious ads by checking the URL below the ad to see if it directs to the legitimate site, think again! Malware advertisers have found a way to use Google's Ad platform to fake the URL shown with the ad to make it appear like a legitimate ad for the product when in fact, clicking the ad will redirect to an attacker controlled site serving malware.

Don't click on search ads or, even better, use an ad-blocker so that you never see them in the first place!

193
submitted 11 months ago by [email protected] to c/[email protected]

Most people know at this point that when searching for a popular software package to download, you should be very careful to avoid clicking on any of the search ads that appear, as this has become an extremely common vector for distributing malware to unsuspecting users.

If you thought that you could identify these malicious ads by checking the URL below the ad to see if it directs to the legitimate site, think again! Malware advertisers have found a way to use Google's Ad platform to fake the URL shown with the ad to make it appear like a legitimate ad for the product when in fact, clicking the ad will redirect to an attacker controlled site serving malware.

Don't click on search ads or, even better, use an ad-blocker so that you never see them in the first place!

331
submitted 1 year ago by [email protected] to c/[email protected]

A reported Free Download Manager supply chain attack redirected Linux users to a malicious Debian package repository that installed information-stealing malware.

The malware used in this campaign establishes a reverse shell to a C2 server and installs a Bash stealer that collects user data and account credentials.

Kaspersky discovered the potential supply chain compromise case while investigating suspicious domains, finding that the campaign has been underway for over three years.

[-] [email protected] 72 points 1 year ago

A Starfield player has credited the sci-fi game with saving their life after they stayed up late to play it and was awake when their apartment complex caught fire.

u/Tidyckilla took to Starfield's subreddit over the weekend to report their amazing escape, saying that if they hadn't been awake "bingeing" the game when the fire broke out, the player and their wife would likely have "died to smoke inhalation".

Saved you a click. Website is trash anyway.

[-] [email protected] 97 points 1 year ago

The translation feature is based on the Bergamot project to provide users with a privacy-aware translation engine where the translation is done locally using machine learning, it’s never sent to a third party, and it’s optimized for consumer hardware.

Neat!

[-] [email protected] 72 points 1 year ago

Saved you a click:

A common allele of HLA is associated with asymptomatic SARS-CoV-2 infection

We observed that individuals carrying this common allele (approximately 10% in individuals with European ancestry) are more than twice as likely to remain asymptomatic after SARS-CoV-2 infection compared with those who do not, and a notable effect of HLA-B*15:01 homozygosity increasing the chance of remaining asymptomatic by more than eight times.

Together, our results strongly support the hypothesis that HLA-B*15:01 mediates asymptomatic COVID-19 disease through pre-existing T cell immunity due to previous exposure to HKU1-CoV and OC43-CoV.

1
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]

[SOLVED]: The issue was caused by having "Show read posts" unticked in Settings. This will hide your own posts from you!

I recently made a post^[1]^ to this community about a bug that I experienced and reported.

The post does not appear in the New feed for /c/lemmy_support nor does it appear in my user profile under Posts ^[2]^.

However the post does have 3 replies (from users on multiple different instances) which means that other users can see it across the fediverse, so it's not a federation issue. (Also, my account and the community are both hosted on the same instance - lemmy.ml).

I was not subscribed to /c/lemmy_support at the time I made that post, but I am subscribed now to see if that affects my visibility of this post.

Is this a bug, or am I misunderstanding how lemmy works?

Interestingly, if I view my profile while logged out, it does show the posts that I made, but when logged in it shows zero posts in my profile.

[1] https://lemmy.ml/post/1394597

[2]

view more: next ›

drspod

joined 2 years ago