• 1 Post
  • 17 Comments
Joined 1 year ago
cake
Cake day: June 6th, 2023

help-circle





  • tetris11@lemmy.mltoLinux@lemmy.mlGIMP 3.0.0 RC1 Released
    link
    fedilink
    arrow-up
    4
    ·
    edit-2
    8 days ago

    Its very easy to use and my goto image editor, but I say that from a position of familiarity of having learned where everything is and what all the keybindings are over many years.

    In contrast, Krita seems like a far better image editor, but because the interface is bewildering to me, I’ve shied away from it.











  • One of the oldest Chinese restaurants in the UK crams all foreigners upstairs to share tables with random strangers, where cutlery is thrown at you carelessly and the waiter tuts if you don’t give them a string of numbers as an order. If you go there with a chinese national you’re somewhat protected from the abuse, but they still glare at you.

    Anyway the food is divine and they don’t overcharge, and it’s one of my favourite places to eat.


  • I was talking with a techhead from the 80s about what he did when his tape drives failed and the folly that is keeping data alive on a system that doesn’t need to be. His foolproof backup storage is as follows.

    1. At Christmas buy a new hard drive. If Moore’s law allows, it should be double what you currently have
    2. Put your current backup hardrive into a SATA drive slot. Copy over backup into new hard drive.
    3. Write with a sharpie the date at which this was done on the harddrive. The new hard drive is your current backup.
    4. Place the now old backup into your drawer and forget about it.
    5. On New Years Day, load each of the drives into a SATA drive slot and fix any filesystem issues.
    6. Put them back into the drawer. Go to step 1.

  • The questionable commit:

        {
          // Add the first line of localized text...
          cupsFilePrintf(fp, "*%s.%s %s/", lang->language, ppd_option, ppd_choice);
          while (*text && *text != '\n')
          {
            // Escape ":" and "<"...
            if (*text == ':' || *text == '<')
              cupsFilePrintf(fp, "<%02X>", *text);
            else
              cupsFilePutChar(fp, *text);
            text ++;
          }
          cupsFilePuts(fp, ": \"\"\n");
        }
    

    Can someone explain to me how this allows arbitrary code execution? As far as I can see, all it does iterate through a string and markup some special characters.

    Edit: Okay, after reading the blog post, and this fantastic bug report, it sounds like to print to a CUPS server, you send it a message on port 631 using an IPP (some print protocol) server. CUPS then requests attributes of the IPP server, one of which being the print filter command to run (“Foomatic-rip”) to use to convert a PS or PDF into native print code. By requesting attributes, an exploit involving string escaping through the use of unexpected spaces or quotes can override the Foomatic print command. Arbitrary text can be supplanted, which will then be executed by the CUPS server.