Remote
Kevin
@ikke@ipv6.social
mastodon
4.5.5
I help maintain the Alpine Linux infrastructure.
134
Followers
114
Following
15
Posts
Joined November 19, 2022
Alpine Linux:
Github:
Posts
Replying to
@filippo@abyssdomain.expert
@filippo Interesting, I just cam across https://infosec.exchange/@mttaggart/116163107290977793 the other day, basically saying that it won't be feasible any time soon.
Email sent to the Alpine Linux security address:
Subject: URGENT: Sensitive information disclosure.
The actual 5 digit codes they mention? References to gitlab merge requests 🤦♂️
Replying to
@waldi@chaos.social
@waldi@chaos.social @ncopa@fosstodon.org no, musl already bit the bullet and uses 64bit time_t
Replying to
@freedosproject@fosstodon.org
@freedosproject@fosstodon.org alpinelinux is struggling with documentation and could use help.
https://alpinelinux.org
https://docs.alpinelinux.org
Fun, another "critical severity" (9.3 CVSS score) CVE for zlib that only affects a reference program that's not shipped.
The CVE in the meantime has been adjusted with a lower score, but too late for the security scanners to start reporting and us receiving reports like:
> we found a CRITICAL CVE in the OS level
Replying to
@Codeberg@social.anoxinon.de
@Codeberg@social.anoxinon.de ouch. This remains a cat-and-mouse game.
At least having them solve the Anubis challenge does cost them extra resources, but if they can do that at scale, it doesn't promise a lot of good.