@mgorny maybe baking certificate stores into absolutely everything was not the greatest idea

It's kinda funny that the certificate compromise comes just after another round of upstreams bashing at distro packaging.

Let me get this straight for the people in the back. In a perfect world, you'd just upgrade a single package on your system and be good. Unfortunately, we're far removed from even a reasonably good world.

Pretty much everything that matters in #Python uses certifi. dev-python/certifi in #Gentoo is a fork that uses system certs, so our system install is good. But in every virtual environment (venv, conda, etc.), you need to upgrade certifi.

certifi is also bundled in a bunch of packages, including pip. dev-python/pip in Gentoo has certifi unbundled, but you need to upgrade pip in your virtual environments (using vulnerable pip!). On Gentoo systems, you also need to upgrade dev-python/ensurepip-pip, which is the upstream wheel which we couldn't figure out how to unbundle.

pip is also bundled in Python to bootstrap venvs. In Gentoo, we're configuring Python to use our system dev-python/ensurepip-pip package, so as soon as you upgrade it, you're good. But where this isn't the case, you need to wait for new Python releases and upgrade, because otherwise venvs will start with vulnerable pip. On the plus side, you can remember to upgrade it after creating a new venv.

Lock files are particularly popular in the Python world, and a dependency cooldown is the new fad. You will need to update certifi in them, and exclude it from dependency cooldown.

Many #RustLang packages (think uv) also use a bundled certificate store. All these packages need a lockfile update and rebuilding, meaning downstream patching or new upstream release. So yes, everyone (including Gentoo users, because Rust doesn't really support dynamic linking, great design for #security) need to update uv, and possibly wait to discover more random Rust packages that are vulnerable.

I'm also going to guess that all flatpakers are affected, all popular browsers, and possibly everyone else who knows better than to use distro packaging. All containers are affected, and will need to be rebuilt, with new system certificate stores and all the packages that bundle their own stores…

And the best part is, most of these upstream package distribution systems have no other security layer except for TLS certificates. You can update Gentoo packages safely, because we are using our own key infrastructure. But pip, uv and so on are subject to a MITM risk while upgrading the vulnerable packages.

This is the true definition of clusterfuck.

Breaking News: Musk Ordered Starlink Slowdown That Blindsided Ukraine

The SpaceX founder authorized the move and has been discussing Ukraine with Trump, but the president has denied ordering the restrictions

PAYWALLED

https://www.wsj.com/world/ukraine-starlink-elon-musk-trump-dbc49193

@w3cdevs @w3c No accessibility section? I understand it's a first public working draft, but I am used that accessibility is at least mentioned in specs that clearly will make people uncomfortable through movement.

A Secret told—
Ceases to be a Secret—then—
A Secret—kept—
That—can appal but One—

Better 4 it—continual be afraid—
Than it—
And Whom you told it to—beside—

—Emily Dickinson (mostly)

#eMudhra

RE: https://indieweb.social/@httpster/116018793292768991

Nu har även Dagens Nyheter tagit upp Bokförlaget Bokum och deras AI slop. Dagens ETC var väl först på bollen utanför sociala medier.

Men bland oss bibliofiler har det varit ett pågående ärende i över ett år.

https://www.dn.se/kultur/bocker-fran-misstankt-ai-forlag-saljs-pa-stora-plattformar-krankande/

A Secret told—
Ceases to be a Secret—then—
A Secret—kept—
That—can appal but One—

Better 4 it—continual be afraid—
Than it—
And Whom you told it to—beside—

—Emily Dickinson (mostly)

#eMudhra

rip PHP

Dva lidé zemřeli po nočním ruském útoku poblíž druhého největšího ukrajinského města Charkov, informovaly úřady. Ruské údery hlásí i Kyjev.

I also have a weird ask for the fedi. I don't know if anyone on here does commissions for Japanese or Korean calligraphy (shodo / seoye - hopefully I got that right).

My initial training was in Japanese Zen and I am currently studying Seon (Korean Zen). I would like to decorate my meditation space with something that is at once appropriate and human made.

Please feel free to either boost this, retag it to reach the right people or reach out to me if you would be interested. My additional goal is to support people who put love and time into their craft.

#commissions #art #zen

@liaizon This is so cool! I actually have never tried this myself 😁 . Thanks for the feedback. And agree - quite useful.

@lw likewise it was a conscious choice over a decade ago not to go into that system, and it’s been a choice that keeps paying off.
Hugops out there for my friends in firewall land who are very stressed today.

Narrator: closer to two decades