diff options
Diffstat (limited to 'TODO.md')
| -rw-r--r-- | TODO.md | 25 |
1 files changed, 24 insertions, 1 deletions
@@ -19,6 +19,7 @@ - wkd for pgp - home: rename "Archived Posts..." to "Older Posts" - archive: rename "Archived Posts..." to "Older Posts" +- index with pagefind: (<https://pagefind.app/>, <https://www.tbray.org/ongoing/When/202x/2025/11/01/Blog-Search-Pagefind>) ## linting - replace `<img>` in old posts with `{{< figure >}}` (partial work @@ -145,6 +146,9 @@ <https://blog.tidelift.com/the-state-of-package-signing-across-package-managers> - declarative install (go) rationale: <https://blog.phylum.io/phylum-discovers-dozens-more-pypi-packages-attempting-to-deliver-w4sp-stealer-in-ongoing-supply-chain-attack> + - counterexamples: + - rubygems (arbitrary ruby) + - rust (arbitrary rust in `build.rs`) - typosquatting (see sqo vulns from may email) - starsquatting (requests, phpass): https://medium.com/checkmarx-security/typosquatting-attack-on-requests-one-of-the-most-popular-python-packages-3b0a329a892d - ref: https://kerkour.com/rust-crate-backdoor @@ -223,12 +227,14 @@ https://github.com/gorhill/uBlock/wiki/Procedural-cosmetic-filters <https://rubyweekly.com/issues/620> ##table.item:has(p.name > .tag-sponsor) + - dark reader + - tab stash - hardening - try out various lsms - apparmor - lockdown - selinux - - systemd hardening + - systemd hardening (examples: spamassassin config) - owasp guides - disa stigs - dropping system calls (firejail) @@ -236,6 +242,7 @@ - heat pump (pictures/heat-pump-20220930) - <https://insideevs.com/news/509767/tesla-model3-control-arm-fix/> - `curl|bash` is madness + - vulnerable to clickfix: <https://arstechnica.com/security/2025/11/clickfix-may-be-the-biggest-security-threat-your-family-has-never-heard-of/> - gosec vs govulncheck https://github.com/securego/gosec https://www.pixelstech.net/article/1667102060-Secure-Your-Go-Code-With-Vulnerability-Check-Tool @@ -288,6 +295,7 @@ - sorta: elasticsearch (opensearch), redis - reddit, stackoverflow - my tools + - hnb - vim: (2 pragbooks vim books, vimhelp.org, learnvimthehardway) - tried neovim, still like vim more - irssi @@ -522,6 +530,8 @@ - run tails in gnome boxes with persistent storage (see x1 notes for details, but it's `qemu-img convert ... qemu-img resize`) ref: <https://unix.stackexchange.com/questions/517524/install-tails-with-persistent-storage-on-virtualbox> +- signal in tails: + <https://bisco.org/notes/installing-and-running-signal-on-tails/> - bot user-agent blocking: <https://www.jwz.org/blog/2025/05/user-agent-blocking/#comment-259206> <https://perishablepress.com/ultimate-ai-block-list/> (linked from comment) @@ -561,6 +571,18 @@ - eff surveillance self-defense: <https://ssd.eff.org/> - msn good article about facebook snafu with a gratuitous omission: <https://www.msn.com/en-us/news/technology/meta-found-a-new-way-to-violate-your-privacy-here-s-what-you-can-do/ar-AA1GecPs> - ars comment about ublock origin setting: <https://arstechnica.com/security/2025/06/meta-and-yandex-are-de-anonymizing-android-users-web-browsing-identifiers/?comments=1&post=43767385> +- spamprobe to spamassassin (notes in v3.txt) + - had to disable dnswl check, was causing grief + - `sa-check.py`, got 184/200 (~92% true positive rate) + - added `sa-train.sh`, runs nightly + - updated `~/.mailfilter` + - will monitor +- cwe id in u16, cve id in u32 + (`~/git/test/rust/nvd-cve/src/lib.rs`) +- "quick numbers vs accurate numbers" + - quick disease test versus blood test + - BLS jobs reports +- `polycvss` article about bit packing and `cvss-calcs` ## linkdump (2022-08-10): - css bg fade: @@ -652,6 +674,7 @@ <https://www.jwz.org/blog/2024/06/your-personal-information-is-very-important-to-us/> - <https://arstechnica.com/gadgets/2024/08/nova-launcher-savior-of-cruft-filled-android-phones-is-on-life-support/> - software: <https://www.lawfaremedia.org/article/the-crowdstrike-outage-and-market-driven-brittleness> +- <https://github.com/C2SP/wycheproof> ## done - add project folders |