A compacted archive could be used as an attack vector.

• Zip Bombs
• Code execution through a vulnerability in the extracting algorithm

Both of them are valid for any OS.

if i recall correctly

I cannot, i did some searches when i wrote the comment but could not find info about it. It is possible that i am confusing it with another project. I added a iirc but maybe that was not clear enough that i am not sure about it.

That’s simply bad software practice, which was fixed once pointed out. Fact is that if they had done this on purpose, they wouldn’t have changed it and instead, would’ve came up with an excuse to keep it the same way.

This is not correct. While they have removed it from being installed on newer installs/updates, the certificate remains on the system that ran the corresponding version installer/upgrade unless it will be manually removed by the few percent that got the news.

I am talking about it in general. If you trust it or not depends on you. I am just saying that the argument that it is OS or that you can host the server yourself does not automatically mean that it is safe. That applies to any software.

It could install software that transmits the data some time else. Basically something virus would do. The code can be hidden somewhere or loaded from somewhere with simple code.

Those are basic tactics used for years by malware. If just simply monitoring would be enough to protect against malware then we would have way less problems.

You should never run untrusted code or code by untrusted ppl.

You are not running the software cause you do not trust the ppl running it? So you do host the software anyway? Just because it is OS and just because you can run it on your own hardware does not mean you can blindly trust it.

The installer has included a root certificate before that gets installed without asking. Also there are some code blobs in the code iirc.

Also how they handled the initial wayland “support”.

It is relatively easy to smuggle in backdoors if you are the maintainer of the code and afaik there was not even an independent audit.

Saying it is fine just because of it being OS is really naive.

Open standards are the first step of a functional transition to an open government. From there Open Source Software can compete against commercial software, once the ppl see that the FOSS offers the same features then the proprietary paid software they can easily switch to it. With open standards they only need to train the users, no data to migrate etc.

Focus instead on enforcing standards’ compliance so i can open a .docx with any program and be usable anywhere.

That’s an impossible task. Not even Microsoft manages that. Do not want to count how often i used libreOffice to repair or convert an older MSOffice file so it can be opend with modern Versions of MSOffice.

Once there was a 500MB Excel Sheet with lime 500-1000 used Cells, opened and saved it to.a xlsx file using libreOffice and reduced it to a few MB while still being fully functional.

Would it be not much easier (and more portable) if you create a Linux VM in for example VirtualBox? From there you could just follow any Linux guide.

The cheap models can not be flashed with openwrt since they use some proprietary drivers or something.

The complete Opal series is not supporte iirc.

You should have read the post more carefully. The CVE affects every OS. Just the first shown example is Windows only.

Also, the relevant commits are outlined in the first paragraph. This article is not for the stupid user it’s a technical analysis on a few ways to exploit it and for those cases the commits are more relevant than the version. Also saying which versions are affected is not that easy, commits can be backported into an older version by for example the packager.

You want the mail-crypt-plugin in dovecot.

And how often. have you said stuff that you have not received advertising for? You will notice it when you get a positive match but not on a negative.

Data collecting companies can predict/rate your behavior for more then 20 years based. Since then. it has been perfected. They know that you are interested in those topics without having the need to waste resources on recording and analyzing every single audio stream.

Extracting the key from a TPM is actually trivial but immense time consuming.

Basically this with probably more modern chips and therefore even smaller cells. https://youtu.be/lhbSD1Jba0Q

Also sniffing is a thing since the communication between CPU und TPM is not encrypted.

Wasn’t the CVE fixed in a reasonable time frame? I seriously doubt that the maintainers would have ignored it if it wouldn’t have been discussed so publicly.

AFAIK, to exploit it, you need network access to CUPS then add the printer and then the client needs to add/select a new printer on the client device and actively print something.

If CUPS is reachable from the internet, then the system/network is misconfigured anyway, no excuse for ignoring the issue but those systems have other sever issues anyway.

TPM is not only used by the system encryption. But no i do not use it for it. Not because of privacy, cause of security reasons.

Basically, when you do not run server side transcoding and instead rely on client side support you will run from time to time into issues. Jellyfin does not have the ppl to get every client to work with all the different formats on every hardware.

1080 h264/h265 does not say much about the media format. Those codec differentiate in things like Chroma (4:2:0; 4:4:4, etc) or in color depth like 8 or 10 bit. So not every h264 media file does run on the same hardware. Audio codecs are even more complicated.

I think since i setup my hardware transcoding I ran into a not playable file once. But depending on the hardware it can be worse. On android TV you may have to play around with the settings.

I understand that this can be a deal breaker for some ppl.

1. Not sure what you mean by that. Jellyfin has had an up to date version in the play store for years.
2. Yes every Profile is separated into its own account, that’s by design and will most likely never change. An easy PIN option in the local network existed for years. Now you can even login with your phone app by entering a displayed PIN.
3. I remember very few media that i had issues with in the past. Depending on the transcode hardware you have some things can be tricky