Dendrobatus Azureus<p>For me reading this post took about 10 minutes since I not only read but I also processed and checked references and I tooted about it immediately</p><p>It is quite sobering to read something this horrific happening in an Open Source project of this magnitude of volume</p><p>This is something you would expect in closed source not open source; it's like a shower with 0° degrees Celsius of water flowing over you 0° in the depth of the coldest Siberian winter</p><p><a href="https://security.opensuse.org/2025/05/07/deepin-desktop-removal.html#2021-02-01-dtkcommon-filedrag-d-bus-service" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">security.opensuse.org/2025/05/</span><span class="invisible">07/deepin-desktop-removal.html#2021-02-01-dtkcommon-filedrag-d-bus-service</span></a></p><p><a href="https://mastodon.bsd.cafe/tags/openSUSE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>openSUSE</span></a> <a href="https://mastodon.bsd.cafe/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a> <a href="https://mastodon.bsd.cafe/tags/POSIX" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>POSIX</span></a> <a href="https://mastodon.bsd.cafe/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OpenSource</span></a> <a href="https://mastodon.bsd.cafe/tags/programming" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>programming</span></a> <br><a href="https://mastodon.bsd.cafe/tags/Deepin" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Deepin</span></a> <a href="https://mastodon.bsd.cafe/tags/frightmare" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>frightmare</span></a> <a href="https://mastodon.bsd.cafe/tags/Infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Infosec</span></a> <a href="https://mastodon.bsd.cafe/tags/nightmare" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>nightmare</span></a> <a href="https://mastodon.bsd.cafe/tags/elmStreet" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>elmStreet</span></a></p>
101010.pl is one of the many independent Mastodon servers you can use to participate in the fediverse.
101010.pl czyli najstarszy polski serwer Mastodon. Posiadamy wpisy do 2048 znaków.
Administered by:
Server stats:
490active users
101010.pl: About · Status · Profiles directory · Privacy policy
Mastodon: About · Get the app · Keyboard shortcuts · View source code · v4.5.0-alpha.1
#frightmare
0 posts · 0 participants · 0 posts today
Dendrobatus Azureus<p>This is where the depth of the deception became clear </p><p>>></p><p>The review of this component was also what led us to the discovery of the deepin-feature-enable whitelisting bypass, since we installed the full Deepin desktop environment for the first time in a long time, which triggered the “license agreement” dialog described above. After finding out about this, we decided that it was time to reassess the overall topic of Deepin in openSUSE based on our long-standing experiences.</p><p><<</p><p><a href="https://security.opensuse.org/2025/05/07/deepin-desktop-removal.html#2021-02-01-dtkcommon-filedrag-d-bus-service" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">security.opensuse.org/2025/05/</span><span class="invisible">07/deepin-desktop-removal.html#2021-02-01-dtkcommon-filedrag-d-bus-service</span></a></p><p><a href="https://mastodon.bsd.cafe/tags/openSUSE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>openSUSE</span></a> <a href="https://mastodon.bsd.cafe/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a> <a href="https://mastodon.bsd.cafe/tags/POSIX" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>POSIX</span></a> <a href="https://mastodon.bsd.cafe/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OpenSource</span></a> <a href="https://mastodon.bsd.cafe/tags/programming" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>programming</span></a> <br><a href="https://mastodon.bsd.cafe/tags/Deepin" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Deepin</span></a> <a href="https://mastodon.bsd.cafe/tags/WTF" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WTF</span></a> <a href="https://mastodon.bsd.cafe/tags/frightmare" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>frightmare</span></a> <a href="https://mastodon.bsd.cafe/tags/Infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Infosec</span></a> <a href="https://mastodon.bsd.cafe/tags/nightmare" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>nightmare</span></a> <a href="https://mastodon.bsd.cafe/tags/elmStreet" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>elmStreet</span></a></p>
Dendrobatus Azureus<p>This part I screen capped for accentuation </p><p>>></p><p>2024-08-29: deepin-api-proxy: D-Bus Service</p><p>After a longer time of standstill regarding Deepin reviews, a request for the addition of deepin-api-proxy arrived. This package greeted us with over two dozen D-Bus configuration files. Again, upstream’s description of what the component is supposed to do was very terse. From looking at the implementation we deduced that the proxy component seems to be related to the renaming of interfaces described in the previous section.</p><p>We found a design flaw in the proxy’s design which allowed a local root exploit. You can find the details in a dedicated blog post we published about this not too long ago.</p><p>It is noteworthy that the communication with upstream proved very difficult during the coordinated disclosure process we started for this finding. We did not get timely responses, which nearly led us to a one-sided publication of the report, until upstream finally expressed their wish to follow coordinated disclosure at the very last moment. </p><p><<</p><p>I now have really seen it all The Good the Bad and the Ugly in Open Source programming </p><p><a href="https://security.opensuse.org/2025/05/07/deepin-desktop-removal.html#2021-02-01-dtkcommon-filedrag-d-bus-service" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">security.opensuse.org/2025/05/</span><span class="invisible">07/deepin-desktop-removal.html#2021-02-01-dtkcommon-filedrag-d-bus-service</span></a></p><p><a href="https://mastodon.bsd.cafe/tags/openSUSE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>openSUSE</span></a> <a href="https://mastodon.bsd.cafe/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a> <a href="https://mastodon.bsd.cafe/tags/POSIX" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>POSIX</span></a> <a href="https://mastodon.bsd.cafe/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OpenSource</span></a> <a href="https://mastodon.bsd.cafe/tags/programming" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>programming</span></a> <br><a href="https://mastodon.bsd.cafe/tags/Deepin" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Deepin</span></a> <a href="https://mastodon.bsd.cafe/tags/WTF" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WTF</span></a> <a href="https://mastodon.bsd.cafe/tags/frightmare" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>frightmare</span></a> <a href="https://mastodon.bsd.cafe/tags/Infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Infosec</span></a> <a href="https://mastodon.bsd.cafe/tags/nightmare" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>nightmare</span></a> <a href="https://mastodon.bsd.cafe/tags/elmStreet" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>elmStreet</span></a></p>
Dendrobatus Azureus<p>More excerpts </p><p>>></p><p>Sadly the review of deepin-app-services was another chaotic case, one that is actually still unfinished. Even understanding the purpose of this D-Bus service was difficult, because there wasn’t really any design documentation or purpose description of the component. From looking at the D-Bus service implementation, we judged that it is a kind of system wide configuration store for Deepin. Contrary to most other Deepin D-Bus services, this one is not running as root but as a dedicated unprivileged service user.</p><p><<</p><p>This reads like a horror novel but it's actually happening! Unbelievable how this has harmed a distro with many dedicated users!</p><p><a href="https://security.opensuse.org/2025/05/07/deepin-desktop-removal.html" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">security.opensuse.org/2025/05/</span><span class="invisible">07/deepin-desktop-removal.html</span></a></p><p><a href="https://mastodon.bsd.cafe/tags/openSUSE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>openSUSE</span></a> <a href="https://mastodon.bsd.cafe/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a> <a href="https://mastodon.bsd.cafe/tags/POSIX" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>POSIX</span></a> <a href="https://mastodon.bsd.cafe/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OpenSource</span></a> <a href="https://mastodon.bsd.cafe/tags/programming" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>programming</span></a> <br><a href="https://mastodon.bsd.cafe/tags/Deepin" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Deepin</span></a> <a href="https://mastodon.bsd.cafe/tags/wtf" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>wtf</span></a> <a href="https://mastodon.bsd.cafe/tags/frightmare" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>frightmare</span></a> <a href="https://mastodon.bsd.cafe/tags/Infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Infosec</span></a> <a href="https://mastodon.bsd.cafe/tags/nightmare" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>nightmare</span></a> <a href="https://mastodon.bsd.cafe/tags/elmStreet" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>elmStreet</span></a></p>
Dendrobatus Azureus<p>The Deepin frightmare </p><p>Excerpt from linked site<br>>><br>After reviewing the main D-Bus service, we could not help ourselves but call it a security nightmare. The service methods were not only unauthenticated and thus accessible to all users in the system, but the D-Bus configuration file also allowed anybody to own the D-Bus service path on the system bus, which could lead to impersonation of the daemon. Among other issues, the D-Bus service allowed anybody in the system to create arbitrary new UNIX groups, add arbitrary users to arbitrary groups, set arbitrary users’ Samba passwords or overwrite almost any file on the system by invoking mkfs on them as root, leading to data loss and denial-of-service. The daemon did contain some Polkit authentication code, but it was all found in unused code paths; to top it all off, this code used the deprecated UnixProcess Polkit subject in an unsafe way, which would make it vulnerable to race conditions allowing authentication bypass, if it had been used.<br><<</p><p>¿WTF?</p><p><a href="https://security.opensuse.org/2025/05/07/deepin-desktop-removal.html" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">security.opensuse.org/2025/05/</span><span class="invisible">07/deepin-desktop-removal.html</span></a></p><p><a href="https://mastodon.bsd.cafe/tags/openSUSE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>openSUSE</span></a> <a href="https://mastodon.bsd.cafe/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a> <a href="https://mastodon.bsd.cafe/tags/POSIX" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>POSIX</span></a> <a href="https://mastodon.bsd.cafe/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OpenSource</span></a> <a href="https://mastodon.bsd.cafe/tags/programming" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>programming</span></a> <br><a href="https://mastodon.bsd.cafe/tags/Deepin" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Deepin</span></a> <a href="https://mastodon.bsd.cafe/tags/WTF" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WTF</span></a> <a href="https://mastodon.bsd.cafe/tags/frightmare" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>frightmare</span></a> <a href="https://mastodon.bsd.cafe/tags/Infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Infosec</span></a> <a href="https://mastodon.bsd.cafe/tags/nightmare" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>nightmare</span></a> <a href="https://mastodon.bsd.cafe/tags/elmStreet" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>elmStreet</span></a></p>
SaltiredPopcorn 🏴😈<p><a href="http://foritismansnumber.blogspot.com/2024/10/frightmare-1974.html" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">http://</span><span class="ellipsis">foritismansnumber.blogspot.com</span><span class="invisible">/2024/10/frightmare-1974.html</span></a></p><p>The <span class="h-card" translate="no"><a href="https://a.gup.pe/u/horror" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>horror</span></a></span> review on the blog today is some Pete Walker goodness.</p><p><a href="https://bbq.snoot.com/tags/blog" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>blog</span></a> <a href="https://bbq.snoot.com/tags/blogger" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>blogger</span></a> <a href="https://bbq.snoot.com/tags/review" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>review</span></a> <a href="https://bbq.snoot.com/tags/MovieReview" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MovieReview</span></a> <a href="https://bbq.snoot.com/tags/PeteWalker" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PeteWalker</span></a> <a href="https://bbq.snoot.com/tags/SheilaKeith" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SheilaKeith</span></a> <a href="https://bbq.snoot.com/tags/frightmare" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>frightmare</span></a> <a href="https://bbq.snoot.com/tags/horror" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>horror</span></a> <a href="https://bbq.snoot.com/tags/film" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>film</span></a> <a href="https://bbq.snoot.com/tags/filmastodon" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>filmastodon</span></a></p>
TrendingLive feeds
Mastodon is the best way to keep up with what's happening.
Follow anyone across the fediverse and see it all in chronological order. No algorithms, ads, or clickbait in sight.
Create accountLoginDrag & drop to upload