yingziwu

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Update: I've disabled comments as of 2025-01-26 to avoid everyone having notifications for something a year on if someone wants to suggest a correction. Folks are free to email to suggest corrections still, of course.

Background

Convert Manjaro to Arch Linux

Conversion Script

Download, make, and run script.

$ git clone https://github.com/kskeigrshi/manjaro-to-archlinux.sh
$ cd manjaro-to-archlinux.sh
$ makepkg
$ ./to_arch

About

I faced bandwidth issues between a WG Peer and a WG server. Download bandwidth when downloading from WG Server to WG peer was reduced significantly and upload bandwidth was practically non existent.
I found a few reddit posts that said that we need to choose the right MTU. So I wrote a script to find an optimal MTU.
Ideally I would have liked to have run all possible MTU configurations for both WG Server and WG Peer but for simplicity I choose to fix the WG Server to the original 1420 MTU and tried all MTUs from 1280 to 1500 for the WG Peer.

Testing

On WG server, I started an iperf3 server
On WG peer, I wrote a script that does the following:
- wg-quick down wg0
Edit MTU in the /etc/wireguard/wg0.conf file

Retrieving Auth Token

Run the command:
```
python pixiv_auth.py login
```
This will open the browser with Pixiv login page.

Some hosting providers like scaleway allows to remove the IPv4 from the VPS in order to save 1€/month but doing this will result in losing connectivity to the "IPv4 world".
Or you may have ordered a VPS that only has IPv6 connectivity and you want to access to a resource only accessible from the "IPv4 world".
Here is how to gain your access back to the "IPv4 world".

Change your name servers(s) to DNS64 name servers(s)

Note: You may deploy your own DNS64 & NAT64 server on a separate server by following this tutorial (untested): https://packetpushers.net/nat64-setup-using-tayga/.
Note²: You may find a explanation of what is NAT64 and DNS64 on Wikipedia.

Choose a/multiple DNS64 public server(s) that has/have its own NAT64 public service from this list:

调查目的：了解当前各基于TLS的协议方案中ClientHello的指纹独特性。理论背景见 https://arxiv.org/abs/1607.01639 。

指纹数据库：

naiveproxy v78.0.3904.70-4

（利益相关：我是这个的作者）

	select event_json.json::json->'content'->>'body' as message,
	events.room_id,
	room_stats_state.name,
	events.sender
	from events
	left outer join event_json on
	events.event_id=event_json.event_id
	left outer join room_stats_state on
	room_stats_state.room_id=events.room_id
	where event_json.json::json->'content'->>'body'<>'' and events.sender='@ACCOUNT_NAME:SERVER.DOM';

	for (i in activities()) {
	activityID = activities()[i];
	desktops = desktopsForActivity(activityID)
	for (j in desktops) {
	desktop = desktops[j];
	desktop.wallpaperPlugin = "org.kde.image";
	desktop.wallpaperMode = "Scaled and Cropped";
	desktop.currentConfigGroup = new Array("Wallpaper", "org.kde.image", "General");
	desktop.writeConfig("Image", "file:///home/zhou/Pictures/Bing/AlpineLarches_ZH-CN10557456981_1920x1200.jpg");
	}

	#!/usr/bin/env python3
	#
	# Simple Intel x520 EEPROM patcher
	# Modifies the EEPROM to unlock the card for non-intel branded SFP modules.
	#
	# Copyright 2020,2021,2022 Andreas Thienemann <[email protected]>
	#
	# Licensed under the GPLv3
	#
	# Based on research described at https://forums.servethehome.com/index.php?threads/patching-intel-x520-eeprom-to-unlock-all-sfp-transceivers.24634/

	import requests
	import json
	import random


	Back_URL = 'https://api.bilibili.com/x/web-interface/archive/stat?aid='

	headers = {
	'Cookie': "Replace Me With REAL COOKIE" ,
	'Pragma': 'no-cache',