home.social

Search

1000 results for “packy”

  1. New #blog #post: Package Manager Tier List

    https://rldane.space/package-manager-tier-list.html

    1521 words

    Note: this is a very off-the-cuff tier list, using speed as the main qualifier, but the article explains exceptions to that as it goes on.

    cc: my wonderful #chorus: @joel @dm @sotolf @thedoctor @pixx @orbitalmartian @adamsdesk @krafter @roguefoam @clayton @giantspacesquid @Twizzay @stfn

    (I will happily add/remove you from the chorus upon request! :)

    #rlDaneWriting #blost #DeadLikeMe #Linux #BSD #RunBSD #FreeBSD #OpenBSD #NetBSD #Debian #Arch #pacman #AUR #Fedora #homebrew #flatpak #snap #OpenSuSE #RPM

  2. What Is a Supply Chain Attack? Lessons from Recent Incidents

    924 words, 5 minutes read time.

    I’ve been in computer programming with a vested interest in Cybersecurity long enough to know that your most dangerous threats rarely come through the obvious channels. It’s not always a hacker pounding at your firewall or a phishing email landing in an inbox. Sometimes, the breach comes quietly through the vendors, service providers, and software updates you rely on every day. That’s the harsh reality of supply chain attacks. These incidents exploit trust, infiltrating organizations by targeting upstream partners or seemingly benign components. They’re not theoretical—they’re real, costly, and increasingly sophisticated. In this article, I’m going to break down what supply chain attacks are, examine lessons from high-profile incidents, and share actionable insights for SOC analysts, CISOs, and anyone responsible for protecting enterprise assets.

    Understanding Supply Chain Attacks: How Trusted Vendors Can Be Threat Vectors

    A supply chain attack occurs when a threat actor compromises an organization through a third party, whether that’s a software vendor, cloud provider, managed service provider, or even a hardware supplier. The key distinction from conventional attacks is that the adversary leverages trust relationships. Your defenses often treat trusted partners as safe zones, which makes these attacks particularly insidious. The infamous SolarWinds breach in 2020 is a perfect example. Hackers injected malicious code into an update of the Orion platform, and thousands of organizations unknowingly installed the compromised software. From the perspective of a SOC analyst, it’s a nightmare scenario: alerts may look normal, endpoints behave according to expectation, and yet an attacker has already bypassed perimeter defenses. Supply chain compromises come in many forms: software updates carrying hidden malware, tampered firmware or hardware, and cloud or SaaS services used as stepping stones for broader attacks. The lesson here is brutal but simple: every external dependency is a potential attack vector, and assuming trust without verification is a vulnerability in itself.

    Lessons from Real-World Supply Chain Attacks

    History has provided some of the most instructive lessons in this area, and the pain was often widespread. The NotPetya attack in 2017 masqueraded as a routine software update for a Ukrainian accounting package but quickly spread globally, leaving a trail of destruction across multiple sectors. It was not a random incident—it was a strategic strike exploiting the implicit trust organizations placed in a single provider. Then came Kaseya in 2021, where attackers leveraged a managed service provider to distribute ransomware to hundreds of businesses in a single stroke. The compromise of one MSP cascaded through client systems, illustrating that upstream vulnerabilities can multiply downstream consequences exponentially. Even smaller incidents, such as a compromised open-source library or a misconfigured cloud service, can serve as a launchpad for attackers. What these incidents have in common is efficiency, stealth, and scale. Attackers increasingly prefer the supply chain route because it requires fewer direct compromises while yielding enormous operational impact. For anyone working in a SOC, these cases underscore the need to monitor not just your environment but the upstream components that support it, as blind trust can be fatal.

    Mitigating Supply Chain Risk: Visibility, Zero Trust, and Preparedness

    Mitigating supply chain risk requires a proactive, multifaceted approach. The first step is visibility—knowing exactly what software, services, and hardware your organization depends on. You cannot defend what you cannot see. Mapping these dependencies allows you to understand which systems are critical and which could serve as entry points for attackers. Second, you need to enforce Zero Trust principles. Even trusted vendors should have segmented access and stringent authentication. Multi-factor authentication, network segmentation, and least-privilege policies reduce the potential blast radius if a compromise occurs. Threat hunting also becomes crucial, as anomalies from trusted sources are often the first signs of a breach. Beyond technical controls, preparation is equally important. Tabletop exercises, updated incident response plans, and comprehensive logging equip teams to react swiftly when compromise is detected. For CISOs, it also means communicating supply chain risk clearly to executives and boards. Stakeholders must understand that absolute prevention is impossible, and resilience—rapid detection, containment, and recovery—is the only realistic safeguard.

    The Strategic Imperative: Assume Breach and Build Resilience

    The reality of supply chain attacks is unavoidable: organizations are connected in complex webs, and attackers exploit these dependencies with increasing sophistication. The lessons are clear: maintain visibility over your entire ecosystem, enforce Zero Trust rigorously, hunt for subtle anomalies, and prepare incident response plans that include upstream components. These attacks are not hypothetical scenarios—they are the evolving face of cybersecurity threats, capable of causing widespread disruption. Supply chain security is not a checkbox or a one-time audit; it is a mindset that prioritizes vigilance, resilience, and strategic thinking. By assuming breach, questioning trust, and actively monitoring both internal and upstream environments, security teams can turn potential vulnerabilities into manageable risks. The stakes are high, but so are the rewards for those who approach supply chain security with discipline, foresight, and a relentless commitment to defense.

    Call to Action

    If this breakdown helped you think a little clearer about the threats out there, don’t just click away. Subscribe for more no-nonsense security insights, drop a comment with your thoughts or questions, or reach out if there’s a topic you want me to tackle next. Stay sharp out there.

    D. Bryan King

    Sources

    Disclaimer:

    The views and opinions expressed in this post are solely those of the author. The information provided is based on personal research, experience, and understanding of the subject matter at the time of writing. Readers should consult relevant experts or authorities for specific guidance related to their unique situations.

    Related Posts

    Rate this:

    #anomalyDetection #attackVector #breachDetection #breachResponse #CISO #cloudSecurity #cyberattackLessons #cybersecurity #cybersecurityGovernance #cybersecurityIncident #cybersecurityMindset #cybersecurityPreparedness #cybersecurityResilience #cybersecurityStrategy #EndpointSecurity #enterpriseRiskManagement #enterpriseSecurity #hardwareCompromise #hardwareSecurity #incidentResponse #incidentResponsePlan #ITRiskManagement #ITSecurityPosture #ITSecurityStrategy #Kaseya #maliciousUpdate #MFASecurity #MSPSecurity #networkSegmentation #NotPetya #organizationalSecurity #perimeterBypass #ransomware #riskAssessment #SaaSRisk #securityAudit #securityControls #SOCAnalyst #SOCBestPractices #SOCOperations #softwareSecurity #softwareSupplyChain #softwareUpdateThreat #SolarWinds #supplyChainAttack #supplyChainMitigation #supplyChainRisk #supplyChainSecurityFramework #supplyChainVulnerabilities #thirdPartyCompromise #threatHunting #threatLandscape #trustedVendorAttack #upstreamCompromise #upstreamMonitoring #vendorDependency #vendorRiskManagement #vendorSecurity #vendorTrust #zeroTrust

  3. Thinking about my Vargr exclave, ran some population numbers.

    The population is a little over 16.6 Billion, probably 85% Vargr, 7% Zhodani, 5% Vilani, and 3% other.

    The vast majority of people are on the capital Okhokferr (9B) and Rekhzor (7B). Only other major planet is Ghaerlag (0.4B), gateway to Zhodani.

    Okhokferr is a theocracy run by Kukh Akaiya, “Members of Akaiya’s Pack”. Led by Roukh Vaergvue, “Emperor Dragon”.

    #TTRPG #Traveller #TravellerRpg #ClassicTraveller #Traveller5 #Vargr

  4. Russia offers Indonesia major nuclear cooperation package

    Russia’s state nuclear corporation Rosatom has offered Indonesia a full-scale cooperation framework to support the development of its…
    #Nuclear #gigawattreactors #Indonesia #indonesiasnuclearambitions #Likhachev #nuclear #NuclearCooperation #Russia
    europesays.com/2989061/

  5. Ces offres Zadig&Voltaire sont trop bien pour passer à côté :

    - Ventes privées Zadig&Voltaire -75%
    - Offre spéciale Anniversaire : -10% -10%
    - Pack multi-articles : -10% supplémentaire -10%

    Consulter : reduc4all.com/boutique/zadig-v

    #CodePromo #BonPlan #Reduc4All #ZadigVoltaire #Mode

  6. ----------------

    🛠️ Tool
    ===================

    Opening: openclaw-ops is an operational skill and script collection designed to manage local or self-hosted OpenClaw gateways. The package focuses on continuous monitoring, automated repair workflows, update/change detection, session-level analysis, and pre-installation security auditing of third-party skills. The bundle was tested against OpenClaw 2026.4.11 and documents a minimum supported baseline of v2026.2.12 due to prior critical fixes including CVE-2026-25253.

    Key Features:
    • Includes a dedicated skill /openclaw-ops to triage gateway configuration and runtime components: gateway, auth, exec approvals, cron jobs, channels, sessions, and installation state.
    • Provides single-purpose scripts such as heal.sh (one-shot auto-fix), post-update.sh (post-update orchestrator), and watchdog.sh (periodic liveness restarter with escalation).
    • Offers session tooling: session-monitor.sh for behavioral checks over JSONL session logs, session-search.sh for full-text search with structured, redacted output, and session-resume.sh to compact a session into a markdown resume with failure context.
    • Supplies operational checks: check-update.sh for version-change detection and explainers, health-check.sh for declarative URL/process checks, and security-scan.sh to score configuration and credential exposure (0–100).

    Technical Implementation:
    • Scripts rely on standard runtime tools (Python3, curl, openssl, ripgrep) and read runtime metadata from ~/.openclaw/openclaw.json, with the option to override the gateway port via the OPENCLAW_GATEWAY_PORT environment variable.
    • The post-update orchestrator sequences update detection, healing, workspace reconciliation (VPS-aware), security scan, and a sentinel trigger via a policy-guard state file (policy-guard.trigger).
    • macOS-specific integration is provided for always-on supervision via a LaunchAgent installer wrapper (watchdog-install.sh), while non-macOS environments are expected to use scheduling alternatives.

    Use Cases:
    • Continuous operations for small self-hosted deployments invoking automated healing and watchdog restarts.
    • Pre-installation vetting of third-party skills via skill-audit.sh to reduce risky dependencies.
    • Incident summarization through daily-digest.sh and a shared incident-manager.sh helper for lifecycle flows.

    Limitations:
    • The watchdog installer is macOS-only; cross-platform uptime requires external schedulers.
    • Several scripts depend on external binaries (e.g., rg, openssl, curl) and assume local file-system state in ~/.openclaw.
    • No bundled remote orchestration; intended for local/self-hosted operators rather than managed SaaS.

    🔹 tool #OpenClaw #security #ops #CVE-2026-25253

    🔗 Source: github.com/cathrynlavery/openc

  7. ----------------

    🛠️ Tool
    ===================

    Opening: openclaw-ops is an operational skill and script collection designed to manage local or self-hosted OpenClaw gateways. The package focuses on continuous monitoring, automated repair workflows, update/change detection, session-level analysis, and pre-installation security auditing of third-party skills. The bundle was tested against OpenClaw 2026.4.11 and documents a minimum supported baseline of v2026.2.12 due to prior critical fixes including CVE-2026-25253.

    Key Features:
    • Includes a dedicated skill /openclaw-ops to triage gateway configuration and runtime components: gateway, auth, exec approvals, cron jobs, channels, sessions, and installation state.
    • Provides single-purpose scripts such as heal.sh (one-shot auto-fix), post-update.sh (post-update orchestrator), and watchdog.sh (periodic liveness restarter with escalation).
    • Offers session tooling: session-monitor.sh for behavioral checks over JSONL session logs, session-search.sh for full-text search with structured, redacted output, and session-resume.sh to compact a session into a markdown resume with failure context.
    • Supplies operational checks: check-update.sh for version-change detection and explainers, health-check.sh for declarative URL/process checks, and security-scan.sh to score configuration and credential exposure (0–100).

    Technical Implementation:
    • Scripts rely on standard runtime tools (Python3, curl, openssl, ripgrep) and read runtime metadata from ~/.openclaw/openclaw.json, with the option to override the gateway port via the OPENCLAW_GATEWAY_PORT environment variable.
    • The post-update orchestrator sequences update detection, healing, workspace reconciliation (VPS-aware), security scan, and a sentinel trigger via a policy-guard state file (policy-guard.trigger).
    • macOS-specific integration is provided for always-on supervision via a LaunchAgent installer wrapper (watchdog-install.sh), while non-macOS environments are expected to use scheduling alternatives.

    Use Cases:
    • Continuous operations for small self-hosted deployments invoking automated healing and watchdog restarts.
    • Pre-installation vetting of third-party skills via skill-audit.sh to reduce risky dependencies.
    • Incident summarization through daily-digest.sh and a shared incident-manager.sh helper for lifecycle flows.

    Limitations:
    • The watchdog installer is macOS-only; cross-platform uptime requires external schedulers.
    • Several scripts depend on external binaries (e.g., rg, openssl, curl) and assume local file-system state in ~/.openclaw.
    • No bundled remote orchestration; intended for local/self-hosted operators rather than managed SaaS.

    🔹 tool #OpenClaw #security #ops #CVE-2026-25253

    🔗 Source: github.com/cathrynlavery/openc

  8. Poldork: Great TV Shows That Never Were 😐

    Poldark stars a hot bloke called Aidan Turner. Poldork stars a not-hot-bloke called Aidan Not-Hot Bloke. The series launched in 2020 and is famous for starring an ugly lead actor.

    The ugly lead actor led to accusations of photosynthesis from naysayers, but the show is pretty good (if you switch your brain off). Ready to be on half brain mode? Dork it up a notch.

    A Walking BO Hazard in Poldork

    To master the Cornish coast of England, a hero doesn’t need a six-pack or rugged jawline. A wife beater vest stained with bacon drippings and beer will suffice, as will a bald cranium and beer belly.

    That is the show of Poldork. With a £50 million budget from the BBC (which some caustic observers have called a travesty of wasted funds), this re-imagining of Winston Graham’s novel is all about BO and bloated incompetence.

    Set in 1983, Private Bob Poldork returns from the Falklands war and sets up home in Cornwall. He finds his family don’t want to speak to him, his wife has left him for someone less ugly, and by gawd Bob Poldork vows to rebuild his life.

    In the 2015 series, Aidan Turner sports an iconic scar on his face. For Poldork, lead actor Cate Blanchett (in heavy costume/makeup disguise for the role) sports varicose veins and a blotchy, big red nose.

    Thus, the series is set to be an okay one.

    Blanchett acts the life out of the role, but a stale script set around Bob working in a fish & chips establishment fails to result in pulse-pounding plot lines. Instead, the series was panned by critics for succumbing to endless scenes of Bob frying fish, chips, and asking customers if they want gravy with that.

    Cate Blanchett’s method acting then takes over.

    Her bewildering commitment to portray the most repulsive man on television is a tour de stench (pun intended). Then one weekend, replicating the famous open field scything topless scene from Poldark, Bob decides to mow the lawn. He gets his kit off, beer belly wobbling all over the place, and is reported to the police by outraged neighbours.

    Whilst in jail, the on-site doctor discovers that Poldork has jaundice and irritable bowel syndrome. He’s released from jail early to spare his fellow inmates. This episode, the last in the series, was panned by critics for being “stupid” and “making no sense”.

    Cate Blanchett responded to the show’s negativity by getting a plane back to her native Australia.

    Public Demands to Reveal the £50 Million Budget

    One of the big fallouts from the show was the use of its £50 million budget, all funded by taxpayers with a BBC licence, with the confusion over where the money was spent. The BBC issued the following statement on 1st January 2021:

    “Shut up. It’s none of your business.”

    The tone was so abrupt and unusually aggressive from the BBC, it effectively silenced 70% of complainants. However, the remaining 30% was so outraged they stormed London and went on a 13-day city-wide riot.

    It resulted in over £300 million in damages, which was dubbed by the angry mob as “revenge” for the wasted £50 million. Indeed. That money could have gone on making another series of Porridge (or something).

    #BO #CateBlanchett #dork #Humor #Lifestyle #Poldark #Poldork #Satire #satirical #Silly #TV #TVShows