bildiba's comments

On: CVE Foundation

[bildiba]

I haven't been actively monitoring for security vulnerabilities ever since I switched from system administration to software development a few decades back. These days, I just read news that talks about high profile vulnerabilities - I do see CVE a lot more than cert.

We used to look at cert: https://www.kb.cert.org/vuls/ I just did a quick search to confirm that it is still there.

What's the difference/relationship between the two?

[iterance → bildiba]

The primary difference is that CVE was unexpectedly killed by the US Government yesterday and the program terminates today.

[readthenotes1 → iterance]

How is the failure to renew a contract "unexpected"?

Contracts have end dates. All parties on the contract know them.

[Wingy → readthenotes1]

I expect they didn’t see it not being renewed coming because the contract was renewed every time for the past 25 years.

On: We're ending our Samsung collaboration

[bildiba]

I switched from Samsung Galaxy (first S, then S3) to OnePlus years back, and I've been a happy camper.

I currently have an OnePlus 9, I've heard no so good (compared to previous) reviews of their newer models, but I'll cross that bridge when I get there. My current phone has been running great for multiple years, minimal bloatware, would recommend.

[warble → bildiba]

I have the 10 pro and although the camera is definitely an improvement over the 5 I used to own, the overall performance is about the same. I still have my 5, and use it a lot for POS stuff and it's great still. I even have a OnePlus 1 around and it still works decently although it struggles a little with some apps. That's a TEN year old phone.

[ot1138 → bildiba]

I have a recent OnePlus and it's been excellent. I like it even more than the older ones I had, which is directionally quite different than my experience with Apple and Samsung.

[magicalhippo → bildiba]

I bought a Motorola G73 5G a few months ago, paid $160 for the 256GB variant including 25% VAT.

Compared to my primary phone, Samsung S21, it's a ridiculous amount of phone for the money.

But I find the default Google apps to be quite limited compared to Samsungs offerings. Google's calculator app has no unit conversion and a very bare-bones "scientific" mode. Google's file app has no way to search for files containing special characters, while Samsung's can do that just fine by using \ to escape the character.

I don't have a SIM in the Motorola as I just use it around the house, other is "work phone", so haven't tested the phone and messaging parts yet, but I recall Samsung were better there too several years ago when my SO had a Sony or something phone.

But yeah, seriously considering getting something else next time around.

[zrm → magicalhippo]

> Google's calculator app has no unit conversion and a very bare-bones "scientific" mode.

Surely there are untold many suitable calculator apps on Google Play or F-Droid?

[magicalhippo → zrm]

But to find one which doesn't suck and has no ads? Possible, but I'd have to spend time on such a trivial thing.

[jpm_sd → magicalhippo]

This one

https://play.google.com/store/apps/details?id=uk.co.nickfine...

[valiant55 → bildiba]

Yeah, I'm honestly afraid to buy a new phone with all the horror stories. I still have my OnePlus 6T, Oxygen is fine but it seems like the ROM scene isn't what it use to be.

On: Podman Desktop v1.5 with Compose onboarding and enhanced Kubernetes pod data

[bildiba]

Even more so if said containers contain Trojans.

Bit more secure than running directly, but if the container is broken out of, attacker directly gets root.

[mmh0000 → bildiba]

Adding to the parent's point. The docker hub is full of malware images and the docker devs could not care less.1.2.3.

1. https://www.bleepingcomputer.com/news/security/docker-hub-re...

2. https://sysdig.com/blog/analysis-of-supply-chain-attacks-thr...

3. https://www.bleepingcomputer.com/news/security/thousands-of-...

[heresie-dabord → mmh0000]

It's often the case with software "repositories". Pypi, npm, Maven... Security is expensive.

An organisation needs money, on-staff security professionals, and (of course) lawyers to explicitly commit to maintaining a package system.

Even MAAMAN (was FAANG) app stores have been exploited.

FYI your second link is broken or dead.