News

CVE-2024-39908 : DoS in REXML

by

There is a DoS vulnerability in REXML gem. This vulnerability has been assigned the CVE identifier CVE-2024-39908. We strongly recommend upgrading the REXML gem.

Details

When it parses an XML that has many specific characters such as <, 0 and %>. REXML gem may take long time.

Please update REXML gem to version 3.3.2 or later.

Affected versions

  • REXML gem 3.3.2 or prior

Credits

Thanks to mprogrammer for discovering this issue.

History

  • Originally published at 2024-07-16 03:00:00 (UTC)

Posted by watson1978 on 16 Jul 2024

I told you so: Mozilla working with Facebook to weaken Firefox’ privacy and anti-tracking features

by
I’ve long been warning about the dangers of relying on just one browser as the bullwark against the onslaught of Chrome, Chrome skins, and Safari. With Firefox’ user numbers rapidly declining, now stuck at a mere 2% or so – and even less on mobile – and regulatory pressure possibly ending the Google-Mozilla deal with makes up roughly 80% of Mozilla’s income, I’ve been warning that Mozilla will most likely have to start making Firefox worse to gain more temporary revenue. As the situation possibly grows even more dire, Firefox for Linux would be the first on the chopping block. I’ve received quite a bit of backlash over expressing these worries, but over the course of the last year or so we’ve been seeing my fears slowly become reality before our very eyes, culminating in Mozilla recently acquiring an online advertising analytics company. Over the last few days, things have become even worse: with the release of Firefox 128, the enshitification of Firefox has now well and truly begun. Less than a month after acquiring the AdTech company Anonym, Mozilla has added special software co-authored by Meta and built for the advertising industry directly to the latest release of Firefox, in an experimental trial you have to opt out of manually. This “Privacy-Preserving Attribution” (PPA) API adds another tool to the arsenal of tracking features that advertisers can use, which is thwarted by traditional content blocking extensions. ↫ Jonah Aragon If you have already upgraded to Firefox 128, you have automatically been opted into using this new API, and for now, you can still opt-out by going to Settings > Privacy & Security > Website Advertising Preferences, and remove the checkmark “Allow websites to perform privacy-preserving ad measurement”. You were opted in without your consent, without any widespread announcement, and if it wasn’t for so many Firefox users being on edge about Mozilla’s recent behaviour, it might not have been snuffed out this quickly. Over on GitHub, there’s a more in-depth description of this new API, and the first few words are something you never want to hear from an organisation that claims to fight tracking and protect your privacy: “Mozilla is working with Meta”. I’m not surprised by this at all – like I, perhaps gleefully, pointed out, I’ve been warning about this eventuality for a long time – but I’ve noted that on the wider internet, a lot of people were very much unpleasently surprised, feeling almost betrayed by this, the latest in a series of dubious moves by Mozilla. It’s not even just the fact they’re “working with Meta”, which is entirely disqualifying in and of itself, but also the fact there’s zero transparency or accountability about this new API towards Firefox’ users. Sure, we’re all technologically inclined and follow technology news closely, but the vast majority of people don’t, and there’s bound to be countless people who perhaps only recently moved to Firefox from Chrome for privacy reasons, only to be stabbed in the back by Mozilla partnering up with Facebook, of all companies, if they even find out about this at all. It’s right out of Facebook’s playbook to secretly experiment on users. This is what I wrote a year ago: I’m genuinely worried about the state of browsers on Linux, and the future of Firefox on Linux in particular. I think it’s highly irresponsible of the various prominent players in the desktop Linux community, from GNOME to KDE, from Ubuntu to Fedora, to seemingly have absolutely zero contingency plans for when Firefox enshittifies or dies, despite everything we know about the current state of the browser market, the state of Mozilla’s finances, and the future prospects of both. Desktop Linux has a Firefox problem, but nobody seems willing to acknowledge it. ↫ Thom Holwerda It seems my warnings are turning into reality one by one, and if, at this point, you’re still not worried about where you’re going to go after Firefox starts integrating even more Facebook technologies or Firefox for Linux gets ever more resources pulled away from it until it eventually gets cancelled, you’re blind.

OPPO Watch X review con 1 mes de uso | Quiero que los smartwatch sean así

by
️ OPPO Watch X en Amazon España: https://amzn.to/3zykavq ️

Te cuento mi experiencia después de un mes de uso con el OPPO Watch X, uno de los mejores relojes del mercado y mi favorito para los usuarios con Android que buscan el equilibrio ante todo, diseño, pantalla, batería y todo lo que necesites a nivel de software.

00:00 OPPO Watch X review 1 mes de uso
00:15 Diseño
01:48 Pantalla
03:41 Batería
05:19 Carga
07:55 Rendimiento
09:05 Wear OS
10:35 OHealth
13:05 Precios
13:35 OPPO Watch X, ¿vale la pena?

#urbantecno #oppo #oppowatchx #smartwatch

⭐ TOP VIDEOS (+1M VIEWS) ⭐
https://youtu.be/iyNeG9mSAfg
https://youtu.be/kTEAlfONnrk
https://youtu.be/B6EhtzsyFAI

Equipo de Rubén
Nikon Z 30 https://amzn.to/47o8Kpd
Viltrox 23 mm f/1.4 https://amzn.to/48sEDyA
K&F Concept 210 Tripod https://amzn.to/48kZF21
Samsung SSD T5 EVO https://amzn.to/48jiy5t
️ Comica CVM-VM20 https://amzn.to/3vpdGNp
Lenovo Legion 5 https://amzn.to/47t8nd4
iPhone 15 Pro Max https://amzn.to/48Gz92H
Samsung Galaxy Buds2 Pro https://amzn.to/48nonif

↡ Más info ↡
Visita nuestra WEB: https://urbantecno.com/ ️
Más vídeos en TIKTOK: https://www.tiktok.com/@urbantecno
Únete a TELEGRAM: https://t.me/urbantecno ️
Más info en TWITTER: https://twitter.com/UrbanTecno

Enable local-to-anchors tables in PF rules

by
In a recent post to tech@ titled let’s make pf(4) anchors and tables better friends (possibly originating at the ongoing hackathon) Alexandr Nedvedicky (sashan@) introduced code to enable creating local tables inside anchors in pf(4) rulesets:

Date: Sat, 13 Jul 2024 14:32:21 +0200
From: Alexandr Nedvedicky <sashan () fastmail ! net>
To: tech@openbsd.org
Subject: let's make pf(4) anchors and tables better friends

Hello,

the change presented in diff below allows user to define table
inside the anchor. Consider rules here:

Read more…