Seems generated. Also why no llamafile?

sorry it was generated and was supposed to be a test and not to be posted. thanks for the llamafile suggestion!

That metal does not seem very bare if it requires a coating of AWS/GCP/Azure.

The org takes responsibility. If you want to additionally name & blame an exec feel free.

This sounds very AI written and buries the lede, but my understanding is if you control the repo in a way that you can set the default branch state for a git repo and get a victim to install a plugin with the same git sha as that branch state you can RCE them?

Pretty bad for a package manager, but this seems like something I would unfortunately expect from a harness/agent.

It’s worse than that.

A user installs a completely safe plugin through a marketplace, the marketplace pins a vetted commit for the plugin, trusting it is safe and will stay safe. If the “safe” plugin’s repo is controlled by an attacker - he can now set the default branch to a malicious version and anyone who installs will get the malicious version, exactly what the SHA pinning exists to protect from.

It gets worse when you consider agents auto-upgrade plugins from marketplaces. The attacker can have a new version, also benign, and open a PR to change the pinned SHA in the marketplace to the new version. Once the marketplace owner approves - do the said rug-pull and now anybody who installed the plugin gets an auto-upgrade to the malicious version.

The real question here is what is the default? Is it opt-in or opt-out?

If the site didn't require login, sure.

Now it'll be "Just don't use the site and encourage anyone else to stay away"

I don't see it in https://archive.org/details/worksofsirthomas0000urqu or https://archive.org/details/bim_early-english-books-1641-170...

I also don't find it on the site of "Klaus Schmeh" that it claims to be on a list of "Top 50 unsolved encrypted messages": https://klausschmeh.net/?s=Cyphral

Looks like the best source I can find is this: https://scienceblogs.de/klausis-krypto-kolumne/2014/11/17/we... which seems real-ish?

It is there in that first link (search for "The Cyphral Distich"). It's missing, however, from this 1653 print: https://archive.org/details/bim_early-english-books-1641-170... (It should appear on that page above the Latin motto.)

> That points to a glaring hole in the modern-day automated web PKI, not Tesla's dangling DNS record.

It's not. They control a long-term high-value asset (the domain tesla.com). They decided to delegate part of that asset to a large number of "random" people that they do not have a contract or agreement with.

Being able to issue certs for cloud IPs has nothing to do with this since it is not a long term asset, and if it is you probably don't delegate it to random people to control unless you do not value that asset.

I'm not a golang person, but does this even compile like that? Do people not even run a build anymore?

go.mod has “module github.com/yourusername/toast” so it will compile but author probably didn’t read the code.

If you are going to make recommendations and promote them to a wide community (linux users) that is predominantly using something that you do not consider advisable for that recommendation (systemd) then it might be good to mention that.

Systemd is probably on 80%+ linux systems that people interact with, and 95%+ that people manually configure.