I’m not sure what the previous poster was thinking of, but I also thought they were talking about distro packages. I meant my post to be a complement to yours, not a counter-argument.

So far the recommendations I’ve seen have been to update OS ca-certificates, or to manually remove the compromised ones. And the Python devs are saying to update pip and uv. I guess the same goes for npm, but I uninstalled that a long time ago due to the abundance of supply chain attacks. I haven’t seen anyone trustworthy source recommend rolling anything back.

I wonder if they didn’t read this section:

There are no entries in the certificate transparency logs for these intermediates in that period, indicating that CT-enforcing clients like Firefox, Chrome, Edge and Safari could not have been attacked.

or if they did read it, but don’t trust it.

From my amateur investigation, it seems like pip/npm/etc. packages are potential attack vectors, BUT afaik this issue only allows a malicious actor to impersonate a HTTPS server, it doesn’t give them any new means to redirect your connect to their fake server. So if I understand this right, to be directly affected you would have had to:

• Accidentally connected to a fake server, like steamcomnunity instead of steamcommunity.
• Used a network controlled by the malicious actor, for example a public wifi.
• Be targeted by your ISP, a government agency or some other corporation capable of intercepting internet traffic from your own network.

So to me it seems like the risk of being affected is quite low for the average user, BUT (again) I assume that through sheer numbers, there’s a risk that some other developer gets infected by malware or gets their credentials stolen, which in turn could to supply chain attacks in the future.

I guess one thing Pythong developers have to be mindful of is that they might have venvs containing old versions of pip, which aren’t automatically fixed when you upgrade pip on system level

Isn’t that basically what Linus is saying too, in this quote?

*Finnish forest

It’s Palantir (or maybe it was just of one of the founders?) that bought a large chunk of land in Sweden, but to my knowledge they haven’t made their plans for what to do with public

The first speech recognition was introduced 1952, while AI was established as a field of research in 1956, so you are technically correct :) Back when I studied computer science at university, both speech and image recognition was considered AI, but I assume you’re thinking about more recent AI technologies. According to the Computer History Museum it was only using deep neural networks that computers finally could match the accuracy of a human, so pre-AI tools were definitely much less accurate.

SDs kampanjer bygger till stor del på någon sorts luddig idé om att vi svenskar är Sveriges urbefolkning, och att alla andra ska sparkas ut. Att norra sverige skulle ha en annan urbefolkning passar helt enkelt inte in i deras världsbild. Och ifall någon försökte tillämpa någon sorts konsekvent logik, så kanske de till och med skulle komma till slutsatsen att samerna borde ha ännu mer rätt till sin mark.

Men själv tror jag det är enklare än så. Om man struntar i vad SD säger och istället ser till vad de faktiskt gör, så ser de nog bara till internationella storföretags intressen. Samerna och deras rennäring är i vägen för nya gruvor. En ursäkt för övergrepp som som svenska staten begått tidigare vore ju att erkänna att det var fel att tvångsassimilera samerna och att ta deras land.

Men för att vara tydlig, jag tror inte någon är intresserad av att upprepa de historiska övergreppen. Idag skulle det förstås vara mycket enklare att bara juridiskt avskaffa samernas rättigheter, och bestämma att de är helt vanliga svenskar utan någon särskild rätt t.ex. rennäring på land som staten tog från deras förfäder.

The gitlab repo appears to be a dump of random small .c programs and different .tar.gz archives. The download link OP provided is the source.