<Scopeuk>
Well that's "fun" someone published a backdoor in sshd via over loading crypto functions using hooks in xz, it looks like deliberate action on the part of one of the dev[s, caught in respray rawhide and Debian unstable before proper deployment
teepee has quit [Remote host closed the connection]
teepee_ has joined #openscad
teepee_ is now known as teepee
teepee has quit [Remote host closed the connection]
teepee has joined #openscad
<analoq>
Scopeuk: impressive that someone was able to spot it :?
<InPhase>
analoq: A simple backdoor not running high cpu load might have made it out the door. And maybe occasionally has.
<InPhase>
High cpu load is going to get flagged though. People follow up on that sort of thing.
<InPhase>
I hope people are doing the due diligence of systematically looking into all the other contributions this person made to other software packages.
<analoq>
InPhase: i tried to figure out who it was, but no luck. I doubt he will use the same acc/ his true name
mmu_man has quit [Ping timeout: 256 seconds]
mmu_man has joined #openscad
extor has quit [Ping timeout: 268 seconds]
LordOfBikes has quit [Ping timeout: 255 seconds]
<InPhase>
analoq: Oh, that information is being reported widely. It is allegedly co-mainter since 2022 of the xz project, Jia Tan. The relevant commits came from this person's account, and many contacts to various distros were made under this person's name urging them to upgrade to the compromised version.
<InPhase>
analoq: Most people reporting this are holding some possibility that this person's accounts were all wildly compromised, but given the quantity of communication out there under this person's name about the compromised releases, this is not being regarded as the likely explanation.
<InPhase>
Whether it is this person or not, the commits from this person need to be gone over with a fine toothed comb, as clearly their account has been doing malicious things over some stretch of time covering two point releases at minimum.
<pca006132>
I think that maybe libraries that are important to security should have a simpler build system and simpler code for auditing...
LordOfBikes has joined #openscad
<InPhase>
If it is that person, then it could potentially also be a criminal matter.
<InPhase>
pca006132: lol. Quality libraries has been on my better-world wish list for some time, but we are far from it.
<pca006132>
true
<pca006132>
especially due to performance requirements... those libraries often contain various asm/hooks to make it faster
<pca006132>
and making this kind of obfuscation a bit easier to do
<InPhase>
pca006132: The problem is "important to security" is a very huge portion of them, and we pretend otherwise. This was after all just a file compression tool, and a project that went stagnant because it had basically one maintainer for a long time. Prior maintainer Lasse Collin appointed Jia Tan co-maintainer because Lasse just couldn't handle it anymore, and no one else stepped forward to help.
<pca006132>
true
<InPhase>
Obfuscated code is even easier to slip in when nobody is really watching. We're kind of lucky here, relatively speaking, working on an "interesting" project that is experiencing a steady growth in maintainer interest.
<InPhase>
s/maintainer/contributer/ I guess you don't even need to say the word maintainer for a project like this.
mmu_man has quit [Ping timeout: 264 seconds]
J24k62 has joined #openscad
J24k68 has quit [Ping timeout: 250 seconds]
R2robot has quit [Quit: Pull the lever, Kronk. Wrong leverrrrrrr!]
<guso78k>
i got a viable solution until we get a better one working
<InPhase>
guso78: Did you see my example?
<guso78k>
InPhase nope!
<guso78k>
when did you post it ? let me recheck
<guso78k>
i see it now. let me check it out :)
<guso78k>
InPhase looks promising. the cubes are absolutely regularily placed ?
dustinm` has quit [Quit: Leaving]
<guso78k>
The code is great! i just dont understand it yet. in order to finally use it: is it possible to additionally specify direction of x ,y and z axis ?
<guso78k>
and it suppose the points come in a defined order, so its easily predictable, which ones make up a triangle ...
<InPhase>
guso78k: I hardcoded it to a rectangularly defined corner pieces with fixed orientation in order to keep my head straight while writing it.
<InPhase>
I figure one could orient afterward. Or, modify once the reference example is working if it really needed to do other things.
<InPhase>
When you spoke about defining based on a rectangle corners, that's when this solution hit me. This constraint gives the other coordinate for around the corner, as the other point on a rectangular solid.
dustinm` has joined #openscad
<guso78k>
yes, i think i can make it .. after putting your credits into the code :)
<InPhase>
guso78k: My first thought was a 3-way weighted bezier-like calculation, with points that are, in some manner, symmetrically distributed. It's surely possible, but while I think I could work out the math, it wasn't obvious how to arrange the points in such a space. There's no obvious parametric iterator. Maybe 2 axes of "toward the corner" for one and "around the triangle" for the other, but that
<InPhase>
seemed confusing to think about. :)
<InPhase>
But I'll just put that out there as probably not impossible, but it didn't fit within the margin I had available for the problem.
<InPhase>
JordanBrown1: Well that gets you to almost what I actually did... But then you have the problem of trying to get the edge points to line up to a bezier for all three edges, which is lost for the bezier surface collapse if you're not careful. And then you want points inside to be roughly distributed in a good manner so that it doesn't look biased like this triangle is.
<JordanBrown1>
Bias I can't answer. I *think* that lining up the edges is just a matter of using the same control points as the edges that you're trying to line up with.
<InPhase>
Yeah. This is what I did.
<InPhase>
And then auto-picked a sensible middle control point, since that wasn't provided by guso78k's problem definition.
hyvoid2 has quit [Quit: updating my knockoff UNIX install]
<InPhase>
But then I broke it apart to dynamically adjust the point density, in deviation from the normal Bezier surface you would get if you squished one side.
<InPhase>
Otherwise I think it's basically the same math, just reordering the coefficients to only be inside the summations they are over.
<JordanBrown1>
I'm still working on the program a little, trying to make the parameters for the connecting patch be derived from the parameters for the other three patches.
<JordanBrown1>
But that's 30 lines, based on BOSL2.
<guso78k>
JordanBrown1 i think its actual a designer decision, which of the 3 vectors of the joint shall be degenerate. lets see if we can make this user friendly
<JordanBrown1>
I don't think that's really an issue.
<JordanBrown1>
I updated the image a little, making it so none of the edges are boring and symmetric.
<JordanBrown1>
The interesting points are the center two, the two with diagonal lines connecting them to the intersection point.
<JordanBrown1>
I think those two are constrained in two axes each, but the third axis is independent.
<guso78k>
wow. i did not know that someone can alter an image on imgur once uploaded
<JordanBrown1>
it's not exactly altering the image. it's altering the post.
<JordanBrown1>
I deleted the old image from the post, and added a new one.
<guso78k>
so you altered the history of this irc chat ?
<JordanBrown1>
no
<JordanBrown1>
I edited my imgur post
<JordanBrown1>
imgur does not (exactly) store images
<JordanBrown1>
it stores posts, that contain images
<JordanBrown1>
you can edit a post after you initially post it
<InPhase>
:) I usually just add the second image to avoid wildly confusing people. ;)
<InPhase>
guso78k: Did you figure out the tesselation of my solution? I'd like to compare how it looks to JordanBrown1's solution.
<InPhase>
I suspect it will look a bit more axially balanced, but you never know for sure until you see the final thing.
<guso78k>
InPhase sorry, i did not proceed much. i spent some time on moving the origin of the corner somewhere else but then i was continuing on selecting edges in my script
aiyion3 has quit [Remote host closed the connection]
aiyion3 has joined #openscad
<guso78k>
next i extend the fillets to do union and intersection filleting with automatic edge selection
<guso78k>
this is what SDF can do for a long time already, but SDF has other disadvantages ...