Posts
1284
Following
Hidden
Followers
Hidden
She/Her or It/It's, trans to the people who know me. I'm less active here, oh well...
miifox
repeated
ela@infosec.exchange

Ela

OMG. -froot bug resurfaced. https://seclists.org/oss-sec/2026/q1/89

I see the headlines, "10 years old bug".

My friends, this bug is older. Much older. Not this particular instance, but it is a classical mistake to make. It's a command line injection when calling the login executable.

Some people point to CVE-2007-0882. Solaris had that, almost 20 years ago.

But it's even older than that. It's so old it predates the CVE system. I don't remember exact dates, but we popped Linux and AIX boxes with that, mid 90s.

But it is *even older* than that. Have a look at System V R4, ©1990, getty calling login with unsanitized input:

https://github.com/calmsacibis995/svr4-src/blob/7dabeda6fc10bd1bbd1a84d502f05642b1bf0c9e/cmd/getty/getty.c#L526

But how deep does the rabbit hole go? When was this bug introduced?

Getty called login with user input since the dawn of time (UNIX V2, 1972):

https://www.tuhs.org/cgi-bin/utree.pl?file=V2/cmd/getty.s

But this predates command line arguments in login:

https://www.tuhs.org/cgi-bin/utree.pl?file=V2/cmd/login.s

So, when did this particular command line feature of login appear?

In the BSD universe, -f was introduced with POSIX compatibilitiy in 4.3BSD-Reno:

https://www.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/src/usr.bin/login/login.c

But someone paid attention and filtered out user names starting with - in getty:

https://www.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/src/libexec/getty/main.c

RCS timestamp says 6/29/1990, so same age as SysV R4.

The original 4.3BSD (1986) doesn't filter the user name:

https://www.tuhs.org/cgi-bin/utree.pl?file=4.3BSD/usr/src/etc/getty/main.c

And it does have a -r option in login:

https://www.tuhs.org/cgi-bin/utree.pl?file=4.3BSD/usr/src/bin/login.c

Exploitable? No idea, argv processing might be a problem. I'll find out another day.

In conclusion: bug existed since 1990, it's so easy to make when implementing POSIX that it keeps resurfacing, and at least one person in Berkeley knew since day 0.

0
4
0
miifox
repeated
evacide@hachyderm.io

evacide

Do not store your Bitlocker encryption keys on Microsoft's servers if your threat model includes governments or law enforcement. As this article points out, this is the result of a design choice Microsoft made. It didn't have to be this way.

https://www.forbes.com/sites/thomasbrewster/2026/01/22/microsoft-gave-fbi-keys-to-unlock-bitlocker-encrypted-data/

1
4
0
miifox
repeated
deetwenty@todon.nl

Botch Frivarg

It's fursuit Friday again!

0
1
0
miifox
repeated
mjdxp@labyrinth.zone

mjdxp

as a fedi user, you either only post once every 3 months or you make a post every time you exhale just to let everyone know
2
10
5
miifox
repeated
karb@bark.lgbt

Clep-Karb 🔜 NFC❄️

"Noodle Dragon in front of noodle shop? Now all I need is my noodle bowl to get comfy. Do you want to join?"

📍 Suitwalk Offenburg January
📸 @Setsu

1
7
1
miifox

miifox

For #fursuitFriday have a mii fox being a bit silly on a plushlife wolf

Photo by @botchFrivarg on my #gl690 #analogPhotography
it's a girl fox falling over on…
it's a girl fox riding the plus…
0
0
1
miifox
repeated
charlotte

Charlotte lotteheartplural/Cinny cinny_heart_plural thetadelta ursaminor treblesand

Edited 1 month ago

dutch trains are digital. either you arrive approximately on time or you do not arrive at all
german trains are satanic. you will eventually arrive but the price in terms of time or sanity may be greater than you intended

5
63
130
miifox

miifox

plushlife wolf plushlife wolf #analogPhotography
it's a photo of a plushlife wol…
0
1
1
miifox
repeated
StejfsPhotos@pixelfed.social

Štejf's Photobox

Low effort Fursuit-Photo posting here.

#Furry #Fursuit #FilmPhotography
0
3
1
miifox
repeated
SharkaBytes@oldbytes.space

Coffeehound RetroSharka 🏳️‍⚧️

"Scanned on the Almighty A1200"

A fine bit of Eric W Schwartz's Amy the Squirrel from a Productions archive CD.

Fierce love for the burning bright in '94, much as it did then for me and still today. 💜

0
2
0
miifox
repeated
Neotheta@finfur.net

Neotheta

Posessed 🐾 Speedling for Jeuno

0
4
1
miifox
repeated
Kiro@bark.lgbt

Kiro

do i look cool like you, big bro? 🧢

1
7
1
miifox
repeated
Kiro@bark.lgbt

Kiro

what's better than a fox and a german shepherd? well, a fox-shep of course 🍂

0
4
1
miifox

miifox

mmm could it be i simply don't have a native language?

listening back to my own voice i sure do sound like a foreigner in any language
0
0
0
miifox
repeated
assonix@masto.asonix.dog

digital 'vee

Chadbre noticed he caught your eye :3

Umbreon: Sir Chadrick Eeveeington the Third (he/him)
Art: @flytermo.bsky.social

1
3
0
miifox
repeated
silver-sebastian.bsky.social@bsky.brid.gy

Sebastian Silverfox

It is waaay too cold to not be snuggled into soft yote fur right now.

0
5
2
miifox
repeated
petrillic@hachyderm.io

Chris Petrilli

This gave me a laugh.

2
6
1
miifox

miifox

advantages of a closet-bed, or bedstede in dutch (https://en.wikipedia.org/wiki/Box-bed) from someone who had one as a kid
- you don't roll out
- plushies don't roll out
- you can game in peace
- you can jork it in peace
- nice and warm
- cosy
- it your place and yours only

disadvantages:
- always a few centimeters too small to stretch your legs
- you hit your head a whole damn lot
it's a photo of a closet with a…
0
0
0
miifox
repeated
internetsdairy@mastodon.art

internetsdairy

There are four billion Lego minifigs in the world. Time for Denmark to activate their sleeper army.

0
6
0
miifox

miifox

Trichromes trichromes! #analogPhotography
it's a colour photo of a lego s…
it's a colour photo of a lego s…
0
1
2
Show older
About Raccoon Noises

Rules

  • Hate against minority groups is forbidden. This includes racism, sexism, ableism, xenophobia, homophobia, transphobia, antisemitism, islamophobia, queer exclusionism, etc.
  • Content that is illegal under German Law is not permitted. This especially includes the promotion and dissemination of any Nazi symbolism and ideology, except for education, reporting on past or current events, and antifascist art.
  • Please add content description to all media that you post. This instance automatically adds a CW if it is missing. If you are unable to create one, you can request one via the #DescriptionWanted hashtag
  • Be considerate. Add content warnings for NSFW Content, common phobias, overly long posts, controversial subjects, etc. Please try to avoid flashing images and quickly moving text inside of your posts.
  • NSFW content is generally allowed, but all NSFW content must be properly marked as such, including kinks. Profile images, names, bios, etc must be fully SFW, or they are subject to removal
  • Bots are allowed, however they must be marked as such and must make unlisted posts, may only @ or interact with posts of other users iff they have prompted the bot, or have given explicit permission to do so. Additionally, bots may not post more than 10 posts in a 60 minute interval without interaction.
We highly encourage reporting posts violating our rules, even if they are not on our instance. Your reports will not be ignored. For transparency we publish local moderation decisions for users on this server, and federation moderation decisions on the #FediBlock hashtag.
We do the following moderation automatically:
  • Unlisting of bot posts
  • Modification or removal of posts that cause issues with certain clients

Privacy Policy

What data do we collect?

We collect the following data:
  • Email Addresses from local users
  • Posts and Media uploaded by local users
  • User Profiles and Posts by certain remote users

How do we collect your data?

If you are a user of this instance, we collect and process your data when you sign up for or use interactive features (e.g. Posting) of the Website.
If you are not a local user, we collect your data over the following ways:
  • One of our users has requested to follow your account, and you have accepted the request.
  • One of your posts has been interacted with by a remote account, that a local account has followed. This includes Replies, Repeats, Quotes, Likes, Emoji Reactions, and @-Mentions.
  • You have requested that your post is shown to one of our users (i.e. through @-Mentions or DMs)
  • User Interaction: One of our users has explicitely looked up your profile or one of your posts on this instance, for example to interact with it.
  • You have posted a public post on an instance that participates in the awoo.today relay.

How will we use your data?

We collect your data so that we can:
  • Store and display your posts to our local users
  • Display public posts to anonymous users
  • Deliver your public, unlisted, and private posts to your followers
  • Deliver direct messages to the recipient
  • Allow our users to follow you
  • Allow our users to interact with your posts
As members of the awoo.today relay, we will send posts that you have marked as “public” to all of the other instances participating in the relay.

How do we store your data?

We store your post, profile and account data securely in the Hetzner Datacenter in Falkenstein, Germany. See their DIN ISO/IEC 27001 certification Media is stored on Vultr
We employ technical security measures to avoid exposure to sensitive data.
We also store backups of post, profile, and account data in multiple locations, in an encrypted form, on our server near Chemnitz, Germany, as well as on Vultr.
For technical reasons it is not possible modify these backups to remove your data. If this is a concern, please contact us.

What are your data protection rights?

We want to make sure that you are aware of your data protection rights. Every user is entitled to the following:
The right to access — You can request a copy of the data we have about you. This may require a short verification for remote users. Local users can do so in the settings under Export/Import
The right to rectification — You can request us to correct any information you believe is inaccurate. You also have the right to request us to complete the information you believe is inaccurate.
The right to erasure — You can request us to erase the data we have about you.
The right to restrict to processing — You can restrict us from transmitting your posts to other servers by setting your post visiblity to “Local”. Remote users can also restrict processing of certain posts, by setting its visiblity to “Unlisted” or “Private”.
The right to object to processing — As a remote user, you can object to further processing of posts and profile data by blocking this domain.
The right to data portability — You can at any point move to other instances. Due to technical restrictions, it is currently not possible to automatically transfer the users you follow and posts to your new account.
If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, or need help with the included tools, please contact us at our email privacy@chir.rs

Cookies

Cookies are text files placed on your computer to collect standard Internet log information and visitor behavior information. When you visit our websites, we may collect information from you automatically through cookies or similar technology
For further information, visit allaboutcookies.org.

How do we use cookies?

We use cookies for keeping you logged in. Additionally we store certain configuration in cookies, however these cookies are never transmitted to anyone.

How to manage cookies

You can tell your browser to not accept cookies, or tell it to remove cookies this website has stored on your device. Please consult your browser’s documentation on instructions on how to do that.

Privacy policies of other websites

This site contains many links to other websites. This privacy policy only applies to this website. Please consult the privacy policy of these remote sites before entering any personal information.

Changes to our privacy policy

We may make occasional adjustments to this privacy policy. This policy was last updated on 2022-12-30.

How to contact us

If you have any questions about this policy, the data we hold about you, or want to exercise one of your data protection rights, please contact us at: privacy@chir.rs

How to contact the appropriate authority

Should you wish to report a complaint, or if you feel that we haven’t addressed your concern in a satisfactory manner, you may contact the Sächsische Datenschutzbehörde.
We also offer the Mastodon Web UI. Keep in mind that some features are missing, like emoji reactions, quoting, and JPEG XL.

Art Credit