#api

bkoehn@diaspora.koehn.com

It took way longer than it should have, but I eventually built a Dovecot plugin that adds support for SCRYPT (a password hashing algorithm). My poor cloud servers take too long to compute ARGON2 hashes (which are harder to attack than other algorithms), hence the plugin.

Some kind soul already wrote the code, but it didn’t work on modern versions of Dovecot, and I wanted it built into a Debian package I could add on to a Dovecot in a Docker image. So off to work.

Gitea has a built-in repository for Debian packages, and I used its Gitea Actions to automate the build, packaging and uploading, then I tweaked my Dovecot image to include my new repository and install the plugin from there.

I never built a Debian package before; it turns out that they’re quite simple most of the time, just the files/directories you want to install and some metadata files to indicate dependencies, architectures, versions, etc.

The hardest bit was understanding the API change and fixing the code. Along the way I learned more about Linux libraries and the tools for inspecting them.

All in all it was a fun side project to tackle. I learned the #Dovecot #API, #LibSodium, #Gitea Actions, #Linux libraries, and #Debian packaging. Not a bad way to spend a slow time in my work schedule.

anonymiss@despora.de

Report that ``a stranger obtained my #email address from a large-scale language model installed in #ChatGPT

source: https://gigazine.net/gsc_news/en/20231225-chatgpt-model-delivered-email-personal-information

However, rather than using ChatGPT's standard interface, Chu's research team used an #API provided for external developers to interact with GPT-3.5 Turbo and fine-tune the model for professional use. We succeeded in bypassing this defense through a process called fine tuning . Normally, the purpose of fine-tuning is to impart knowledge in a specific field such as medicine or finance to a large-scale language model, but it can also be used to remove defense mechanisms built into tools.

#security #privacy #ai #technology #problem #news #openAI #exploit

anonymiss@despora.de

#Linkwarden is a self-hosted, #OpenSource collaborative #bookmark manager

source: https://github.com/linkwarden/linkwarden

Features

📸 Auto capture a screenshot, #PDF, and readable view of each webpage.
🏛️ Send your webpage to #Wayback Machine (archive.org) for a snapshot. (Optional)
📂 Organize links by collection, name, description and multiple tags.
👥 Collaborate on gathering links in a collection.
🔐 Customize the permissions of each member.
🌐 Share your collected links with the world.
📌 Pin your favorite links to dashboard.
🔍 Full text search, filter and sort for easy retrieval.
📱 Responsive design and supports most modern browsers.
🌓 Dark/Light mode support.
🧩 Browser extension, managed by the community. Star it here!
⬇️ Import your bookmarks from other browsers.
⚡️ Powerful #API.

enter image description here

#software #internet #web #tool #utility #browser #archive

anonymiss@despora.de

#Hacker gains #admin #control of #Sourcegraph and gives free access to the masses

source: https://arstechnica.com/security/2023/09/pii-leaked-after-sourcegraph-an-ai-driven-service-for-code-development-is-hacked/

The hacker gained administrative access by obtaining an authentication key a Sourcegraph developer accidentally included in a code published to a public Sourcegraph instance hosted on Sourcegraph.com. After creating a normal user Sourcegraph account, the hacker used the token to elevate the account privileges to those of an #administrator. The access token appeared in a pull request posted on July 14, the user account was created on August 28, and the elevation to admin occurred on August 30.

#hack #api #security #cybercrime #internet #news #software