XMPP Service Operators - 2022-01-26

Get to patching all the things https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034

Unless you run openbsd, you folks have the day off

i'm terafucked D:

the advisory is definitely enough info to build an exploit. patch asap.

jonas’: https://www.bleepingcomputer.com/news/security/linux-system-service-bug-gives-root-on-all-major-distros-exploit-released/

how can i find out, to which device a omemokey belongs... i know. it is almost impossible. the background... i've got one new omemokey in a timespan, where all 4 verified keys and the according devices have been next to me... can i find out an ip-address on the serverlogs, where the key came from? i distruted this key... but i'm really serious... do i've forgotten another device? (the other laptop, i made new, with new gajim and key wasn't it. I got no key from, when i checked it... because the omemo-plugin isn't working there!)

Good to know: https://www.bleepingcomputer.com/news/security/lets-encrypt-is-revoking-lots-of-ssl-certificates-in-two-days/

how many are actually using the TLS-ALPN challenge though? I didn't know it existed...

Me neither, sounds rad ✏