• 0 Posts
  • 37 Comments
Joined 1 year ago
cake
Cake day: July 24th, 2023

help-circle
  • Perfect example of a (part of a) security vulnerability being fixed in a commit that doesn’t immediately seem security related and would never be back ported to a stablestale distro

    The code which parses the binary MaxMind database after decompression is well guarded as of 2024 but used to look different, potentially providing more attack surface. There is also an interesting commit where a contributor makes adjustments to the gzip::decompress() function which hints at a stack overflow, as the destination buffer was changed from static allocation on the stack to dynamic allocation on the heap, though it was not exploitable due to checks before it is written to











  • Before trying the conversion, I suggest checking if you are missing a library that strawberry needs (probably libopus or libopusfile). For me, strawberry reads opus files perfectly normally, so I wonder if yours is falling back to using ffmpeg or something to decide them

    If you really must convert, use Vorbis with the variable bitrate mode -q6 (or -q:a 6 option in ffmpeg) which usually ends up around 192 kbps, or push it up one more to q7 which will be a little higher. This is the level that is usually transparent, but do keep in mind that any conversion between lossy codecs is much more likely to cause perceivable loss in quality than a conversion from a lossless source. Btw opus is the direct successor to Vorbis and is superior in quality per bitrate (128k is what YouTube uses and is indistinguishable the vast majority of the time). It’s probably better than 320k mp3 at least



  • It’s unfortunate that the other users are ignoring your actual question… You should still be able to bind qbittorrent to the wireguard interface, and you definitely MUST do so in order to make sure you’re safe (if the VPN drops, you don’t want it to fall back on your normal connection). If you aren’t sure what the wireguard interface is names, try running ip a before and after activating the VPN connection and compare them.

    Port forwarding allows other users to connect directly to your torrent client. Without it, it’s much more difficult for you to connect to other people who aren’t port forwarded (though not impossible if there’s a third, mutually connected client who can facilitate initiating the connection). Things will generally still work without it, but youll connect to fewer people, so it might be slower. And if you’re downloading rare torrents, you might have to be patient and wait for someone else to join and facilitate the connection



  • Facebook may be evil but I don’t think they’re anywhere near “inject malware into global supply chains to push adoption of a public engineering side project that they don’t directly profit from and most executives don’t care about” level of evil. Is it possible? Sure anything is possible, but that is wildly beyond many many more plausible explanations and there’s zero evidence leading us down this path. And why would they go through the trouble of backdooring zstd, which has a highly observed codebase, when they just successfully backdoored lzma because it didn’t have a lot of maintainers?

    While it’s true that zstd is commonly favored for having “good” compression at blazingly fast speeds, which is useful on the web and on servers, Zstd 's max compression setting (zstd --long -19) is actually within about 5% of LZMA’s but faster, so it replaces most use cases of LZMA except when that extra 5% (and that’s not even constant; some inputs are even better on zstd) really does matter at all speed cost


  • The first 3 seem incredibly far-fetched.

    • What exactly does Facebook gain from more people using zstd, other than more contributions and improvement to zstd and the ecosystem (i.e. the reason corporations are willing to open source stuff).
    • Why do you consider zlma to be loved among pirates and hackers and zstd not to be, when zstd is incredibly popular and well-loved in the FOSS community and compresses about as well as lzma?
    • Every person in the world uses both lzma and zstd extensively, even if indirectly without them realizing it.

    I think it’s likey that, of all the mainstream compression formats, lzma was the least audited (after all, it was being maintained by one overworked person). Zstd has lots of eyes on it from Google and Facebook, all of the most talented experts in the world on data compression contributing to it, and lots of contributors. Zlib has lots of forks and overall probably more attention than lzma. Bz2 is rarely used anymore. So that leaves lzma