qyliss changed the topic of #spectrum to: A compartmentalized operating system | https://spectrum-os.org/ | Logs: https://logs.spectrum-os.org/spectrum/
<Shell> qyliss: whatever Django it's running on still has a known logout CSRF vuln :p
<Shell> (it is mostly just annoying cos all it can do is log someone out, but.)
<MichaelRaskin> Does it has a matching _login_ CSRF vulnerability?
<Shell> I don't believe so.
<MichaelRaskin> Argh. I can imagine a threat model where CSRF login vulnerability _does_ make a CSRF logout vulnerability worse.
jmcasey has quit [Quit: My MacBook Air has gone to sleep. ZZZzzz…]
jmcasey has joined #spectrum
jmcasey has quit [Client Quit]
jmcasey has joined #spectrum
<colemickens> can sommelier be used without a chromium kernel
jmcasey has quit [Quit: My MacBook Air has gone to sleep. ZZZzzz…]
jmcasey has joined #spectrum
jmcasey has quit [Client Quit]
cole-h has quit [Ping timeout: 264 seconds]
pie_[bnc] is now known as pie_
pie_ is now known as pie__
pie__ is now known as pi^e
pi^e is now known as pi^e_
pi^e_ is now known as pie_[bnc]
xantoz has quit [Ping timeout: 256 seconds]
xantoz has joined #spectrum
<qyliss> colemickens: not with an upstream kernel
<qyliss> But you could take just the virtio_wl kernel from the Chromium kernel
<qyliss> *kernel module
<qyliss> I plan to do that at some point, but it's not a high priority
<colemickens> Are you saying its already built as an external kernel module and I could write a derivation for it, or would that require some kernel knowledge to do an extraction?
<qyliss> (I have tested before that it works, though)
<colemickens> I'm a kernel noob.
<qyliss> It's an in-tree module
<qyliss> So extracting it would be tricky
<qyliss> But copying it to your own kernel tree wouldn't be
<qyliss> (Probably)
<qyliss> Probably extracting it wouldn't be too bad, actually, but you'd have to know what you were doing I think
<MichaelRaskin> AFAIR out-of-tree modules have just a few variables in the Makefile different
<colemickens> Okay, cool, thanks for explaining.
<qyliss> I think when I tested it I just did a git log on devices/virtio/virtio_wl.c and cherry-picked every commit onto upstream
<qyliss> Shell: got any more info about the logout CSRF?
<MichaelRaskin> qyliss: what more info could even exist? A third-party site could cause a POST to the Django site causing a logout
<qyliss> What version of Django doesn't have it
<qyliss> Is there a patch for it
<qyliss> etc
<qyliss> Because this is our default Nixpkgs Django and despite the limited potential for abuse, it would be good to not have it
ehmry has quit [Quit: https://quassel-irc.org - Chat comfortably. Anywhere.]
ehmry has joined #spectrum
ehmry has quit [Quit: https://quassel-irc.org - Chat comfortably. Anywhere.]
ehmry has joined #spectrum
<qyliss> Goog also seems to be working on some io_uring stuff in crosvm
<MichaelRaskin> Autobalancing of the balooning in the context of a lot of VMs running in parallel sounds a bit scary
<puck> note that crosvm is designed to run one VM on the system, so this system isn't too weird
<qyliss> Shell: thank you :)
<qyliss> "9 years ago"
<Shell> yup
<Shell> still an issue iirc
<Shell> I came across it independently
<qyliss> wowww
<Shell> also you can hit it even if you're not an admin, despite it being the admin app's logout endpoint, lol.
cole-h has joined #spectrum
jmcasey has joined #spectrum