Vlad Vaviloff Vaviloff

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Update: I've disabled comments as of 2025-01-26 to avoid everyone having notifications for something a year on if someone wants to suggest a correction. Folks are free to email to suggest corrections still, of course.

Background

The experience of using Node.JS with TypeScript, ts-node, and ESM is horrible.

There are countless guides of how to integrate them, but none of them seem to work.

Here's what worked for me.

Just add the following files and run npm run dev. You'll be good to go!

`package.json`

PostgreSQL is Enough

Background and Cron Jobs

New Computer Setup

Configuring a new PC takes time. These are the steps I took to piece together my dev environment.

Windows 11

Local Account

To setup a new Windows PC without using a Microsoft account:

Mastodon Docker Setup

In this guide we will only focus on using the prebuilt images from Docker Hub.

Prerequisites: You have Git, Docker, Docker compose and Nginx pre-installed.

Prepare

Clone Mastodon's repository.

ES Modules are terrible, actually

This post was adapted from an earlier Twitter thread.

It's incredible how many collective developer hours have been wasted on pushing through the turd that is ES Modules (often mistakenly called "ES6 Modules"). Causing a big ecosystem divide and massive tooling support issues, for... well, no reason, really. There are no actual advantages to it. At all.

It looks shiny and new and some libraries use it in their documentation without any explanation, so people assume that it's the new thing that must be used. And then I end up having to explain to them why, unlike CommonJS, it doesn't actually work everywhere yet, and may never do so. For example, you can't import ESM modules from a CommonJS file! (Update: I've released a module that works around this issue.)

And then there's Rollup, which apparently requires ESM to be u

	#!/bin/bash
	# https://gist.github.com/Vaviloff/9ee6b0c68393a98a0e9c715ba4063fe3

	# Development box setup script
	# Run as root - sets up system for a user $user

	user="${1:-vaviloff}"

	set -e # Exit on any error

	#! /usr/bin/env node
	import fs from 'fs';
	import { promisify } from 'util';
	import path from 'path';
	import { spawn } from 'child_process';

	const fsExists = promisify(fs.exists);

	if (!process.env.GITHUB_TOKEN) throw new Error("process.env.GITHUB_TOKEN is required");
	if (!process.env.GITHUB_USER) throw new Error("process.env.GITHUB_USER is required");

	# Used on Ubuntu 18.04 and 20.04
	# Find instructions for other OSes here: https://certbot.eff.org/instructions

	# Install Certbot via Snaps
	sudo snap install core; sudo snap refresh core
	sudo snap install --classic certbot
	sudo ln -s /snap/bin/certbot /usr/bin/certbot

	# Install DNS CloudFlare plugin
	sudo snap set certbot trust-plugin-with-root=ok

	# Use systemd for managing NVIDIA driver suspend in drivers ====>>> PRIOR to version 470 <<<=====
	# https://download.nvidia.com/XFree86/Linux-x86_64/450.66/README/powermanagement.html
	# https://forums.developer.nvidia.com/t/unable-to-set-nvidia-kernel-module-parameters/161306
	# Please note: In Fedora Linux you may need to just install the xorg-x11-drv-nvidia-power pakage
	# as sugested by @goombah88 in the comments below.

	TMP_PATH=/var/tmp
	TMPL_PATH=/usr/share/doc/nvidia-driver-460/

	echo "options nvidia NVreg_PreserveVideoMemoryAllocations=1 NVreg_TemporaryFilePath=${TMP_PATH}" \| sudo tee /etc/modprobe.d/nvidia-power-management.conf