℉ⅈℕℹℸℽ @finity@qoto.org

Solr is vulnerable if you grab the right version from Docker Hub (8.8.0 works nicely). But - the Java executable in there is from within the last few years, and those all disallow remote code includes via JNDI... So by default it's not going to give you RCE - at least not with the method commonly cited.

I learned some things.

Mostly done with my #log4shell range - Terraform and Ansible deploy it to AWS so you can play around with log4shell.

https://github.com/kc0bfv/log4j_range

https://youtu.be/jTM9-nudFBA

Great little short. #dust

Rough morning for somebody.

I35 in Kansas miles 40-60 always fly past. In either direction you come out of hours of placid plains into comparably dazzling suburbia of Wichita. I can't help but look around almost in wonder, my mind soaking in the distraction. By the time I catch my bearings we're out the other side driving through the fields again.

This party monster massacred the other decor...

Thanks Reddit

I spent way too long on Elastic given that their docs say it isn't exploitable due to mitigations... Oh well.

Spent a few hours last night trying to get #log4j RCE on fresh ElasticSearch, Jetty, and Solr (not enough time on this one) installs. But no luck.

@lain carry moonbeams home in a jar

Morning leaving Colorado

Support #EFF this week, and your donation will pack double the punch with an automatic 2X match... https://eff.org/power-up

Supreme court might eliminate RvW? Make it a law. That's the right way to do these things anyway. (I understand the complication around this, but if it's ever gonna happen this is the best time I've seen so far)

@ken_fallon this answer recommends the mouse hack because then it'll work easily with existing software.

https://ham.stackexchange.com/questions/1256/using-a-morse-code-key-with-a-computer

I was gonna recommend something like the Sega Genesis joypad driver, or DB9 joystick driver. I messed with that years ago and the electrical connections are simple and translate easily to the driver, and the driver was easy to modify to have the button behavior be different. I'm not sure that type of setup would work with whatever software you want to use though.