#wtf

Was zum F*ck!?https://bnn.de/kraichgau/bretten/oberderdingen/kommt-in-der-region-das-aus-fuer-das-deutschlandticket
Kommt jemand an den Volltext? Was geht in deren Köpfen vor?

#WTF #Karlsruhe #Deutschlandticket #AlleBekloppt #Verkehrswende #ÖPNV

This is where the depth of the deception became clear

>>

The review of this component was also what led us to the discovery of the deepin-feature-enable whitelisting bypass, since we installed the full Deepin desktop environment for the first time in a long time, which triggered the “license agreement” dialog described above. After finding out about this, we decided that it was time to reassess the overall topic of Deepin in openSUSE based on our long-standing experiences.

<<

https://security.opensuse.org/2025/05/07/deepin-desktop-removal.html#2021-02-01-dtkcommon-filedrag-d-bus-service

#openSUSE #Linux #POSIX #OpenSource #programming
#Deepin #WTF #frightmare #Infosec #nightmare #elmStreet

This part I screen capped for accentuation

>>

2024-08-29: deepin-api-proxy: D-Bus Service

After a longer time of standstill regarding Deepin reviews, a request for the addition of deepin-api-proxy arrived. This package greeted us with over two dozen D-Bus configuration files. Again, upstream’s description of what the component is supposed to do was very terse. From looking at the implementation we deduced that the proxy component seems to be related to the renaming of interfaces described in the previous section.

We found a design flaw in the proxy’s design which allowed a local root exploit. You can find the details in a dedicated blog post we published about this not too long ago.

It is noteworthy that the communication with upstream proved very difficult during the coordinated disclosure process we started for this finding. We did not get timely responses, which nearly led us to a one-sided publication of the report, until upstream finally expressed their wish to follow coordinated disclosure at the very last moment.

<<

I now have really seen it all The Good the Bad and the Ugly in Open Source programming

https://security.opensuse.org/2025/05/07/deepin-desktop-removal.html#2021-02-01-dtkcommon-filedrag-d-bus-service

#openSUSE #Linux #POSIX #OpenSource #programming
#Deepin #WTF #frightmare #Infosec #nightmare #elmStreet

More excerpts

>>

Sadly the review of deepin-app-services was another chaotic case, one that is actually still unfinished. Even understanding the purpose of this D-Bus service was difficult, because there wasn’t really any design documentation or purpose description of the component. From looking at the D-Bus service implementation, we judged that it is a kind of system wide configuration store for Deepin. Contrary to most other Deepin D-Bus services, this one is not running as root but as a dedicated unprivileged service user.

<<

This reads like a horror novel but it's actually happening! Unbelievable how this has harmed a distro with many dedicated users!

https://security.opensuse.org/2025/05/07/deepin-desktop-removal.html

#openSUSE #Linux #POSIX #OpenSource #programming
#Deepin #wtf #frightmare #Infosec #nightmare #elmStreet

The Deepin frightmare

Excerpt from linked site
>>
After reviewing the main D-Bus service, we could not help ourselves but call it a security nightmare. The service methods were not only unauthenticated and thus accessible to all users in the system, but the D-Bus configuration file also allowed anybody to own the D-Bus service path on the system bus, which could lead to impersonation of the daemon. Among other issues, the D-Bus service allowed anybody in the system to create arbitrary new UNIX groups, add arbitrary users to arbitrary groups, set arbitrary users’ Samba passwords or overwrite almost any file on the system by invoking mkfs on them as root, leading to data loss and denial-of-service. The daemon did contain some Polkit authentication code, but it was all found in unused code paths; to top it all off, this code used the deprecated UnixProcess Polkit subject in an unsafe way, which would make it vulnerable to race conditions allowing authentication bypass, if it had been used.
<<

¿WTF?

https://security.opensuse.org/2025/05/07/deepin-desktop-removal.html

#openSUSE #Linux #POSIX #OpenSource #programming
#Deepin #WTF #frightmare #Infosec #nightmare #elmStreet

#sycamoregap

The evil men who cut down the #sycamoretree wanted to be famous?

Are you effing KIDDING me?!

Idiots. May their names be forgotten long before they turn to dust then.

Prison will be good too.

#WTF #trees #tree

Why do f-ing websites keep having a f-ing choice about f-ing NECESSARY COOKIES ONLY while they're clearly not f-ing sufficient to prevent f-ing questions about f-ing cookies the next f-ing time I visit the f-ing site?!

Can these f-ing "developers" get their f-ing sh-t together ...

#privacy #cookies #tantrum #necessarycookiesonly #wtf #tgif #devops #development #webdev

https://www.lemonde.fr/international/article/2025/05/09/donald-trump-nomme-une-presentatrice-de-fox-news-au-poste-de-procureure-de-washington_6604370_3210.html #WTF

#News #Pope #WTF
No matter what; he can even be Che Guevara or some true progressive, the message that #Rapist47 will send is
I DID IT

I may have found a way to convert clothing into weed killer.

#capitalism #industry #fail #wtf #lol

#wtf #funny #humor #pic #fail #pics #picture

@Genstart @MEActNOW

I'll see your #WTF and raise you a #WTAF.

Heute Morgen hat das Teil einfach gedacht, dass #WLAN nicht mehr funktionieren müsste.

Neustart hat nichts gebracht.

Aber man musste im WLAN Einstellfenster auf den Link „Problem lösen“ klicken und nach 2min ging es dann wieder.

#wtf #windows

For some reason, #MoveInSync needs to store 2+ GB of “documents & data” on my #iPhone.

#WTF? WHY?

#India #Bangalore #iOS

Saw someone wearing a #MoveInSync t-shirt in #NammaMetro yesterday and was *so tempted* to accost them to give in-person feedback on this garbage of an app.

(Bug-reports via the app, email-feedback, etc. seemingly go to /dev/null. )

#WTF #India #Bangalore

The #MoveInSync app crashes so often on #iOS that it’s barely usable.

It’s not just me — multiple folks in my company & elsewhere have been complaining about this — see the App Store reviews.

Don’t even get me started on its scheduling & pick-up idiocies.

#WTF

#Fahrradparkhaus Am Hauptbahnhof · #Frankfurt am Main

https://maps.app.goo.gl/81iPCJ1jf9NmvzBg9

Laut Rezensionen bei Google wohl eher eine Einladung an Fahrraddiebbe.

#wtf

Auftragsverarbeiter übergibt seine #TOM zur Prüfung. Ich muss jetzt erstmal atmen, sonst werde ich gleich überdeutlich. Die meinen das tatsächlich ernst. #WTF

Kleiner Praxis-Tipp: Frage Dich, ob Du selbst Deine hochsensiblen Daten (Art. 9 und 10!) jemandem anvertrauen würdest, der Sicherheit mit einer derart plakativen Gleichgültigkeit behandelt? Kaum, oder? #Datenschutz #Privacy #Sicherheit

Useless Facts, Badly Drawn #113: Trap Streets and Paper Streets.
.
.
.
#trapstreet #paperstreet #maps #cartography #copyright #copyrightviolation #theft #intellectualproperty #intellectualpropertytheft #fightclub #didyouknow #trivia #facts #funfacts #bizarrefacts #wtf #webcomic #comics #uselessfacts #uselessfactsbadlydrawn

wtf? By using X's Grok AI you now directly harm people in Memphis, TN. They get gassed and you get AI slop.

https://www.politico.com/news/2025/05/06/elon-musk-xai-memphis-gas-turbines-air-pollution-permits-00317582

#wrongTimeLine #wtf