From 8d8fa15c00946e77f1c4db652aca7bbedc6b275b Mon Sep 17 00:00:00 2001 From: Maxime Bonin Date: Sat, 6 Apr 2024 20:13:31 -0400 Subject: [PATCH 1/2] new post xz --- src/images/xz.png | Bin 0 -> 18985 bytes src/pages/posts/083-xz.md | 32 ++++++++++++++++++++++++++++++++ 2 files changed, 32 insertions(+) create mode 100644 src/images/xz.png create mode 100644 src/pages/posts/083-xz.md diff --git a/src/images/xz.png b/src/images/xz.png new file mode 100644 index 0000000000000000000000000000000000000000..09b011e398dac01d3856aff2644977daeb288b0f GIT binary patch literal 18985 zcmeHvXH-;ayCp#+2gw;RAd*B>Vi5#E6huTMgXADk+ihziKNCpvYC~{7c5eWs- zl~rv~;B0$rm~)Ql zOyqO-ubQcAb1c#26w06Io`mUesf!#vSX{ z8r2skY81le2+56(+NUwKUO`_TnEf@%M5^5*_PsOobq|W7N%s_86WwW1;j0hR8QK^T z9mBGIe)W+!A*@?qwA@7}vBpbu9Z5*NR*u$d$qBta>5|=d-zfTNAdr0|FLf$opy^~1Q z8B28iD2!+`KxO(Z@oA^vsT-A*Lvk8CK~x^`HH0)Y!NupS3ZK^1=9X3lqRaLV2>X7y zcHb;~Q~|f;w7J^tTLdTge>3WHyCZw~y3&0Sf~UCGJO(F*BKpyX<0=5A$q*2~V__U!FD_cV2bX;=sd&Jx_YbyM4W zY&~_bzr9FDxrf!HOsq^gy?auR@knx7nDU#vl zaS`%|vmyHp4`f~c{Dk*HMi~5pH}rK7GyV@cMIwWLUQ2HKUtcgp_s?&535D?o;|)Dk z_U8{e`o4eOs;WTw&wKv&3&Iut-O>K-$K5#fZ;$rxJ`TnE&u{)8C;xwZ9Ch%&JKDd! zI(xEzuKT~SR{!~NN@xGuYxS@5VJG^pEB~KI`*(}^Key)pgIjYnCB{lc7uhDt9wo{h z6RXa5l|8BtSsAN(;k8EY?15bS{M9*}}a??gEiGbi-ELm3n ziM*8oiWz}c5{Oqs>A0nziEP6kE=e7ZIDw5(IWOBts_|v|wpfz;mO!j(mCp@MnlmvS z@Bwr$Zi#Zz5E8t&MRXLvgYz~b=I6eihRGaXKbNF_E>`s{d(=7hsG4nWv81YPq$q1u zASMu z603S@*`2-9lD=h@u4T4Qc%|R=?-xIil^k?mcFw%GwZS+HXAq@A9HvOP=f_=dLJKd2 zzrZ=YxYaED%jocYEE!*1=S2FIsr5aUC>3}QELA^t2bOBahugfE)ov`*IcQ37yrJNu}xS?d^L~4mSqFET(g7 z;IC%tbKEf&@Ul?{=HcPtuZymm2-;K)Qn-M`#KfwG22W-id#N+D$^EvW{k98raOOmC zmG<`bsu$>c#kk;F;8t8Xe~~e;JhQnedR98r`zxtxIKOiC1Mjqm^>xRE zEuWnL2nPZMlupaup491(n=^e<_Uk!KO$B+dgyZAmy<G);mWIVfgaXU&%i*DFD^;&G`3)q`sEY!R*LsWl5h^S z3-nE+qih8Q1$_?UlbC+?&#WU6F&G~WGKfa^T4PLn5r+)s0biVp+oR_Z8VK$Pj88Aa zkAnt7uNESyR1KNz(@NMS{lIm?x7dg0Vim-bsabDAD!u9a@N~yrfeHFWcTj=M@xkKa zMGXxNqB}zPp#8My$`%9oxz9{id^3Bld5vLXP>cr{5qrOiT=HDekJ-%SGpdGKp# zbcvoE+4PH-$bVWX8FMkpByXIgx}d;TDBo9*p@MwBz2=_XEE}_-)5azH^1*T zVC!ydDe!8bC!Hl*O+}s4mF8dE`?`d=e8&)fS7{rtwG=FnP-z%5QP!ECKk3U2dfIyW zd&mf?jc8U^R|$8f{V63SC=7!`m={ne;Y5<&d%TduN$PXIelenSx-N0jF4xL;2})}y1KfOa&o5$62DprGsWK}X*0*6@`Vm9 zSbp5inG1+!o3AT$YS=qnZ-ORwn%?PO_cTWEFgUgnn}~Mv-Sa9H9=F0=mSwE?l|VtKBPSp2oExy7SPaWC>_npQEcQY_#4pOkMNOrK1V^N9>GKES`cp@HT? zgY$#R?TkI2+5PW_Tn4>+Cw7Z|9IF%(+*9La=n_(@TJoN2$8`ne`+ZSQXt@XE&_lz~ zx6VE9m=_6uGh9Z>Vm~`qHSk_p;;O`U`uSVWc6zYi?sE8f9wtGR5gLe9wcL>IbN3k^ z@il4D;Va4tp6_@%Z&bpodZ;h6QMNQXT`YBq%5bjk-E9JwhM!xKUh5t$q>p5rTGBhv z3-#U2L)=R{nK|xL#8h8ug>Onh2$hmgCsWIKC);n;j_v$?%r(u{AhBh1f)O<>S`w>w zY`~J%IsR(gYlv}|jxs64OvURL-QuP`&zXm;Ts1FT_x)PDx^v)Ge=?wWYxg*uwnJUD za&+zNWz!_rtT+`{%+P(@gULDgwAMt^NJ| zMv)_?qE#0WsQ6@}^tp3F2G;)JjuZ4#r}BR+dhD_tZj|1lxVC^I``9>}Y4u(->r>W6 zPdKKenIOgGP}JGVtg)BYwZ*sq?wa^?i?77bnCj9nO*==8bw#8?g0EZ9i9KQbt+_p< zL+Z3VzReLi`b5FQG)@x6~crfV}Sj@?loA*i`-)?J|dTeft|CQXSQ zBRMQo`>}^&>n8#|X*0rq4ZV-ryL2I=EtQjp=RB+lESJ5Q#GIZ`xD7gO7V;3HUq6R6 zwbXqp9d4P7(;px6a1jy|-S(R)KKK_qkH0Q#rm~y)kWI+me2D zHAsAYhUK?Iw}n|5DOqo!vxDRA6hE@rErm3(=mui#^7}`3g`vmgC(PQs?y)9z`SSbq zt-SnQLXHL>k#*_z6AAn1fuG${jLhq$GbzO?uQv&`x9&sgV#BZp zlJfE$V`J>D)hTYpZnNE(Ej>fSmShPhKtGdnjmq6GB`JD)dhS_@vF)&}$&nG{=H|j% zydsx{2s>5{)D*nuX$^B)6ldgo>rE8Sh6+D(kl;3{!bCk>@S=_QI5LJBGO!a~UgPd8 zA~q}>j}9CWaO{{ZCfmhmNakaGAx| zx~ET{654-S7ufx|s8(hm%oy2L{g+VDqU8ObL+tlhZp`;Oe0s(tSt{f$9{smS0b~8Z zTvV=bg4d*c+q?SPwO2=bc#TX1pmLsyDi7CiiwZ|wq$)4YB>9cumQLXrQtZZAPi_^J zM-Dv_Jd5(^X}=voYwM@ucc0aUJ-TP%9lAC+T)08!xdy}L?7^&=nMqgakrBthw}V9l z)l<*>*GsZ`!EJjzN*0o3?Y&z*HBsS81Z!roJ4iR;U4%aOgG14^($X}V15T_VsZ<2N z$z=p)d#*SpICX%k>s{`klJO$^xqa;6(oNj z_`mJ4%FoZASz8k_4gQTl3!Bg5Sd-LG18@X{71Gp5PGpddMx$LkJ(mJ1Cy{6eX45?P z5p_2aBveRo3ywmGn6TvO;B#FDJu2B}Y9=>OrwW~$M-j<=&XVp!uhjV%sw#^H`wgn? z^viHLI-BFKlkJKFCXrrGJQ$CAm98*#Sn>}wM5$z}=4c^JN_bzF8|Vw#=MC0udktMo zzMEr|x?*QSEyrWupT$~1Ugy<>d^PkQY4Ng!n?lZJHFL&h)W>YK7EMp4!#KX{-Ed;o z<U2>5`ce!pSmzt2LSy>os)HNvtL56NSz4mlGQ8^hzhXeJD!E6;L6Lxa8MJ@s!&k z`kAo>=3deKH6EG>WWm!k%!Unj^J&s4FTS{&+5LTo4D@|-2RB)~>PEsd`RS_xH~pdIq`3W7af&&DI9t$-KE!8;>SffDWJhcc-F2j9U@W} z9LQo(3r$J{Cu{}VUDeI#`9s>LD%SdqE!3@l&Q`usLI62K6geUJ6EBHc-^#@`6q&)O6Kjn+NKA4w;LEv3U; zv4hM2qyhsG{G<2y@ohk;l)NlK=Ect!7p?02_P#q7xsQL;y8P?F|AW?L2yRIhHsK6d z5E~mC@2w^3pL>X`e*X78d=z2L-50)K(COJmA{IVAqvRen?dwb9>z*zF0nypn=l_0k zqtYAgiYr!u?y3A)yZPHU3T9?zBOLUL+Ff?C19?FE8&i(*GDKmed+|={^*H7+3op z#9e%SU&61dJ21vJUS2F+U0raCgS{uay431?woW%-&&S`*)DtpybfkvKC%9D+`37Ih zWn@~Qyf>~;__3%w{H$Hn&=9@2xTvtKToY!9Vg}^BxzxikF)`6?e6i6WuXI%CW!t%L zi(+?k-Y}4Qy`Yk-wJv=T8A)kmWR%fwTjlkHo0dveS^QUMbB5OE8QgqFWotqCZs7Ky zE({!1)zvrQuEL4`{3$jxJp4c;v43?NKPR(NX`*!S>!y-D8`_tDp}EuYnUP3DPR>Pb z0Vb$1n5J3Q5!|da{$z|yOr8XvocT?9AO!PvwNd;2zO+F6OUkR1Cp5BhPE&O^Q96`w z3)C;rYgqQqEf3^wxbcU>@cP%FKy-ApHQ(~a#s zt9Bb=)cHbMT9i0BIVA;ucq2TMbIX7Kyf2sDQEG$UTxh;i}v zkJ2qPnO#_D)h}|SDv82=&|{BM`84=scOmY+rbr@j@wl3r8VrpP4!!IheJ}Kh-bTDE zx+qHjVrDQ;H@GNh*7=9|@z}a}MMXsl$pqh1VPWCfyuyZO7@y$RFjPjseRXhjl} zQ#%*i`2G7E`?PE5dihfbbj#S-`vW=7T%EiyxP3V9S26O(BW;U2zOt8oW%Yk5ox`rL zXBvsjM_y@g=8$Djkl+7ter;o8iv8M4x9~+o;4x=%a`Nus7TU$d<*II29AMn(qYW>9 zMv8~DmW(q4^paRJJa>z}?Eq&ngFW8B5)eH0-)5qrp@Hy#vAqbUWqifxW_*0*afADG z&hRP_9$DG~nWGLsiDYUEz*GkFaaBv}^kL7mshOGC6LlX+ud}Hd^AL;PzkbAWM9$A! zz%9!!ES%rn9f`Ur>9CSm_Os;KgTi4Yx%70I=+qb9R1s>q10pU+Zpgat%Vk^5BkVuR z%1X4yApktRydDTK6Z4vyb&1hB0hNGGlO-lFGB%!F>`H`ma?7E1WQwW%YAL2?Z0s=| z@wC6WnW$lZMbJw#NB2Tvmzj+XsiC2vYVH7%#tqFMe^(NLa8I9Hc9+}z16p@J46jNF z3aSm%2OP2APeZuO5;1zha0v;GrynTgSYjq8Cl&5o4S({>SN3{xPmo6+l9Mq@h)oC5 zx4fL`hpB3?J;RUu=N~!JC>P>IELOMDET$-PoGyfP_qsd>jB9VW&$HyVg zyagLo&Td$&EyO&D;o;)C=cwAc+XF%9TK&qmK3XF;1Oj($eZAT%W~WKdp2OhQ?$I)d z_x1{tbZRu^`uiJS*4P_~e?xDC+#ecB$h&mE`0JkfO=R5VJ`S zqid+$^~dz9nHj7(g8^v=rQCuuwXaDGll{1H+#1^D+w%uUasu%b;^N{(H8n4dL|8tl zUUv)_d#L~<5X|^?cAa4XMM46?{X0#Vo@yk9D9pEZQYBNfu`uw+-oe3P!th~g^VCwm z-`78gnx`u0XGH(P!NI}E#Dx1LE0MD>pTix;SHE%tkBd{R0;Vj224T~6J|U~C z_Ls)i=57Z!vJXJ<_Wr#FQ-_~v6NTZ;TqPAJHz*$MYo^fPo6(!y(agLt6mA4$5Y$ij4$!o*j#5{D7VDZ_ zs4W1Aa0a@q-0|*wqY9EC%XTl>`o`4MlnS7Ya)VSKg?Ycl(j>n3j>5(VRO{EuEgGY0 zhgV^8x;|rF@yKQu3-q9%prH5uugkDtEyS<)cLZ zG#AA*@!5;LT6LV_HEe$!;Sm0_@23NHU@1^ErK8~FRZ?Z9RgP9?y%Gk4xz^&f`^qOq zJSkz86Np9`85!@x-KzrecNJcTV+W=LsYQ79|9~*kM&*_SE&J>2fMPu(`P2$<+V#c7 z!GK+E;Z|1uvj5m@FWMc<%fnbOi+tpsy}0EARZki>vAT^X-+BzgTQb%Do_od>*;Z6k zG-K4ZcJ6j;QAI^~lW7pt@=R!e*iP{l+P1Lv1ul^Z0Kps_96F@YDp+$SWBvl#DveVBoeE6c%1(r7}vn+QM!-x`Uvtt*wRP(Ka`iCG)Ax{OWaf zYIkX_#J8is*3jpco3zcl04{+BmSIwe_A40p)_RYR0so3uj8plSHFu*&_*4;+5S>6! ziJe8R5k6yL@+L5WaW)_yodQta_klxT=@qwK;=o%5?HA~P* z$JTqF+hMnR>4h0B$HmZ&dxN4F~u@3erho0{SV&U6yJ#Wh>Mec)dsbMBaXxZjyL zo7MwAui=PQ`QkneuZmbFP!1g*%K;|~C@Y24T77G1h#6KE4~+ceumVoI4Lo$;Z{NOc zE1ul@{)`Aidz+n$%Ncx$)%n}mTouqc%)QWP`j_1&%Qt%c2Lsos16Gmc=yFCkpfjf7-r z;g2xn0n;@yJ$<|0#Oqm=CO@<$!Y@bbPN_ev#Y{yK-M*mj@ zV2cBCTS@{6^X5+L=5u{4kMR!hdz=2#vhozaon>vum)D@J>FMjc=wN_X+Njt13{g?_ zjYXXCWkS2{^_O8`BtpW%_Z$h%M5*B670VS9h#8qKS!EBA#FmW>5lE7=AM8znP3;}8 z#dZh;FI&@nY6R40^)bS8_qk^lDY#kI9HN#3#5?TP)-Wp_M)Jv#D- zj-xyHY*kD)DDa>%aMkt3?#9*3ox?-F0vpq=c^vn{&y2w8;#MD@jD?{@Z}#i3*Hl-# zl>Z(r1e7T`kB*STPo%rS3HQ<(?W(N~m+*H^Ab#Rmo9J_>ii(*te|a)egc%O6?;MD{ zxKbx+sAdS>@FmrM-OI9jy--YH8_XX^kElPkiHXpzU>|Tp=X)XYFro>f=LQwEo8if~DoY zE;MPWsenk#L9wZZgaeYbxUv$HfBRRNbN13lKe!LT*JV#*Yd`4oIo5mQh+rV0q@>jF z-rRu(4KhR^_DCZ69w#?}NXck^US0D6OgDfD3RYgC zSbC+}dNchZKpPQDdS!3s=jl)!zD=?5&f-aA%Z@*=`2Y-RTdvF7K*$0~2Q++q zonNwML^=`2d*+x9+~J;^F6P~weF8xxudxI|G&+vw=%1h$f^)Ef~E5(cJiVG4lQgS$sa>m$&KAe+Gz02M~`B$P^I{NA8-k#Z-HC9CuGiYeV}S?x1e@tHEp`7q@{ zSs&$5=JE!Vw7}!7bYo6=30b5mup*HENSdt-+qOdNm)ItMO?)4_BgH(m(G&l;K$N ztHNVSN(0&&2pt;l#x{!~lOafJ=yML$In0|x-@^Zc2n7jW<#h!_kNCTQ3*C@}j$cS+ zUqgTwa0(C{ZWji&0W{-_Blnx`7#w8!w)hjJNj>ED(QH;JEpX1}x1=4}lsus^phNRy z)e9+&3(XHuI+Gt&XAM7VZ;sle^CosxhYfn(e7e2zDC5p8$ulo0k0CJ)RY$6+c6*IM zDLXyAlUil74ix69xe}Yau|Pch)%bfB6YndpDQL%(e&Wggnsfc)YehpXFt)*I`{CMH zY_GF#BG7}TR=d=~aT6a~iyyt-shp_R+&4nG9lnT5Kr5)Py zo8mf~Uu0J~jvqB#Mjg6ushv|Y0o6>ftJ8O?qHW(&tO@!aNYz{FN8kHWodk6^N588& zPxCzGr#U%5a97x&=98}94S6BEfFD{mH-R1DSag-z+$ffQO}%I;b}ju<7>Ld8;YpRa zMx5-@^i}j9jMkNS#W=+UWIq@lw?2to2w&U>&i5>0MJY89)Vf20cQ?=~JP^l@B{*+R zn4n?cLl##!8nq-Sh_7vkRO?Q zRc-axtr3&r!zxjwrAAVvpDld+#WR8&X98H%PP?kbw_M*Q7s>~E-tUbKiAvFxTz>Zn^jJz)QH z?IoEjda~yMpqUhs(pZ}ncWp0juMR_$21ma=td5Uos!Y2oG7=u8S7=@3&MkNu-$?-8 zAm!%?-=?XtJ3%ifJskV~`F-FVMv<43=d6&S?q_X0k{u-Acdk~21(fM;epp%lZ8R#_ z<^9n6uj!7J<8D?sLpAEaM3lvHNd+h!hL3J@za){K(Aop4BFat@p|Y)v;n9`xn(~}j z!v^w`PCL)iG-Z z+#f&lw}}@Ny}7yO_;!ouR4D&Rq=e|so(Qy>;R}~u9rb>>{z?j?cQrHFjA5(nE(Tq4 zi=%CF2lcb@LzUguvrZpKi!j9|uCa|RI(>9beE~|vWw?%_&~f&_XL}`n)&1*{t%35H zKa5Vm8OmuWGGa+oPyqAfOj(5Z8Ue@Qc|Lu{wPr=ZAmbDuNi$F-a=U@Pk)|m-^s!9oS>z4bJTgP zudwC#@;B~N?;Md5@15gMUri?&6}Kmg!PF7?O$~LK0ZcbQCFHGu0|o%d1A%y;yzoOv z5RDgM-D-e?73tHWlIe&D69bgvxh31{uBiHH=Jw_>Vq88hU7fEWOI@!KYVyQJ*)C4A zNoO@*!K`)w>M!OT?KH8H$5grWCXC&a$l)-?(bt&=LUk4D{1^-ARL}NjK0~YpopGHD zI!Eq?v3%Sy*}xwSKH&v#i-450V?b#>f7gtQiI~)&L39h&Y?n=6iM$Ij7Q#P#mtDs? zD*X?OEPok-umL*{GEoe-Y|X_V@5%$cy?+?>2|c}SPat7EKKW|<#`4dST%UGxbm{U) z&lsOaSYSA%*nAL=BAdi`Q2WdC;=p`**FGY6HqVrdMBn9XNKRPDhzBs<$>ct$EuP6ZuY^T6TWd z>WxU-7vk?r2dW4d`oF$+8z?PDnUZkGuWpG=C!4oE&pc6fWOM)o1G*%YgVop5!+c-p@ZnsC@VN-^KHyz&ba#VZ+_$o z0z$(mx68*MYWkw7BX?AN#OAePUcMAs&TD*pV}0?p&7*(RuwCUgj{Cp-_No<%9`dq0 z6kmH+(R6JfMNx`#S|#s2Y8GL?wM1ma(KPbii;<|#L^@R^yWg8`Ud}PrYEMoEIV}-7 zqjV|d!%oGy-3UG;A9Ok-vZmmTcx(d4*7eLMnf57e=_BEaI%oBZW!8`84}OZLuH|oE znJBUv+BH;@7A`zI(i37XqA|GH*+ST&**tjvW7CaS>DwX-=#->eog>$BVD_E2K8t21|?cL+G!$y)$JEs&dokiFd`H*%v zN^(xE{IZ@r!cypH|Ez8|zxvC!K8YxPk*TF8NAe2BSZSTd{zCEW#iM{}@)n;w)=^C< z!Hkx8!R8mQW}m+2%aG!+?X{xu zu#iXw)Zgl2REBxG)8eIm+?1rH%}G^X!^VNVTx$I5+^b1z$~G>2bi8ObVSnt?SlvS_5()=TeuGLzx;6 zyHs;b!+rT9MxX&V{7X2H;Ng0F{F4RhJ!TA3j!JF-x(BLMV%I$nv+*}36=5#BG9{%G z-U!GSP#MXzS;-7fOR=y?bgjtv*(6!sP$MW2{B)0h>97KuapZT<@cph+?QC&Z);7Y$ zSPHZ(XOHoDc4gS2^b-gHR?);=m80?txZ{Xwz1(F zUYU}UQvu+1@3F%T>Q#Ct@nk(cJ!kI3qEFZwLohwa_t@B&x?4&v zTmESIe!-OcZr`3i{zJ(7%lslZJ|2E}rt+uAMV!r8pLXe|Ff6J5y5L%!gbS=oF!ly% z4n(2P+BFwF?Fcix$vT3jE{>p>q=ht_UkIAbaz!gs)$+GR@M=0d6T}>X%t8MmRM4y= zormf)emI4hh8R_8cjqISO?3&R!uGa@#BJ=;lQq8HovsA_dGvy-)G*>%y2o$|b%(;1 z^WD{7LWBd$?%;e((JWoPnWI%bSavzFOA6bczgjx~If@qe0N@d-jgZ#ykvm-Wei=4d z1}JkUCv=bgaXr@+U$($cK?Q?PHvBXCLr-MyQys_fX57HjDBc(n_bSc@u-K7S-u*&} zT`*cC`}o&%j1oqPY-@d9V3y-hQXiI5LgWY0NL(!5aWu}+xuB=!CK;V9vS&wR;HNjz zM?;|_o z-M7UOdn2&xE{P<1O%ulT1Xt14-J@TLaR~yYU4A_HkCrcDZ2e#}|7oihHu zC3HOT%Wm{H0;@y$XguhGga53}7<$5`W=0eFQ0}X*+1n>({0%Nt3zz_pHkI(6(z&Xvesle z!)&uk!5O6j?{I627*)3yX^p>o@pYZ0#r?d&l~hGfXmxZkn_i{^1O~}1H+0s$vfB7y z>XELWv{GioRw@)naWyAQZ6Y{nB0!%FR(e-1bf2LQZd}1Kg^b(SH=2QOp*UY4r7C}( zBB&bsdsgztrp&!Ac3FtOPW=oFiuYa~LP=+L=kOH-Fcml#Yg4I3^7*S*(PiRGU>vUQ zlXq{<`QgxolzVJg;O_4~$+h;fZLS-az8&G#QBW_R8#MH%-J~-2nKjwYOR{}5oAiWo z2HIyq+<<@4YgrUY8LN7p*%*+A9v)2m@ir{q?TFr=AZtThEQ+VQ_~`lQ$$=UHT@9l% zz=ktx(#&-B6O+*Er5)#Tb8+bpV;JQ-Gw{Y3680Y#Z3@$RL5uN-Aw6)Spj$b&Y`tcU z=_m#p9dH3)bb207t(%-_3e}-)f8STZxyP;1bn!)8T%2LT0|FTKo7>yNWwb3z^>sZi z8ATiv$a^|wDjVmt9tVCU8n##p2f4kS?V=v36hKQ*IlzDhES_dG&(98D@#gS^bc>#U zI&9PPA4Meiv2aj~nsWVaj@Z^%g&hUSua%W2rY=i2U=Ri)u3=Sv#_XKuaC5r~laAha ztK!tP@j8(!SHSPQHRQ#@lctc#G#q|;G@Molry41YiE`Aue(%Z5r>a;iI9i9=0OZ=|f4pa29M|oGwN&wvG8l%y zmlyU_R4^rS653kjcpHe90XwzRB#Poy-qfdw>%4Kz7u~E%^)J1@Yyv9w_ICL}fY4W3 zzeM$)zm^|<7_b9Hba=gM3juQG@F_s_Go5jlMn*=+p1&`;Ap+Ks72=1DBTp-`lFxlJ z5alMS8@8K69}mdg=9}t{o0Vs!+HfcnMW0s2Nv@lUqcb}^U6MVWE!C`NWUic6^Muq& zNlQDeC?$ynYdGGk)81nc;M3RzQt#u(9rDNX@a}uH`*U=8Nh@vGt*c< z?_dvE3SM~}IA6K(>hA^m;1X*_0x+w9w43htlN=7m&dOkDI82dM|7OFh8lQ^O+bGWdE;8pZEV@ZPud^OJn;RNIJM>_Q{p*d=X)Ng!dGEN- z6QKwU+b}Cf0G)iSV7_E$_l#esi%;M}C*BS|?0N_GhX!#6!cQRP+( zRaM=!RolL@Ygp`g=14OOixy#VMn+J?-H(E6xX4BY{Gl@J88zx4kYQc|yG(y=f z&06Xt_`y1ty{+7K#5h`BMP+|v+W9TBWxTxY3(`@g_=B3if!TvgpU6bZZ7F63MMY6# z?25BSDO{4vzS`>%Hn#(_avPMU5x}Vv67xIy=ddd)6yP!!@exW#*B+RDcgh>2Xgx+Z z@AyL?f^q`tz0Lmo`TY?c8%=}=Z<6_&XRlG;M=h6Cuv`h4+m(ApPR4&-VQ1!p1?#nzkz}YY;OT_?r3aTN97n?vf zNn9FH6`+4%3cdnJp_8NOlPKs6r$m(jT8CqNpsx4Q0TuAzv$p1EZGaCG6KOXBemx&K zEix-dG@ZEP{|El6)o>~{kG>=lEUKL>$XiY6v`nc=zPJgyUhoncs5YR^gT(mbESaBf z7PPm_f#nRy;z^{883_5rxbJ2X*EWqG0hfBDQ0p>o*Joe@Tr+rXD8h)KV*=4U?f@xk zlkOj$dp~_{cb64}TUM&m(7HZp3&8i_1!W!8nP*Rg`zubDWcS9YM$3 zjJ>V)MR>WDn69lLip3_YCx5S{CpnpugyhsM7s zPG1~SC>(rJDQ*0nLJ!ylenz8g@`?u{j1-k~I6^$>4zZ^}r)P^R6`qj_1da$?UC}Wy z_>~ffPuWgFpM$VWN6+I694}8DUq{ivGFVA!DLDOpmr9=rPhSLTiH4RITE{BQ0B0o# zZqNlmaR(L!ETfnDcI)}4farkh2fx%-D2|}VzURDVAQde)L#ofNb)~jpVA7D^v4$Sm z^d(V8t;=8XjBP&l=oiEyEW_=u9yG)NFvPp{A$JO{#`|+aQ`}7q++zXJ6wlr6?~gr7 zosm(+=?TO`&cYXL!~tQ7cq*yZl&Yb;Vju%{$v}_W%9hRB`A0pWRMb7Md|jAs$h^Is z67WrRy{%Ppyy~qk0hZNE_tStAJ)f$P4HlX>zt7r=fNC6w%vO^+BG8Ghp9_Fvkl(+_77@21|pAN8B_KRaI3A)kY12W&^#KCK)5P_y_UD5J(?XRG|V|_Dr zV%-zBzikiai!b6}eGLv9<}-%9K?)=UwF)k7JTV;_Z^2F8xKqS6;NZq+K!Q)=fPf95 z03C;`o>7_Pbu?kugkRyuELmA)ASYmL%s9$a0R6C#I?fxS^3p^+1H=n0IQkDcCu;&e zk+!t^egAH4-|(~gyKgr}!s*i8V}!)tAX+H0ERnZlcs1_eMO~ZO)Juqu;9+ERxq&bYe=-*3DE^$ph)k}5 z8tbX;fbrD`nc8DbxzIn}ttH@tBblZx`N?^2B znE9t7j6bl3pQ(60JuxwJc*qH@2X2E0vc;Jw8#HdZ7oN3Iad8a5Q{$;!a`)wuotc9M zhFVVs1nf+xoDRTy*bqKHTe+ki?oEP;5A-{sqKcOhw7<>}DU5}6F?!J7WN9=s(v4iXc$Y@!Ns3${rHDW!WC#Ylx1CYQQkfyOvHfl9L z6zzhKSW-%=DNnc1*~KN;y!glan(jEV;dM{gWnnz>)%H5xZj3#^&%nmE-=Ie1wQ-w} zHlv$-U+tEH90V=3cN@JupBru>WO(K|uGP~qIpO(l@pG@uPJyljV!M8IZjTwaw*T~P z*fjQ*uH5VbqYucfJ=P2$IsqHoyuV*V`H<{sXa1wqVd_h~V#Ai)=P8xyK5~U(q)gFn z1Oe&)WY^g;*D*`c>z+(4Cy^;e5ZQwB`P`Wil+xz`#S;tyAqB z3sxFSu_QzD#ALf1EnsTiz4w{I?to)=Qu2HAJxVBR%9)zG4<_EpUu5ipaWCx#>U-H= z1I>4^Bqzv(=Q)G#np2vChSL`L?&WBK`a>AgF@E9lgSD|+LcNq6a%O6}`gzqDA8?KW zb^Eyv@ z>Y13R6zkoBDw5!AIOW8yP9p<436mzc0J?_3iY3)8oq?OQGH1tpxj`}Vjg_&4>g3(U zwDtWv765$khMb3H48xGYU@ii~r5d7aP)stRVvII9PqZHiIzDv19bfhz7cJ!ecr9Uv zMwU)q&y9dK^Zv;QrZm_VSI%^D_0=ux>LCM`IkuBjr|)-6;Nd)}Q}D-H)WEVS*q$MS z&mzJ01`cj$k^qS&vwGK-^hb6zU#d^2I0U7hk7^a33+6n37%`s1f)Z`o+$FVo;@qX*Lk z>>S2ppKgaUC(ffEz}yHFmwWAGP#!u#p>(}%`q3I6>;uMINwSk*1L+PI{~T=h1Qe2L z<&ehu113_4C2-mcP2sDMTyF_CFzOP$6Os=<|7}$M3aB>Nf{8cUJ}G|*hTyrvy~)eb z&G*8ZhipYq(7wUU45RwRMU``Bz*hj0Up6?N{}S3XabzojgM)J)Xg9C}fNw~$i#<-N zx@r8KTe$RS)x#-{HfhXxS|@}z>}}D#TVfbpEj9C>G2Q}SLWV2Ti zIu`_~?W71Idpmh~dGJiRN2vFf`usl4r!qA$0hYEJEoUQQn|j!foWA38T)%oaOB?t) zC;=X&@H~Rl!r75Zn1n0r+I&v+sA2G1pv!Hq6J;8o>=&M_V3cHP9@(2PC zmUi6u8;@7$%E8lmA73qUu^n(C3H}DoZ`nP?yW&OZzh2!$r}3fOj3o_Iz284u5-+|G z^1>F6QyxF2y}5)vS2G15=OlkW{*54qvtghcj15#){$x1thy@QpKYbjm>9?JDa{o%`KTo`v^7+1e9c+v61@3aZS<|4P zl!$ay@o5^1ErW&w6U|HW=^d~c86~?`lvbp2#Vhdt>yDW!;r;A@Y=qiEb!-gZ^j3IU zw=juY5;o*j;ZYZUs2g9eS-45z6psAF{J+oDBV+Vi@{7QV@9q9Q+9TJkz?nYyWEQ4G zm~@~_LTLa~I86Q<(&`u9dNaf3S$HOg_v<176|f#YKH1j=cH!KgZ9eeb0?%BTfDb5< zRr1e63BYO}3>6tt11dDQ_Gg`+-#Qnp^%=jV-8|=Z_Jc-t$5jnDBL2}I&q>c`=%2|3 zbPKtsXN}&%8(^|BsGBk_`hblKS|#{2j<^L~i?Vr@#aeFiw+}{X{zoh}HNEe42x@-G z0r@+Lto`nGs83-#Q(I;0$@;3z9DfOXaWJ?Ql)#Q|5$zCO-ZIMpb_innK8R0lD$qr< z`@h~$d!dpI+wfr*5xJ4QOT}DLf*pDb_N>Cw0yGPU!R`85^#a_NAn@o24XaBo*ud5g zg-4KKf1cohGcDp}rz$725Okq4$l1GZ_*cR3YV|w2<6}!Pmlu)rXvOEWPf`c}=cyOlr?S@D4IU|UqWLs AX#fBK literal 0 HcmV?d00001 diff --git a/src/pages/posts/083-xz.md b/src/pages/posts/083-xz.md new file mode 100644 index 0000000..4b0b9a8 --- /dev/null +++ b/src/pages/posts/083-xz.md @@ -0,0 +1,32 @@ +--- +title: "Q and A with a security researcher about XZ exploit" +date: 2024-04-08 +author: "socraticDev" +image: ../../images/xz.png +tags: + - security + - interview +--- + +_< your FirstName LastName or IrcNickname >_ is a Southern California based Software +engineer with a solid background in application security. From deep learning to +web development to program analysis to eBPF kernel hacking. + +### setup - CVE-2024-3094 is a supply-chain attack + +Supply-chain hacks like +[Solarwinds](https://www.wired.com/story/the-untold-story-of-solarwinds-the-boldest-supply-chain-hack-ever/) +and now [xz](https://nvd.nist.gov/vuln/detail/CVE-2024-3094). From my naive +perspective of a hands-on devops engineer, this sort of attacks mesmerize me: +they seem so big, clever, and unexpected. At the end of the day, it seems like +regular tech people like me are pretty much helpless against them. + +> In a supply chain attack, hackers exploit vulnerabilities in a trusted supplier or partner to infiltrate a target's systems. Rather than attacking the target directly, they compromise the supplier's software, hardware, or services to gain unauthorized access. This allows them to bypass the target's defenses and potentially steal sensitive information or disrupt operations. +> +> chatgpt, "can you explain in 3 sentences what a supply chain attack is?" + +### question 1: how would you grade the severity of `xz exploit` (CVE-2024-3094)? are we playing chicken little and exagerrating its importance or is it really a big deal for the security of our computer systems? + +### question 2: I'm a big fan of "shifting left" on security during the Software Development Lifecyle. For example, at the organization I work for, developers are explicitely taught basic principles of secure programming. On top of adopting programming best practices, devops and dev tooling teams are integrating security into the software delivery pipeline with automated security scans and scheduled patching, is it even possible for software engineer to protect their systems against supply-chain attacks? + +### question 3: We've learned that the `xz exploit` was discovered by sheer luck by a researcher. This leads me to believe there could be many more zero-day exploits in the wild. Do you share this sentiment? If yes, what can we do to protect our organizations? Can we expect our corporate compliance and security teams to tackle this minefield or should we rely on the industry big players like Microsoft, Google, and Redhat to protect us? \ No newline at end of file From a9483fdf0826a61c9d7c3e6632020f9af9468180 Mon Sep 17 00:00:00 2001 From: Maxime Bonin Date: Sat, 6 Apr 2024 20:28:52 -0400 Subject: [PATCH 2/2] update --- src/pages/posts/083-xz.md | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/src/pages/posts/083-xz.md b/src/pages/posts/083-xz.md index 4b0b9a8..e7c9860 100644 --- a/src/pages/posts/083-xz.md +++ b/src/pages/posts/083-xz.md @@ -25,8 +25,23 @@ regular tech people like me are pretty much helpless against them. > > chatgpt, "can you explain in 3 sentences what a supply chain attack is?" -### question 1: how would you grade the severity of `xz exploit` (CVE-2024-3094)? are we playing chicken little and exagerrating its importance or is it really a big deal for the security of our computer systems? +### is the `xz exploit` such a big deal? -### question 2: I'm a big fan of "shifting left" on security during the Software Development Lifecyle. For example, at the organization I work for, developers are explicitely taught basic principles of secure programming. On top of adopting programming best practices, devops and dev tooling teams are integrating security into the software delivery pipeline with automated security scans and scheduled patching, is it even possible for software engineer to protect their systems against supply-chain attacks? +question 1: how would you grade the severity of `xz exploit` (CVE-2024-3094)? are we playing chicken little and exagerrating its importance or is it really a big deal for the security of our computer systems? -### question 3: We've learned that the `xz exploit` was discovered by sheer luck by a researcher. This leads me to believe there could be many more zero-day exploits in the wild. Do you share this sentiment? If yes, what can we do to protect our organizations? Can we expect our corporate compliance and security teams to tackle this minefield or should we rely on the industry big players like Microsoft, Google, and Redhat to protect us? \ No newline at end of file +### is it realistic to believe that software engineers and devSecOps specialists can protect their organizations against such advanced threats? + +question 2: I'm a big fan of "shifting left" on security during the Software Development Lifecyle. For example, at the organization I work for, developers are explicitely taught basic principles of secure programming. On top of adopting programming best practices, devops and dev tooling teams are integrating security into the software delivery pipeline with automated security scans and scheduled patching, is it even possible for software engineer to protect their systems against supply-chain attacks? + +### Advanced persistent threat and AI + +> "An advanced persistent threat (APT) is a stealthy threat actor, typically a state or state-sponsored group, which gains unauthorized access to a computer network and remains undetected for an extended period. In recent times, the term may also refer to non-state-sponsored groups conducting large-scale targeted intrusions for specific goals." +> +> Wikipedia.org, "Advanced persistent threat" + +question 3: the `xz exploit` was discovered by sheer luck by +a researcher. This leads me to believe there could be many more zero-day +exploits undetected in the wild. Combined with the power of AI, it seems like we are +becoming more and more unable to protect ourselves against unknown threats. + +Do you share this sentiment? \ No newline at end of file