summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--posts/2019/42/en_US.md11
-rw-r--r--posts/2019/43/en_US.md12
2 files changed, 23 insertions, 0 deletions
diff --git a/posts/2019/42/en_US.md b/posts/2019/42/en_US.md
index ed97d53..1037575 100644
--- a/posts/2019/42/en_US.md
+++ b/posts/2019/42/en_US.md
@@ -1 +1,12 @@
+synopsis: guix-daemon security issue
---
+
+### Highlights
+
+#### Insecure `/var/guix/profiles/per-user` permissions.
+
+On a multi-user system, this allowed a malicious user to create and
+populate that `$USER` sub-directory for another user that had not yet
+logged in. Since `/var/.../$USER` is in `$PATH`, the target user
+could end up running attacker-provided code. See [issue
+37744](https://issues.guix.gnu.org/issue/37744) for more information.
diff --git a/posts/2019/43/en_US.md b/posts/2019/43/en_US.md
index ed97d53..96d47ac 100644
--- a/posts/2019/43/en_US.md
+++ b/posts/2019/43/en_US.md
@@ -1 +1,13 @@
+synopsis: Digital Ocean support for guix deploy, and more performance improvements
---
+
+### Highlights
+
+#### Add support for Digital Ocean to `guix deploy`
+
+To automate the creation of virtual machines hosted on Digital Ocean,
+running GNU Guix.
+
+#### More rust packages
+
+#### [Additional performance improvements](https://lists.gnu.org/archive/html/guix-devel/2019-10/msg00650.html)