David Tran davidtranjs

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

Node.js Deployment

Steps to deploy a Node.js app to DigitalOcean using PM2, NGINX as a reverse proxy and an SSL from LetsEncrypt

1. Sign up for Digital Ocean

If you use the referal link below, you get $10 free (1 or 2 months) https://m.do.co/c/5424d440c63a

2. Create a droplet and log in via ssh

I will be using the root user, but would suggest creating a new user

Setting up Webpack for any Typescript project from Scratch

Welcome to step by step hands-on guide to setup webpack in your upcoming typescript project. Please follow the steps and you should be able to create your own webpack project. Please download the source code from github.

You will learn below things:

✅Create a Typescript node.js project.
✅Install Dependencies with webpack & typescripts.
✅Use Webpack CLI to crate webpack.config.js file and modify webpack.config.js based on our need.

How to setup Let's Encrypt for Nginx on Ubuntu 16.04 (including IPv6, HTTP/2 and A+ SLL rating)

There are two main modes to run the Let's Encrypt client (called Certbot):

Standalone: replaces the webserver to respond to ACME challenges
Webroot: needs your webserver to serve challenges from a known folder.

Webroot is better because it doesn't need to replace Nginx (to bind to port 80).

In the following, we're setting up mydomain.com. HTML is served from /var/www/mydomain, and challenges are served from /var/www/letsencrypt.

	import * as React from "react"
	import { SkeletonPicture } from "./SkeletonPicture"
	import { AnimatePresence, motion } from "framer-motion"
	import { AbsoluteSpinner } from "@wk/shared-ui"
	import { default as NextImage, ImageProps } from "next/image"
	import { myNextImgLoader } from "../pageComponents/vehicle/SwipeImages"
	import { VehicleFragmentFragment } from "../../generated/graphql"
	import { Unarray } from "../../interfaces/vehicles"

	type IPictureWithSpinner = {

	import React from 'react';
	import ProgressiveImage from 'react-progressive-graceful-image';
	import styled from 'styled-components';

	const PlcHolder = styled.img`
	background: linear-gradient(
	to right,
	rgb(246, 247, 248) 0%,
	rgb(237, 238, 241) 20%,
	rgb(246, 247, 248) 40%,

	const newman = require('newman');

	newman.run({
	collection: require('./postman_collection.json'),
	reporters: 'cli'
	}).on('beforeRequest', function (error, args) {
	if (error) {
	console.error(error);
	} else {
	// Log the request body

	If you are facing an error like that on new MacOS version.

	xcrun: error: invalid active developer path (/Library/Developer/CommandLineTools), missing xcrun at: /Library/Developer/CommandLineTools/usr/bin/xcrun

	It means that you need to install XCode command line, open a Terminal and run this command:

	$ xcode-select --install

	Note:
	If you want to download and install Command Line tools manually, it can be downloaded from: https://developer.apple.com/download/more/

	function removeVietnameseTones(str) {
	str = str.replace(/à\|á\|ạ\|ả\|ã\|â\|ầ\|ấ\|ậ\|ẩ\|ẫ\|ă\|ằ\|ắ\|ặ\|ẳ\|ẵ/g,"a");
	str = str.replace(/è\|é\|ẹ\|ẻ\|ẽ\|ê\|ề\|ế\|ệ\|ể\|ễ/g,"e");
	str = str.replace(/ì\|í\|ị\|ỉ\|ĩ/g,"i");
	str = str.replace(/ò\|ó\|ọ\|ỏ\|õ\|ô\|ồ\|ố\|ộ\|ổ\|ỗ\|ơ\|ờ\|ớ\|ợ\|ở\|ỡ/g,"o");
	str = str.replace(/ù\|ú\|ụ\|ủ\|ũ\|ư\|ừ\|ứ\|ự\|ử\|ữ/g,"u");
	str = str.replace(/ỳ\|ý\|ỵ\|ỷ\|ỹ/g,"y");
	str = str.replace(/đ/g,"d");
	str = str.replace(/À\|Á\|Ạ\|Ả\|Ã\|Â\|Ầ\|Ấ\|Ậ\|Ẩ\|Ẫ\|Ă\|Ằ\|Ắ\|Ặ\|Ẳ\|Ẵ/g, "A");
	str = str.replace(/È\|É\|Ẹ\|Ẻ\|Ẽ\|Ê\|Ề\|Ế\|Ệ\|Ể\|Ễ/g, "E");

	import { SOME_VALUE } from '../constants';

	jest.mock('../constants', () => ({ SOME_VALUE: 'abc123test' }));