cross-posted from: https://sh.itjust.works/post/64685863

Lots of programming languages have their own package manager, separate from the distribution or OS package manager.

Going loosely from the TIOBE index:

• Python has Pip
• C# has NuGet
• Javascript has npm for Node.js
• Visual Basic also uses NuGet
• R has a repository of packages that can be installed by running install.packages("something") in R
• Rust has Cargo/Crates
• Go has the go get command
• Swift has its own package manager swift package
• Ruby has RubyGems
• Java has Maven and Gradle (not sure if they are full package managers, or build automation tools with dependency resolution)
• PHP has Composer for managing libraries and dependencies
• C and C++ are the only exceptions I can think of, off the top of my head; libraries are managed by, and coupled to, the operating system

Lots of programming languages have their own package manager, separate from the distribution or OS package manager.

Going loosely from the TIOBE index:

• Python has Pip
• C# has NuGet
• Javascript has npm for Node.js
• Visual Basic also uses NuGet
• R has a repository of packages that can be installed by running install.packages("something") in R
• Rust has Cargo/Crates
• Go has the go get command
• Swift has its own package manager swift package
• Ruby has RubyGems
• Java has Maven and Gradle (not sure if they are full package managers, or build automation tools with dependency resolution)
• PHP has Composer for managing libraries and dependencies
• C and C++ are the only exceptions I can think of, off the top of my head; libraries are managed by, and coupled to, the operating system

The highlights:

The attack doesn’t require any user interaction other than viewing the malicious email, and once that happens, the attackers get to work exfiltrating a ton of data. This includes the victims’ last 90 days of email communications, email addresses and passwords, the organizations’ email directories such as global address lists, two-factor authentication tokens, and newly created application passcodes.

The Russians’ latest campaign targets CVE-2025-66376, a cross-site scripting (XSS) vulnerability in the Zimbra web-based email and collaboration suite that was patched in November 2025.

Some of the email addresses used in this campaign include ivanka.zurabishvili@proton[.]me, zmul1@buildandconsulting[.]com, garrysmithme@pinmx[.]net, and hostingclient@pinmx[.]net, we’re told.

Alternate link: https://invidious.nerdvpn.de/watch?v=TIf3IfHCoiE

If you need it on Youtube for some reason: https://wwwyoutube.com/watch?v=TIf3IfHCoiE

I l

l I

Guess which one is which?

I don't really care about 1, because it's usually different, and I can't be arsed to change the font.

I'm talking, of course, about transit routes and radio stations.

Quotation marks and other symbols, when typed in the title of a spoiler tag, show up as broken HTML entities.
This only happens on the normal website. Other Lemmy UIs (Tesseract, old-reddit style, Photon, Alexandrite) are not affected.

Examples of characters:
" becomes "
& becomes &
< becomes <
> becomes >

Example occurrence:

Warning: The following spoilers contain full-page screenshots of the phenomenon in question. Do not open on a slow or metered connection.

Normal website section.

On sh.itjust.works:

On lemmy.world:

On lemmy.blahaj.zone:

On lemmy.dbzer0.com:

Alternative UI section.

On sh.itjust.works, Tesseract version:

On lemmy.world, old-reddit style version:

On lemmy.world, Photon version:

On lemmy.world, Alexandrite version: