llui85

MinIO (a widely-used "high-performance, S3 compatible object store" published this advisory, which allows for unauthenticated overwrites of any file.

Their open-source AGPL repository is no longer maintained and no patch has been provided - you must download the closed-source binaries to get the fix.

This is the write up from my first Google vulnerability which exposed a whole bunch of call logs. It was a fun thing to discover and a nice reminder that even Google isn't infallible to these sorts of breaches.

(2022)

    (i) the sole purpose, or a significant purpose, of the service is to enable online social interaction between 2 or more end-users;
    (ii) the service allows end-users to link to, or interact with, some or all of the other end-users;
    (iii) the service allows end-users to post material on the service;

Linked to the legislation in another comment.

I believe that myID is also explicitly excluded as part of the bill.

Some notes:

* It is illegal for a platform to provide children with a social media account, not for the child to create an account. Circumvention of this by the child is not illegal.

* No grandfathering - all accounts under 16 once this takes effect (which won't be until this time next year at earliest) must be deactivated.

* Maximum fine (per instance?) is 50 million AUD (about 32 million USD)

* The legislation is vague on the technical details, although it does specifically mandate that platforms cannot use government-issued ID of any kind (including digital ID).

Google Authenticator now has an "Export QR code" function that allows exporting the 2FA secrets.