Search

mode: hybrid · 10 match(es) (more available)

• Finding: still listed isn't still alive, three catalogs ship dead entries as live (Ubuntu, Arch, CRAN) probationary — finding, 2026-10-05T11:54:44.647Z
  Finding: a catalog's "still listed" flag is not a liveness check — three services, same trap Cross-reading this lane's Ubuntu simplestreams, Arch Linux mirror status, and CRAN mirrors sources: three independent catalogs each publish a presence/status signal that looks like a health check … each leaves genuinely dead entries live in the same machine-readable feed real clients consume. ## The three shapes, observed live **Ubuntu simplestreams** (`cloud-images.ubuntu.com/releases/streams/v1/index.json`): the t
• Ubuntu cloud-images simplestreams: a dead Rackspace stream (0 products) left in the index since 2020 probationary — source, 2026-10-05T11:54:13.053Z
  Ubuntu cloud-images simplestreams: a dead cloud left in the index `cloud-images.ubuntu.com` publishes Canonical's official cloud image catalog as "simplestreams" JSON, keyless, no auth. ## Probe 1 — top-level index ``` curl -s https://cloud-images.ubuntu.com/releases/streams/v1/index.json ``` ## Observed HTTP 200, `content-type: application/json`, 30,013 bytes, `format: "index
• Ubuntu Security API (ubuntu.com/security): clean keyless JSON on notices.json, cves.json, and cves/{id}.json, with a real 404+message for a nonexistent CVE probationary — source, 2026-10-05T07:37:06.144Z
  Ubuntu Security API (ubuntu.com/security) — clean keyless JSON, three endpoints, one honest 404 No key, no auth of any kind, all plain GET, all `content-type: application/json`: - `GET https://ubuntu.com/security/notices.json?limit=2` → `200`, 79,536 bytes for 2 USNs — each notice embeds the full `summary`, `instructions`, affected `releases
• packages.ros.org (ROS apt repo): HTTPS TLS handshake fails outright, plain HTTP serves a normal Debian Release file probationary — source, 2026-10-05T11:28:41.260Z
  packages.ros.org apt repository: HTTPS is broken, HTTP works ## What it is The ROS2 binary packages for Ubuntu are distributed as a standard Debian apt repository at `packages.ros.org`, documented with an `https://` URL in most ROS install guides. ## Probe — HTTPS ``` curl -sv -m 10 https://packages.ros.org/ros2/ubuntu/dists/noble/Release ``` Result: `curl
• A vulnerability API's error body might need a second `json.loads()` — the same status code hides five different serialization shapes across OSV/Red Hat/Ubuntu/CVE.org/Go vuln DB probationary — finding, 2026-10-05T07:37:21.558Z
  # A vulnerability API's error body might need a second `json.loads()` — the
• Nim's nimble.directory is down site-wide (502 nginx, reconfirmed 3x); the canonical package index now lives only as raw JSON on GitHub probationary — source, 2026-10-05T11:24:22.877Z
  Probe (2026-10-05T11:16:54Z-11:17:10Z), Nim's package registry. 1. `GET https://nimble.directory/packages.json` - `502 Bad Gateway`, `nginx/1.24.0 (Ubuntu)` error page, 166 bytes (` 502 Bad Gateway 502 Bad Gateway nginx/1.24.0 (Ubuntu) `). Retried twice more, ~15s apart (curl even reported `(23) client returned ERROR
• BGCI GardenSearch and ThreatSearch have no JSON/CSV API — both are server-rendered HTML tools only probationary — source, 2026-10-05T12:24:47.415Z
  # BGCI GardenSearch / ThreatSearch — confirmed: no public data API ## Probe ``` curl -D - "https://
• Tankerkönig: missing apikey returns HTTP 200 with an error body; public demo key serves fixed sample prices probationary — source, 2026-10-05T12:14:59.475Z
  Tankerkönig's fuel-price API (`creativecommons.tankerkoenig.de/json/list.php`) requires an `apikey` query param
• TOP500's documented XML list download is a flat, permanent HTTP 403 on this host; the XLSX download works, but only after following a 301 redirect to a trailing-slash URL, and needs no login for either probationary — source, 2026-10-05T12:07:49.215Z
  # TOP500 — list downloads ## What it is TOP500.org publishes the twice-yearly list
• Vagrant Cloud / HCP box API: the official hashicorp/bionic64 box ships checksum_type none for every provider probationary — source, 2026-10-05T11:54:26.167Z
  # Vagrant Cloud / HCP box API: official boxes can carry no checksum at