Please note that two excellent shortwave portables are on sale during Amazon’s Prime Spring Sale: XHDATA D-220 ($9.95 on sale) — A compact, ultra-affordable pocket radio. XHDATA D-808 ($87.55 on sa…
Many thanks to SWLing Post contributor, Barry, who writes: Thank you for the tip about the XHDATA deals on Amazon. I picked up a D-808; I’ve always wanted one. Your readers might be interested to k…
A federal judge has temporarily blocked the U.S. Agency for Global Media (USAGM) from cutting off funding to Radio Free Europe/Radio Liberty, citing a lack of proper justification. The ruling allow…
Newswire: Tek Talk of 3/31/25 at 8pm Eastern welcomes Ron Miller of Vispero to discuss tips on reading eBooks with JAWS such as EPub books using Thorium Reader, Kindle eBooks using the Kindle App for PC, and DAISY books using FSReader groups.io/g/tech-vi/message/89…
I get asked all the time why I made the choice more than 30 years ago to run Linux (Unix before that) instead of Windows. Here's reason number 1,000,001 that I am absolutely positive that I made the right choice all those years ago.
Attached: 1 image
Upcoming Windows 11 builds won't have the ability to to install without internet connectivity and a Microsoft Account.
https://blogs.windows.
- Support align attribute on HTMLParagraphElement interface - Implement declarative shadow DOM - Implement the `fit-content()` sizing function - Added --enable-experimental-web-platform-features command line argument
You can help support Servo, an independent web browser engine, and the health of the web ecosystem by donating:
monocles startet heute seine Crowdfunding Kampagne auf StartNext! 🎉
monocles bietet die Lösung für eine europäische Unabhängigkeit von Big Tech. Sei es der Ende-zu-Ende verschlüsselte Chat, der sichere E-Maildienst oder die privatsphärefreundlichen Smartphones mit unserem eigenen Betriebssystem. monocles schafft ein dezentrales, faires und ethisches digitales Ökosystem für alle.
How does it factor in that on #deltachat there are many apps that can be used in a chat without requiring a login or even a privacy policy ... And the apps all work like cryptpad but automatically and without requiring any server side hosting?
Editing documents and checklists and calendars are all safely end-to-end encrypted without a server and anyone can write new #webxdc apps permission free.
if you like to know about all the gory details of how we isolate apps from getting at any side channels, see this discussion which also includes a security audit by Cure53 delta.chat/en/2023-05-22-webxd…
And yes, it's maybe not perfect, but it's not just yet another web view that has arbitrary access. Also, even if an app manages to break isolation, it has no access to the social graph at all. See webxdc.org/docs/spec/selfAddr_… for what is exposed to apps from the messenger side.
Delta Chat’s “web apps shared in a chat” come with a unique privacy promise but in January it was shown to be compromised. We got into a surprising struggle with Web browser sandboxing issues that ...
@risottobias thank you, I will be reading these links. It seems like you strongly believe in your mitigations here, and if that's the case, I would brag about this relentlessly and mention it every time you mention availability of apps.
being phished into installing a malicious app? being typosquatted into installing a malicious app instead of a good one? an app being maliciously updated? a vulnerable app not being updated? a lack of community review?
@risottobias I'm nodding along with all this. Before I'd adopt Delta chat or any similar platform I'd have to understand how it disempowers bad actors and sloppy users.
@risottobias apps and app stores have such a bad security track record that the original post in the thread, touting Delta's many apps, comes off as very cavalier about security. Then you put yourself in the position of having to backpedal, explaining how your apps are different and safe. Maybe true, I still need to read and educate myself; but counterintuitive at minimum!
@ryanprior @risottobias not everybody is deep into security (e.g. the billions of users of WhatsApp or Telegram). We choose "app" and "app store" terminology because it's what people understand, and have an idea what they can do with it. We have gone through serious security scrutiny and efforts, some hundreds of hours. Dismissing this out-of-hand is your sovereign choice of course.
I can tell you went from zero to a perfect ten on unreasonably defensive so... maybe it's good for you to take a breather, regroup...
basics (free advice):
- webxdc should include a link to the source code in each zip file (not just a minified zip) (this is part of how fdroid's repository works) - webxdc should link to an author's website, and prove they control it (supply chain provenance) - should check for updates vs the latest zip file - it's a very, very (very) bad security smell to immediately dismiss a trivially obvious security concern
The Rapture (Millennium, Tribulation, Premillennial, Pretribulation, Posttribulation, End of Days) – Jimmy Akin’s Mysterious World jimmyakin.com/2025/03/the-rapt…
If you’re blind or visually impaired and have struggled with taking notes or recording meetings, the Plaud NotePin might just be the game-changer you’ve been waiting for.
Something that I've seen come up frequently in my learning about Zig is the idea that "Zig is safer than unsafe" Rust. And while that may be the case, I wouldn't say that's a point in Zig's favor more than a point against unsafe Rust.
Zig's protections are not actual guarantees, and can either mislead you or go away entirely based on optimization levels. Rust's protections are the same across optimization levels - you don't lose bounds checking unless you explicitly choose to use unchecked APIs. You don't need unsafe Rust to write to a mutable buffer of bytes, or to read that buffer. If you try to do an out-of-bounds read or write on that buffer, you will always panic. If you try to return a pointer to a local in Rust, your program will not compile. In Zig? Both cases depend on your optimization level.
Let's look at the following Zig:
const std = @import("std");<br><br>const User = struct {<br> name: [6]u8 = undefined,<br><br> fn setName(self: *User, name: []const u8) void {<br> @memcpy(&self.name, name[0..self.name.len]);<br> }<br><br> fn getName(self: User) []const u8 {<br> return &self.name;<br> }<br>};<br><br>test "sets name to long str" {<br> var user = User{};<br> user.setName("SomeExtraHackyUser");<br><br> try std.testing.expectEqualStrings("SomeEx", user.getName());<br>}<br>
This compiles fine, and our test passes if we run it from the IDE or zig build test with the default settings. So we go about our day thinking we have no bugs in that code. However, once we run with one of the --release options, we might realize: On -ODebug we get the expected result, on -OReleaseSmall we get an empty slice, and on -OReleaseSafe and -OReleaseFast we get a segfault (-OReleaseSafe and -OReleaseFast handle segfaults differently, but it's a segfault nonetheless). Different behavior between our default testing mode (and even the default mode we'd run code in as we develop) and the release modes isn't ideal. The bug ultimately comes down to one character.
Can you spot it? If you're still having trouble, let's port the same mistake to Rust:
#[derive(Debug, Default)]<br>pub struct User {<br> name: [u8; 6],<br>}<br><br>impl User {<br> pub fn set_name(&mut self, name: &[u8]) {<br> let size = self.name.len();<br> self.name.copy_from_slice(&name[..size]);<br> }<br><br> pub fn name(self) -> &[u8] {<br> &self.name<br> }<br>}<br><br>#[cfg(test)]<br>mod test {<br> use crate::User;<br><br> #[test]<br> fn sets_name_to_long_str() {<br> let mut user = User::default();<br><br> user.set_name(b"SomeExtraHackyUser");<br><br> assert_eq!(user.name(), b"SomeEx");<br> }<br>}<br><br>
The compiler here will tell us how we've sinned:
error[E0106]: missing lifetime specifier<br> --> src/lib.rs:16:26<br> |<br>16 | pub fn name(self) -> &[u8] {<br> | ^ expected named lifetime parameter<br> |<br> = help: this function's return type contains a borrowed value, but there is no value for it to be borrowed from<br>help: consider using the `'static` lifetime, but this is uncommon unless you're returning a borrowed value from a `const` or a `static`<br> |<br>16 | pub fn name(self) -> &'static [u8] {<br> | +++++++<br>help: instead, you are more likely to want to change the argument to be borrowed...<br> |<br>16 | pub fn name(&self) -> &[u8] {<br> | +<br>help: ...or alternatively, you might want to return an owned value<br> |<br>16 | pub fn name(self) -> Vec<u8> {<br> | ~~~~ ~<br><br>error[E0515]: cannot return reference to local data `self.name`<br> --> src/lib.rs:17:9<br> |<br>17 | &self.name<br> | ^^^^^^^^^^ returns a reference to data owned by the current function<br><br>Some errors have detailed explanations: E0106, E0515.<br>
// Note: we could also use`self: *const User` to tell the compiler `self` is immutable here<br> fn getName(self: *User) []const u8 {<br> return &self.name;<br> }<br>
And now the code properly works at all optimization levels. Rust caught a bug that could have had major consequences in production at compile time. The majority of the time you spend writing Rust will be be in a context where you can take advantage of the borrow checker. If you must use unsafe Rust, then you can use Miri. In Zig you have no borrow checker, and the compiler does not have your back in the majority of contexts. Therefore you have to use tools like valgrind to ensure safety even in simple cases like this.
Again: The important question isn't "how did a reporter get added to a Signal group for discussing sensitive military operations?" (though that's certainly worth asking).
The big question is why Signal was used for discussing sensitive military operations in the first place, especially when everyone involved (except the reporter) had ready access to official classified communications systems.
Signal is great, but it's not designed to prevent this kind of screw up. The official systems are.
Soon, in the first weekend of May 2025, we are gathering curl enthusiasts in a room in the wonderful city Prague and we talk curl related topics over two full days. We call it curl up 2025. curl up is our annual curl event and physical meetup.
This morning, here in Aotearoa New Zealand, I met a table of 6 hilarious women (70s to 80s) who call themselves The Inflexibles. Longtime friends. Cackling with relish at each other's dodgy jokes, cheerfully comparing the books they love, drinking coffees and eating buttery pastries. Making plans for dancing in the park next Sunday. I'm still grinning. That is all.
One of these days I absolutely will get a recording of the all-too-common occurrence in our household where our cat meows "Hello!" and some combination of my partner and I call back "Hello!" with roughly the same inflection and intonation.
I'm not really sure who trained who to do that. Actually, that's a lie. I'm pretty sure the little shit trained us.
- Matrix Gateway support for rooms - Security improvement with ability to store multiple simultaneous password types - Ability to execute API commands from an XMPP client
and more !
This is a major release and you can check the details for the release on ProcessOne blog:
We are pleased to announce ejabberd 25.03, a big release with new features and many improvements, as it comes three months and 180 commits after ejabberd 24.12.
Elon’s slide decks to investors of his Twitter purchase leaked years ago, and his text messages about the purchase were made public after a lawsuit.
Almost every single thing he promised investors and talked about in those text messages hasn’t been delivered.
His own valuation now shows it has lost a decent chunk of its value. The legally required EU filings on user numbers shows it is down across all EU since he took over.
Hubert Figuière
in reply to Rick Scott 🏳️⚧️ • • •Sensitive content