Long overdue, but Meta is releasing a camera passthrough API for Quest developers early next year theverge.com/2024/9/25/2425023… Still anticipating numerous hoops and restrictions though... #AR/#VR
I’m super excited about this blogpost. The approach is so counterintuitive, and yet the results are so much better than anything else that we’ve tried for memory safety. We finally understand why.
With zero-overhead bindings to V8 APIs, memory safety through Rust’s ownership model, and great docs, it’s battle-hardened and production-ready. From here on, Rusty V8 will follow Chrome versions for predictable upgrades.
Our end-to-end encryption engine rPGP just got a big update, fully supporting OpenPGP "cryptorefresh" RFC9850 ... Many thanks to @hko and dignifiedquire for fearlessly pushing ahead in the security machine room ... Please give them a 💜 and also @NGIZero who funded it ! fosstodon.org/@hko/11319894759…
This release brings rather complete support for the excellent new OpenPGP RFC 9580 (also known as "crypto refresh", or "v6")
RFC 9580 standardizes modern cryptographic mechanisms for OpenPGP: AEAD-based encryption, Argon2, and SHA2 fingerprints for the new OpenPGP v6 key format (v4 keys use SHA1).
The percentage of Android vulnerabilities caused by memory safety issues has dropped from 76% in 2019 to only 24% in 2024, representing a massive decrease of over 68% in five years.
Mona 6.8 is now available on iPhone and iPad on App Store, including new features and optimizations for iOS and iPadOS 18. geo.itunes.apple.com/app/id165…
- The default app icon now has a new look when Dark Mode is on - "Controls" for composing a post and opening a tab on the in-app tab bar - You can customizes your "Controls" with a custom title, subtitle or icon - New shortcut action for opening a tab on the in-app tab bar - Varies shortcut actions can now be configured to use the "Default Account"
Mona 6.8.1 is now available on iPhone and iPad on the App Store, fixing an issue that caused blank controls on the Control Center. geo.itunes.apple.com/app/id165…
Mona 6.8.3 is now available on the App Store for iPhone, iPad, and Mac. The app now shows a privacy notice on the post composer when composing mention-only or follower-only posts. Additionally, an enhanced checking process has been implemented prior to uploading pictures or videos to Mastodon to ensure GPS information is stripped. getmona.app
Mona 6.8.4 is now available on the App Store for iPhone, iPad, and Mac. This update improves the app performance when you have a lot of mute items, and fixes a crash relating to HDR photo processing. getmona.app
Have you already been notified that on MacOS, when opening a thread, profile etc. in the side bar, VoiceOver no longer seems to tell users that focus has shifted to the new panel. Visually, it happens, e.g. if there are multiple items, up and down arrows do change focus inside the new panel, but initial focus after pressing enter on a post no longer speaks the new focus after it transitioned visually. This has been the case since MacOS Sequoia.
It's the newest joke in town for zionists when they're asked questions they don't like: "do you want a beeper?" Deborah Lipstadt is the State Dept Envoy to Combat Antisemitism.
I'm not convinced by the part about magic links being user-hostile, misguided, and making you yearn for passwords. Magic links are still the most foolproof solution I know.
@matt That’s a fair opinion. But every time I use them I have to:
1. Wait 15 seconds for an email 2. Have access to my email 3. Worry whether they get lost in spam 4. Add friction 5. Make that destination (email or text) a single point of failure for full access to everything you own (though with resets it’s not too far from it)
Reading about world-systems theory, wherein the capitalist world is divided into core and periphery regions. The core has the higher-skilled, capital-intensive industries and the periphery is essentially a producer of raw materials in service to the core. (en.wikipedia.org/wiki/World-sy…)
It's reinforced by the work of folks like Walter Rodney (author of How Europe Underdeveloped Africa) and Frantz Fanon (author of The Wretched of the Earth).
It's also seems to be reproduced on the city/country scale.
GREAT change is approaching. NIST will standardise prohibition of requirement of composing passwords from various character styles, and requirement for periodic password changes. These are harmful and obsolete rules. Now they will be treated as a cybersecurity weakness pages.nist.gov/800-63-4/sp800-…
To my last boost. Please boost this for wide spread. This is an opportunity for #braille dice sets to enter the realm of #mainstream and mass manufacturing. I haven't been able to read of full set of #dice as a #TTRPG player in 20 years since I went #blind. It would be beautiful for something like this to be added to life and make me feel like I'm right up there with everyone else. Thank you!
I’m super excited to share that they hit their goal for the TTRPGs for Accessible Gaming Charity Bundle! Because of your amazing support, DOTS RPG Project can now team up with Die Hard Dice to create awesome braille dice for the visually impaired and blind community.
This is such a big win for making tabletop gaming more inclusive, and I couldn’t be happier. I’m really looking forward to snagging a set of these dice myself! I'm not in anyway involved other than a supporter but you have no idea how long I've been waiting for this.
This is just my personal huge thanks to everyone who chipped in and helped spread the word. You all rock! 🌟🙌
"Mimochodom, Robert Fico začal účet za obžerstvo dvanástich rokov vlád Smeru a tri roky gamblerstva Igora Matoviča vyčísľovať aj v slovenských korunách, čo neznie dobre. Jeho volič si nevie predstaviť ani miliardu, nieto tridsať, nedá sa to vyložiť na stolík v keši, sú to iba dve čísla, ktoré znamenajú veľa a veľa veľa. Dúfajme, že vodca nezačal trénovať predstavivosť svojho voliča na niečo, čo nám dnes pripadá nepredstaviteľné."
p.s.: Ak by sme tvorili kroniku vladnutia v SR cisto iba pridavanim slov a hesiel (za dnes napr. "nalepky na pocitaci"), aj tak by sme produkovali "tony textu" pricom vyrazy typu "blahobyt", "stastie", "nadej", "spravodlivost" ci "uzitocny pocin" by sme tam hladali marne.
I ordered something once, 2 weeks later it had been delayed 3 times. And cancelling the ~$800 order was hard. It works, but when it doesn't it's a nightmare.
With OCSP in all forms going away, I decided to look at the history and possible futures of certificate revocation in the Web PKI. I also threw in some of my own proposals to work alongside existing ones.
I think this is the most comprehensive current look at certificate revocation right now.
I see that certificate revocation is pretty much web-centric. What would e.g. XMPP servers do besides setting CAA records and hoping their keys aren't stolen?
@cybertailor All of this also applies to XMPP. Nothing’s stopping an XMPP client from using CRLite. But most generally have cobbled-together crypto. I’d be amazed if most non-browser-based ones even handled OCSP Must-Staple correctly.
my rationale for using basic security measures as a filter is that i have to efficiently narrow down millions of domains to something I can manually check, and I might as well pick something positive.
after the “good security” filter, I’ll isolate domains with a main and h1 tag with no trackers in a “good page content” filter. Then I’ll figure out how to narrow it down further before cursory accessibility reviews and reading what people post in the Tor Browser.
scraping the HSTS Preload List and Internet.nl Hall of Fame saw much higher success rates. A minority of the domains passing the first filters are from the Tranco top 2M.
Partway through, I decided to start filtering out Nextcloud and Searx(Ng) instances. I was already filtering out Masto instances and some others. I ran a second filter to check for the existence of hyperlinks on the page to avoid dead-ends, and to ensure they don’t block Tor.
I filtered a subset of duplicates and handled a subset of redirects. I’m down to around 1.1k domains, around 350 of which are the ones that qualified from Tranco’s top 2.6M domains. Many more are from the HSTS Preload list and Internet.nl Hall of Fame. Around a couple dozen more are uniquely from my browsing history, site outlinks, old chatrooms, web directories, and other more obscure locations.
I can manually pare this down over a couple weeks but that’s too much work. Need to figure out the right set of additional filters. Maybe a “points system” for privacy, security, and accessibility features and then taking the top 250 domains with the most points.
Might be useful to have a dump of your rejections and reasons, for those of us who think not being in the list is a really useful symptom to investigate.
@timbray Right now the filter is TLSv1.3, has a strict content-security policy header (with the exception of allowing unsafe-inline styles), has no common tracking third-parties in the CSP, allows Tor. Then it needs a main, h1, a, and meta viewport element.
I’ll then add a points system to cut it in 1/3 and manually review a few domains per day.
Or I could run a subset of Axe-Core on every page and let my fans spin up.
Axe-Core is one of the only page-content checkers out there that doesn’t have a ton of false positives. Even the Nu HTML checker (often incorrectly referred to as the HTML5 Validator; HTML5 can’t be validated) has a ton of them. But some of Axe’s errors, like dupe link names, are way too trivial compared to easy-to-spot manual-only checks like “this h1 is used for the site name but it should be used for the page title”.
@khm a main element can have many article elements or just one. every post in this thread is an article element. every reply i list to one of my blog posts is also an article element. when i include an xkcd comic in a blog post complete with title, caption, and transcript, i use an article in an article.
school me on this main element. I use article at the moment and this is the first I'm hearing of main. otherwise I think sciops.net meets these requirements... except not only do I not use hsts, I expose content over http for accessibility reasons
@khm its existence hearkens back to the “standard” page layout most settled on early in the Web’s history: a header, a main, maybe a couple aside elements on the side, and a footer. A “skip to content” link, if it exists, should typically skip to the first non-decorative thing in main.
Viewing your post on the remote instance, I imagine that main may begin just before your profile banner.
I ran an aggressive filter on the sites, but scrapped it because I had already seen too many of the personal sites that passed.
that filter mandated multiple of the following:
CAA record paired with DNSSEC
OCSP Stapling
COEP + COOP headers
No third party content in the CSP
An onion-location header.
and all of the following:
Not enabling the insecure XSS Auditor with the X-XSS-Protection. Either leaving out the header or explicitly disabling it.
Disabling MIME sniffing with X-Content-Type-Options.
Instead I’ll just manually comb through 100-200 domains a day in the Tor Browser to trim my way down to 500-600 sites or so, then figure out how to proceed. I’ll throw out dead ends, login pages, cryptocurrency, very corporate pages, pages for large organizations without much interesting reading material, LLM-related pages, and anything that doesn’t work in the Tor Browser’s “safest” mode (no media, JS, or a bunch of other features).
When I’m down to a few hundred I’ll probably run a mini version of Axe, decide on an actual points system, and spend more than a few seconds on each site looking for original writing, projects, and/or art and reviewing accessibility.
Last time I tried this, in October 22, I sent accessibility feedback to a dozen themes and sites. I resumed this project now because some common ones finally implemented feedback.
200 websites left to do a cursory accessibility test on. i look at focus outlines, forced colors mode, proper use of heading level one (page title not site title) semantic html (nav, avoids div soup), and a quick run of axe-core. about a minute per site. this will take several more days before i’m ready to build a directory of the survivors and give a proper look at each one.
I should document how I do these incomplete-but-helpful “lightning audits” more thoroughly. After looking at a hundred sites the process has become automatic.
biggest things I look for in an automated audit like Axe are skipped heading levels, missing landmarks (main is big one), and missing alt attributes (mainly on non-decorative images, though decorative images should also have an empty alt).
with inspect element i also look for some semblance of page structure. is it all div soup or is there a header, nav, main, and footer when applicable?
I open the site in a regular browser profile and in my personal profile with an adblocker and forced colors mode, and make sure that tabbing around works in both with focus indicators.
Automated contrast checks are good but also not terribly nuanced. A more nuanced check like APCA with awareness of font size, the type of element (decoration? spot element like a superscript? fluent text?), font weight, etc. is what we should use but that takes time. For a lightning audits i just eyeball it and flag it if the contrast seems very obviously bad.
I used to think that contrast was only talked about so much only because violations were common and it was easy to spot, not because it was one of the most important issues.
Then I started using a shitty dim screen at night with screen gamma adjustment and extra-strong nighttime orange-tinted blue-blocking computer glasses and it got personal.
I don’t think everything should be perfect under such extreme conditions; your visited links and unvisited links appear to have the same hue with a low-contrast night-optimized display. but I should be able to read a paragraph of text, and see the beginnings and ends of links.
I decided that checking 3m domains wasn’t enough so now I’m also checking the top 2 to 5 million DomCop domains (unlike Tranco, this includes subdomains). And a few million Marginalia.nu domains with a score of 6 or higher.
almost done checking the ten millionth domain lmao
i narrowed 5m domains to around 300. i’m hoping my quality filters will give me 500 sites to work with. then I can start being ✨subjective✨ and narrow it down to 200-300 interesting ones for a directory, plus a hall of fame containing maybe 25 sites.
Refined my automatic filters to require a main and h1 element in the raw HTML response. Content outside landmarks and misuse of headings are the most common non-color violations, and a missing h1 happens almost as often as using h1 as a site title instead of a page title.
as i drift off, knowing that three machines on three networks are busy doing a polite ten HEAD requests per second while i sleep (one per domain, millions of domains, slow enough to not get blocked by anyone) and anticipating the results when I wake gives me the same fuzzy feeling as I had years ago playing idle games but it’s so much more constructive. it’s going towards building something new that’s never (to my knowledge) been tried, mixing the new automatic-curation approach with the old manual-curation approach to website discovery. shining a light on the sites that will never see page-one on a major search engine.
@esoteric_programmer further upthread i describe how i filter. I use lists of domains like Tranco too 6m domains, DomCop top 10mil, Marginalia.nu data dumps, my browsing traffic and bookmarks, and some others.
very interesting! however, if you can search in the directory, it's kinda a search engine. But yeah, what do you mean by good practices in this case? and how are you crawling for domains?
Some of the most common #accessibility issues I see in the shortlist of 300-400 sites (filtered from 10 million):
Links only distinguishable through a hue change. I consider links discernible through page structure (e.g. simple navbar links) exempt, but for in-text links we need to see the beginnings and ends of their interactive regions. Underlines work; outlines are another approach I’ve seen.
No landmarks, or stuff outside landmarks. Everything should be in a landmark: header, main, section, footer, and/or aside are what you typically want on the top-level, directly under body. main is the most important.
Misuse of or missing headings. Your page needs one (yes, one) h1 that titles the page, not your entire website. Don’t skip heading levels just to get smaller text. Don’t use headings for stylized text. A lower heading following a higher heading looks like a subtopic of the higher heading, not its own thing.
Contrast. I recommend the APCA contrast tool. Don’t lose sleep over the occasional superscript having barely sub-optimal contrast; focus on bigger issues if you’re 99% perceptible. Often, background images are the culprit; remember that users override foreground and background colors and may use a different viewport that results in text in front of a lighter/darker part of the background image. Contrast issues with images are nearly impossible to automatically detect with popular tools.
Focus indicators that are invisible or barely-visible, or rely solely on hue changes.
Fancy bespoke hidden/toggle-able menus whose hidden items are still accessible via keyboard navigation, making me tab through items I can’t see.
Interactive items using font icons whose accessible names are unicode code-points, even if the author clearly tried to give them readable names.
Really unhelpful alt text like “diagram of X” without actually explaining the things being diagrammed, whether in alt-text or a caption.
Animations that don’t respect prefers-reduced-motion.
Link imperceptibility, missing landmarks, and heading misuse are really common.
A common nit-pick: lists of links (e.g. in nav) would benefit from ul or ol parents.
A common issue that isn’t exactly an accessibility issue: toggles like hamburger menus that require JS don’t work in the Tor Browser’s “safest” mode. I’m looking at simple websites that have no need to exclude anonymous visitors.
Oh, and the document outline algorithm is dead. You can’t have h1 descendants of other headings. or h2 descendants of anything other than h1. Levels do not reset when you enter a child sectioning element, even article.
@toastal AT users are used to list navigation. Screen readers also do neat things like announce the number of items. “list with 136 items” may not be worth hearing all the way through, but “list with eight items” might be different.
If something semantically makes sense, it should receive the appropriate semantic markup even if the presentation is visually worse in a given browser. Presentation should not be a major concern of the markup.
you are going to have to explain the a list of links should be in list items for semantics/accessibility to me. When I load a site in a TUI browser which doesn’t have a stylesheet to do layout, nothing is more infuriating than a massive vertical list of links.
@toastal A list of navbar links being marked up as a list is a very standard pattern that people and ATs have come to expect, just like how pagination links or table of contents links are list entries.
If you have a list of short non-landmark items or several consecutive standalone items of the same type (single standalone sentences, images in a gallery, links, entries in a post archive, etc) they should be a list for consistent navigation.
If each paragraph is its own item and not part of the same work or part of the same article (e.g. untitled entries on a microblog) they should also be contained in list entries. See the list of h-entry microblogs in tantek.com/ for an example.
then at what point is an article not a list of sections with a list of paragraphs? Most of my navigations in the last 3 years have been like 7 items or less with role navigation & skip link to get around it if you did not want to consume it. I am not convinced adding a bunch of nodes is necessary here just because you *can* make a list of it. Why is this different?
Reminder: To celebrate our 100th follower on Mastodon we are slashing our prices in half! 50% off all of our courses, just enter code 100-masto-pals on checkout! This code is Mastodon only. Valid until end of September. a11y-collective.com/courses-ov…
(But I can't keep you from sharing this code with anyone who needs a solid foundation in all things Web Accessibility.) #a11y #accessibility
Am schlimmsten finde ich das Statement von Spahn ("wir sollten EU-Recht einfach mal aussetzen"). Was für ein KATASTROPHALES, FATALES Signal. Zu fordern, demokratisch entstandenes Recht & Gesetz einfach "auszusetzen". Wen wundert es da noch, wenn Faschos auf der Straße auch einfach Strafrecht aussetzen und beleidigen, drohen, verletzen und morden? Spahn ist mitschuld.
treefit
in reply to Organic Maps • • •Dan
in reply to treefit • • •