Daniel's weekly report November 8, 2024

lists.haxx.se/pipermail/daniel…

release. rock-solid, fosdem, talks, curl -v google.com, podcasts, uncurled, security, polhem prize

One more GNOME development and socializing meetup in Hamburg with @camelCaseNick and @FineFindus ! Today was a really productive day. @FineFindus created a libadwaita MR for some API we also want in Papers, and merged a locatization MR in udisks-rs. And @camelCaseNick and Ihelped debugging the libadwaita code and got 5 MRs in Papers in! As always, send us a message if you come around!

#GNOME #Papers #postmarketOS #Hamburg

Sensitive content Click to open/close

Skipped last week due to a time off. Back to app icon sketch fridays!

#gnome #app #icon #sketch #procreate

Mood: I just put a second pair of glasses on the first pair of glasses that were already on my face.

(is it still Monday?)

I wish I could tell Firefox to NEVER open a new tab from an external URL in some of the window. Or always in ONE specific.

For now it's just a crap shoot.

I posted this on elsewhere, and folks found it helpful, so here it is for y’all

For #lgbtq married couples, it's time to take steps to protect your marriage in case same-sex marriage is officially dissolved in the coming years. My husband and I did this when Roe V Wade was overturned, so I hope this is helpful. 👇

This is an important effort to help explore what can be done to make the #Web less energy-hungry…. and thereby help reduce the impact of the overall #Internet on #ClimateChange. (Since web traffic is such a huge amount of Internet traffic.) Good to see this happening!

From: @w3c
w3c.social/@w3c/11344250260640…

A few months ago I wrote about how I approach alternative text for images and tried to offer context for each of my considerations.

“My Approach to Alt Text”

adrianroselli.com/2024/05/my-a…

I also link other resources that are not mine.

#a11y #accessibility

My Approach to Alt Text

I ran across a survey from Tilburg University on the experiences and perspectives of image describers. It asked what process I follow to write image alternative text, and it occurred to me that I don’t use a checklist or guideline anymore.

^{Adrian Roselli}

So much for being the 'ethical, safe one'

Anthropic teams up with Palantir and AWS to sell AI to defense customers

techcrunch.com/2024/11/07/anth…

#ai

Anthropic teams up with Palantir and AWS to sell AI to defense customers | TechCrunch

Anthropic has teamed up with Palantir and AWS to sell its AI family of models called Claude to defense customers.

^{Kyle Wiggers (TechCrunch)}

Du weißt, dass eine Webseite scheiße ist, wenn sie automatisch übersetzten Tutorial-Text enthält, in dem curl als Locken übersetzt wurde.

#curl #Locken

If you're worried about storing your data with US tech companies in light of the election results, this link has a list of European alternatives. These include:

- Email hosting
- Cloud storage
- Domain name registration
- Navigation apps
- Many other services

Stay safe.

european-alternatives.eu/

Edit: Follow the creator at: @european_alternatives

Homepage | European Alternatives

We help you find European alternatives for digital service and products, like cloud services and SaaS products.

^{European Alternatives}

Sad to see that @mozilla needs to layoff 30%😢

Is Google’s ban on paying Mozilla for including G Search in Firefox the reason?

All #privacy companies must unite against Big Tech now! 💪
👉 tuta.com/blog/will-ban-on-goog…

Can someone explain why the #Rosenbergs were executed for providing classified documents to Russia whilst convicted felon Trump did the same thing but was elected President of the United States🇺🇸?

#Treason #TrumpIsATraitor #Russia #politics

When nobody want the feature, include it in the base and increase the price to at least offset the cost:

Microsoft is bundling its AI-powered Office features into Microsoft 365 subscriptions

theverge.com/2024/11/7/2429026…

Microsoft is bundling its AI-powered Office features into Microsoft 365 subscriptions

Microsoft is bundling its Copilot Pro features into Microsoft 365 in some markets. Prices are going up in exchange for AI-powered Office features, though.

^{Tom Warren (The Verge)}

Any cryptographers who are sad about the post-quantum competitions coming to an end and looking for a new problem, here's one I've seen in a few places:

There's a trend towards end-to-end encryption for all datacentre interconnects (no plaintext on the wire, for any wire that leaves the CPU package). This includes things like PCIe, 100 GigE, and so on. As a result, we're rapidly approaching a world where there's over 1 Tb/s of encrypted traffic flowing in and out of every node.

At this rate, bit flips are inevitable somewhere (especially when you scale this up to a datacentre size). This leads to a couple of problems. The first one is bit flips on the wire.

The integrity tags in AES will catch these, but if you need to retransmit that's very painful (the bandwidth-delay product means the buffer sizes get huge), so ideally you want to bake in some forward error correction after encryption. But now you're reducing data rates.

Problem 1:

Can you design an integrity scheme for a symmetric cypher that also provides error correction, is easy to implement in hardware, and does not provide an oracle. I honestly have no idea whether this is even theoretically possible.

Beyond that, the AES engines are hot. Encrypting at even 10 Gb/s consumes a fair bit of power (Problem 0: Can you design a symmetric cypher that can be implemented in 10% of the power of AES in a hardware implementation?). This means that bit flips can occur in the middle of the encryption. These will corrupt the data but may have valid integrity tags.

Problem 2:

Can you design a symmetric cypher such that the integrity tag calculation can be computed in a pipeline that's independent of the main encryption (without duplicating a load of work or massively increasing the number of calculations) such that a bit flip in either pipeline will cause the integrity checks to fail?

Currently, I believe the work around for this is to add forward error correction before encrypting, such that a single block failing can be small, but that also adds a lot of overhead (i.e. lower bandwidth).

Problem 3:

Can you build a cypher scheme with both of these properties? Integrity tags permit error correction and can be computed cheaply in an independent pipeline so that they can catch bit flips during encryption.

If Trudeau gave half a rats fuck about foreign interference in Canada X would already be banned.

#cdnpoli

I just read this in a newsletter and thought it worth quoting and sharing. "I suggest that instead you keep your focus on all that is good in your life, and what matters most to you. I came across this quote from Maya Angelou that is perfect for this moment in our history:

My wish for you is that you continue. Continue to be who and how you are, to astonish a mean world with your acts of kindness. Continue to allow humor to lighten the burden of your tender heart."

Saw a YouTube short asking Kamala voters if they would date a Trump voter, and all the women go:

Eh, no. This is a person who has literally voted to put me at risk.

One white guy: sure! We need to tolerate that people have different opinions.

That right there.

Harm that doesn’t happen to you.
You can tolerate it because it doesn’t happen to you.

it should be even more obvious now that there are clear use cases for private, censorship-resistant ways to transfer money.

it should also be obvious that "crypto industry" grifters who are backing trump don't give two shits about that & are cozying up to fascists for profit

A comment from a non-native Finnish speaker made me realise today that our word for a fire, "tulipalo", is a compound word made from "tuli" and "palo", which both also mean fire. It's a fire fire.

#Finnish

7️⃣ Here's the 7th installment of posts highlighting key new features of the upcoming v257 release of systemd.

The graphical login prompt you see when your computer boots up is a sensitive UI: typically, when starting to work, without much thinking you'll type in your username and password, expecting it to log you in and provide you with your desktop session. However, what if someone just opened a website in a browser in full screen mode with contents that just *looks* like your login screen, …

I made an experiment. Went to YouTube front page, blocked all the AI/crypto scam ads that popped up and then refreshed the page. They stopped coming after 13 iterations during which I blocked 17 different ads.

I'd really love to know how much of the ad business is made up of scams, because it feels like it's a lot.