Fun with `pthread_cancel()` in curl. How I got that working and what challenges I encountered.
#curl #dns #pthreads
eissing.org/icing/posts/pthrea…
You probably know about threads and most likely header of pthreads, but have you ever used pthread_cancel()? Well, I had not before last week and it was a little bit of a journey.icing's blog
End-to-end encryption (E2EE) is important. However, on self-hosted or otherwise trusted servers, the client-to-server transport layer presents a much larger attack surface. It’s the first hurdle an adversary must overcome before they can attack E2EE.
That’s why #Conversations_im includes advanced MITM detection called Channel Binding. Turn it on today!
It’s optional for now because not all servers support it. Talk to your admins.
Neither @matrix nor @delta offer comparable protection.
I've been nominated for the Swedish award "developer of the year" together with @engstromjimmy and @patriksvensson
(Website is entirely in Swedish)
developers-day.confetti.events…
Reminds me of when I was voted the second best developer in Sweden in 2016: daniel.haxx.se/blog/2016/12/01…
"Probably the only person in the whole of Sweden whose code is used by all people in the world using a computer / smartphone / ATM / etc ... every day. His contribution to the world is so large that it is impossible to understand the breadth.daniel.haxx.se
Tack för noten om "andra bästa utvecklaren", kom att tänka på "tredje bästa bandet i Lund". Det var bra för då fick jag höra på
youtube.com/watch?v=McQsv0d4PW…
Provided to YouTube by The Orchard EnterprisesEn Droppe Citron · TorssonEn Svensk Tiger℗ 1989 Rim och reson musikproduktionReleased on: 1989-03-30Producer: T...YouTube
PROSÍM O BOOST 🙏
Kamarád si chce stavět NAS
Proč ? - CHCE ‼️
Vychází z mé konfigurace, ale asi 15 let staré. Samozřejmě dáme lepší zdroj, jen jsme na vážkách zda i lepší desku (CPU) - já jsem vždy pro výkon, nemusí to být jen NAS, může to řídit kamery atd. - za mne N100
Tak dávám hlasovat .... jaký CPU by jste teď zvolili ❓(jdeme dost po nízké ceně, v úvahu připadají jen desky s integrovaným CPU a musí být 64bit s podporou HW zpracování videa, proto jen strohý výběr ze 2 CPU)
Holt je to min. 1000Kč navíc 🤷♂️
I can't wait for the true crime murder show or even the details in the news where the perpetrator would have confided to ChatGPT.
It's not if, it's when.
Plot twist: it's the bot that convince them to commit the crime.
In the latter shall the operator be considered complicit?
This is legitimately the most bizarre take on the online safety act I have ever read in my entire life
I share all my deepest thoughts and feelings with ChatGPT – but our friendship is doomed
theguardian.com/commentisfree/…?
At the moment, the AI chatbot never remembers me, so I can ask it the same questions over and over and enjoy its non-judgmental replies. The Online Safety Act, though well-intentioned, will change all that, writes Coco KhanCoco Khan (The Guardian)
Microsoft says U.S. law takes precedence over Canadian data sovereignty
digitaljournal.com/tech-scienc…
Canada privacy laws are so much weaker than Europe, and they say they could protect European data.
And I clearly see ZERO action taken by the Microsoft addict Government of Canada, that have been funnelling hundreds of millions to Microsoft tax shelter for decades.
Now ask AWS and Google. I'm sure it's the same.
Microsoft representative says US CLOUD Act comes before other country's sovereignty.Alexander Rudolph (Digital Journal Inc)
You know how Microsoft says they would have to hand over data as requested by the US Governemnt regardless of the guarantees they (falsely) made ?
Imagine an email provider also based in the US.... who is known to NEVER got to bat for their users.
Yep, the great Gmail migration was a bad idea.
L’after ? Très peu pour lui… À 4h du matin, le videur fait le « ménage » au Bar’atteint, mythique lieu des nuits strasbourgeoises. Derniers ...David Geiss (Les Dernières Nouvelles d'Alsace)
Copyright class actions could financially ruin AI industry, trade groups say.Ashley Belanger (Ars Technica)
The things we hate about ChatGPT—the unnecessary ass-kissing, affirming our ideas and observations, preparing a seven-bullet-point action plan we didn't even ask for—are exactly why executives love it.
YMaaS—Yes Man as a Service.
Two years, but re-upping this on home UV installation in light of Our Ongoing Contingency:
exple.tive.org/blarg/2023/06/1…
Two years ago I installed a UV sterilizer in my ductwork; since then the family has enjoyed basically one case of something non-COVID (we tested, so best we know it was really not covid) and zero cases of in-house transmission of anything.
If you have the means to add this to your environment, I strongly recommend it.
One thing that I want to mention, true in 2023 and just as true in 2025: the number of corporations I’ve seen making a point to say that their HVAC systems have been upgraded, that they’ve been working to make collaboration safe in their spaces during this whole RTO push, has been zero. It has been exactly zero.
Compared to the cost of a single employee getting sick this shit is basically free. It is cheaper than toilet paper or soda. But somehow.
It is wild (and humiliating) that Canada's response to this isn't throwing people in jail and kicking Microsoft out of the country.
digitaljournal.com/tech-scienc…
Microsoft representative says US CLOUD Act comes before other country's sovereignty.Alexander Rudolph (Digital Journal Inc)
for decades there are been people trying to convince the Govt to stop funneling money to Microsoft for everything, which is basically direct into the US and instead use open source tech that Canadian (suppliers) could provide.
Instead they all gamed procurement to make sure these proprietary vendor could continue to bribe...
Správci hesel jsou také jen software. A zvlášť ti, kteří mají rozšíření do browseru nebo jsou dokonce celí nebo jejich klientská část implementovaní jako rozšíření, představují riziko. Jak velké ukazuje práce výzkumníka z ČR Marka Tótha, který na #DEFCON33 prezentoval díry v mnoha velmi používaných správcích hesel. #kybez
marektoth.com/blog/dom-based-e…
I described a new attack technique that I used against 11 password managers. The result was that stored data of tens of millions of users could be at risk.marektoth.com
OK, I said it:
> As an aside, I think we should seriously be considering moving off of GitHub, not committing ourselves more. The hosting is fine. The free CI is fine. Everything else is increasing problematic.
forum.djangoproject.com/t/adop…
It seems a bit previous to open a ticket. That will only be closed pending a discussion here. Q: is there a list of PyPI Trusted Publishers available anywhere? As far as I can see, is it only GitHub? It’s not clear to me that it’s actually possible …Django Forum
I've decided I don't want to get left behind and have taken my first steps to embrace "AI" guidance in my life.
I bought a tarot deck and will now be using "Arcana Insights" every day.
I'll also be pulling a card every time someone says "I asked chat gpt" in a work meeting.
Today I pulled 5 of swords, which perfectly captures my face whenever someone says "I asked chat gpt".
I dropped this into the meeting chat, warning of hollow victories and the need for building on evidence.
reshared this
Jak byście mieli zgadnąć - w jakim stopniu przychody z akcyzy za papierosy pokrywają koszty leczenia raka płuc na NFZ?
Boosty mile widziane
Imo, kolejnym czynnikiem do rozważenia jest to, jak wysokość akcyzy wpływa za równo na popularność papierosów, jak i na ilość tych kupowanych w szarej strefie.
To wcale nie jest takie oczywiste, że podwyższenie akcyzy polepszy sytuacje. Może to spowodować zwiększenie udziału szarej strefy, znikomy wpływ na ilość spalanych papierosów, a co za tym idzie obniżenie wpływów licząc per faktycznie spalany papieros.
Nie wydaje mi się, żeby Polska była w tym punkcie, ale np. UK już raczej sporo bliżej.
This adds (1) HTTP/3 proxy CONNECT support and (2) MASQUE CONNECT-UDP support for OpenSSL QUIC stack. Usage: curl -k -4 --http1.1 --proxy-insecure --proxytunnel --proxy-http3 --proxy https://GitHub
@icing @SimmerVigor It be very nice if there was some kind of reference server for connect UDP. Maybe a server that only enable UDP towards a small set of IP/UDP/port numbers, maybe each running a test QUIC site.
I would love testing my own implementation of CONNECT UDP with that.
Adventurous summer trip to Kyrgyzstan, day 7: after passing the glacier we came to endless plateau, 3850 m in elevation. Nothing is here, just grass, muds, small lakes and creeks full of clear water. Not even one person. Just wolves, chamois and birds.
Dobrodružná letní cesta po Kyrgyzstánu, den 7.: po překonání ledovce jsme se dostali do oblasti nekonečných plání ve výšce 3850 m až kamsi k hřebenům na čínské hranici. Není tu nic, žádní lidé ani stopy po nich. Jen vlci, kamzíci a ptáci.
@mailbox_org
Hallo Mailbox.org-Team,
habt ihr an eurem xmpp-server herum geschraubt? In den Gruppenchats auf eurem Server kann ich seit kurzem keine Änderung des letzten Posts mehr vornehmen. Bei Gruppenchats auf anderen Servern geht es noch, daher vermutlich eine Server-Frage? (Nutze Conversations aus dem F-Droid)
Sehr dringlich wäre auch mal ein Update eures Servers! Nach meinen Informationen läuft euer Server seit 2018 ohne Updates auf aktuelle Versionen????
Verdammt, dieser Individualismus ist so nerdig und so Anstrengen. Ich muss wohl zurück zu WhatsApp. 😂
Nein im Ernst: Interessant und cool, dass es dies so gibt. Mal konfigurieren, auch wenn es in meinem Umfeld wohl nie jemand lesen wird.
Ich hoffe, das ist im Konfigurationsbackup für die nächsten Neuinstallationen hinterlegt.
@daniel
Die Bildübertragung scheint es auch erwischt zu haben.
Ich (wir) habe(n) neuerdings TLS-Fehler bei dem Versenden von Fotos. P2P geht noch.
"Read error: ssl=0xb400cdb3bb84f1c8: Failure in SSL library, usually a protocol error
error:1000042e:SSL routines:OPENSSL_internal:TLSV1_ALERT_PROTOCOL_VERSION (/usr/local/google/home/prb/src/boringssl/ssl/tls_record.cc:594 0xb400cde9076a6708:0x00000001)"
Ob das jetzt an der #conversationsapp, ihrem update oder dem #XMPP-server von #mailbox_org liegt, kann ich nicht beurteilen. Da P2P übertragungen noch klappen, Tipps ich auf Server(-Versionskompatibilitäts-)Probleme.
‼️ Svině russácký i svině komunistický jiný nebudou!
---
‼️ Připomínat, připomínat, připomínat!!!
A kdo tyhle kurvy ještě dnes volí, ať si táhne k nim na východ.
🗳️ *Když kampaň, tak kampaň, hajzle.*
#srpen1968
#RussiaIsATerroristState
#ruskojehovno
#KampanHajzle
#volby2025
A hearty "fuck you and the horse you rode in on" to every grifting parasite who sold the idea to grieving parents that this might help one single person in any way.
mastodon.cloud/@slashdot/11497… → slashdot.org/story/25/08/05/22…
Jim Acosta, the former CNN chief White House correspondent who now hosts an independent show on YouTube, has interviewed an AI-generated avatar of Parkland shooting victim Joaquin Oliver.slashdot.org
Just saw someone trip over with a big load of fresh laundry.
I watched everything unfold.
reshared this
Is there a bubble of sewists that use vintage machines?
I've just restored my grandma's old Singer 66 from around 1935 back to function.
I learned sewing as a teenager, then did a bit of it in my early 20ies but mostly gave up after that - my machine was a very cheap one from a discounter and I couldn't really make it cooperate
With my old beauty I just love how meditative treadling is and I can see myself taking up #sewing again
@sewing @fiberarts #vintageSewingMachines
Google's new Pixel 10 series has arrived, and we've got a quick breakdown of everything that's actually new this year.Ben Schoon (9to5Google)
I should add to my poll about forcing users to restart after updating - it is not something we are actively considering working on in the short term. I was mostly just curious as I was surprised at being asked to do something which users would likely see as an inconvenience. If we ever did add it, rest assured it would be optional and possibly only for stable builds.
The poll was really just a straw poll query - and to give you an indication, I don't think there's even a GitHub issue for this
"We wanted to pay our staff (for the ground work), but we needed their consent for that".
An AC executive about the deal.
His nose is so fucking longer than a 777 fuselage.
Following a discussion in the user group, which essentially revolved around "After updating to a new version of NVDA, it should FORCE you to restart the PC", I thought I'd just ask here: SHOULD NVDA force you to restart the PC after updating? (The argument being, that sometimes we see quirky behaviour after updating but before restarting. Currently we simply advise you to restart if you encounter something unexpected).
#NVDA #NVDAsr #Accessibility #Poll #Update #Updates #Question
)
CryptGoat
in reply to Daniel Gultsch • • •Benjamin
in reply to Daniel Gultsch • • •tarakiyee
in reply to Daniel Gultsch • • •Сейд ✅
in reply to Daniel Gultsch • • •Замечательно, спасибо, Даниэль! Можешь ли ты настроить так, чтобы Conversations и Quicksy по умолчанию активировали привязку канала?
И ещё один вопрос: в какой версии Conversations появится возможность выбирать только TLS 1.3, как на скриншоте?
mistersixt
Unknown parent • • •rakoo
in reply to Daniel Gultsch • • •Let's consider how deltachat, in its default mode of operations, works.
What is the purpose of Channel Binding ? It seems to me to be mitm-resistance, but considering that in deltachat, contrary to Conversations, the user doesn't even know their password I don't see how they're going to be phished on a scam website. The only way to connect from another client is starting from an already legit one that will consciously share credentials. The app, like conversations, doesn't make typos when calling the server, so if mitm didn't happen through mistyping the address it happens behind TLS, so it's the same for Conversations.
What happens in the case of a mitm ? In deltachat chats are not mitm-able: the only thing a mitm box will see is gpg-encrypted emails. Recall that in its default setting email addresses are pseudonymous (i.e they have no human meaning and it is expected that one person will use many addresses) so what a mitm will see is that some random address sent some other random address something, and the date. The real mitm that can have an impact is one that can intercept the qr code, or the link it contains, out of band. Nothing can be intercepted in-band. Note that this is true even in the non-default way of using deltachat, with your own account on another server, as long as you use deltachat.
In Conversations, because the server is important, they will be able to do everything the user can do: see/set presence, change omemo keys, publish/subscribe, read and send unencrypted stanzas. The only thing they won't be able to do is to read the content of encrypted content, but they will still see who sent it in which room.
Deltachat massively downgraded the importance of server to the point they are just relays of content. It is parting ways with the 80's and 90's era of a server capable of doing everything and clients only ordering them to; xmpp hasn't. The result of a mitm is catastrophic in that mindset, but for a more p2p app it's more of an inconvenience.
So, no, deltachat doesn't implement channel binding, but contrary to others including Conversations deltachat actually doesn't need to. So that's ok.
It's a bit disingenuous to talk down on other libre and decentralized messengers, especially when xmpp in its current design and deployment is arguably worse on the security aspect, not talking about the metadata aspect that the xmpp world still hasn't heard of somehow. They are not the enemy, Whatsapp and Messenger are. (note: this is also valid for delta fans)
(I might have made some mistakes, feel free to tell me)
@matrix @delta
adb
in reply to rakoo • • •@rakoo they can still collect the messages tho, then seize your device and with the private key they can then decrypt all messages, even with this new feature of XMPP this is still true if the VPS provider gives access to the server to your enemy, the more secure way out of this attack vector is forward secrecy, with what @daniel announced you should avoid the problem if the VPS is out of the jurisdiction of your enemy tho
@delta @matrix
rakoo
in reply to adb • • •Daniel Gultsch
Unknown parent • • •rakoo
Unknown parent • • •yes, you can verify keys, but that's just it: only keys are verified. Everything else can't, and there are many things not protected by e2ee.
I don't understand the part about YOLOing the transport though, or is that another subject ?
@delta @matrix
adb
in reply to Daniel Gultsch • • •mistersixt
Unknown parent • • •Fox Trenton 🎱
in reply to Daniel Gultsch • • •I've got two XMPP accounts, one at Conversations the other on another server.
If I activate it, do you know it it will just be ignored or "break" something when it comes to the other server.
PS. Thanks for a great app! Been using XMPP since early Jabber days, Conversations is my favourite client for it.
Fox Trenton 🎱
Unknown parent • • •(Not great that it breaks, but great that it is immediately noticeable. 😁 )
Guus der Kinderen
in reply to Daniel Gultsch • • •chipiguay - Pablo 😴
in reply to Daniel Gultsch • • •Neustradamus :xmpp: :linux:
in reply to Daniel Gultsch • • •State of Play
Neustradamus (GitHub)