20 Odysseus is tied to the malus (mast) to listen to the carmen Sirenis (the Siren's song) without jumping overboard. His nauta (sailor) has aures obturatas (plugged ears) to stay safe from periculum (danger). The Siren frustra cantat (sings in vain)! #ClassicsTober23 #MinimusLatin
that uBlock Origin post about how to bypass YouTube's adblocker nags has been making the rounds, but it isn't the clearest in terms of steps, so here's a quick PSA:
1. click the uBO shield icon 2. click the settings button (gears) 3. go to the "Filter lists" tab 4. click "Purge all caches" 5. click "Update now" 6. now refresh the YouTube page.
every time I've seen one of the nag popups, this has instantly fixed the problem.
I've talked to quite a few vendors over the years about concerns in open sourcing their existing closed source update code to make it possible to build a fwupd plugin. Rather than repeat myself over and over, I've written just over a page of justification on why it's not really an issue. Does anyone have any comments or other suggestions? Thanks
(This would be a new section in https://lvfs.readthedocs.io/en/latest/custom-plugin.html just before “Depending on a new library”) – this is also in rst format, not MarkDown.
For those of us receiving email in multiple languages, it would be awesome to have #Firefox Translate built in to Thunderbird. No sending your sensitive conversations to a corporate cloud, just a lean translation service running locally.
We've decided to make it a development priority for Q1 2024!
@uhuru Speaking as a community manager who frequently receives questions about Thunderbird via email in Dutch, German, Spanish, and French, it seems like a useful feature to me 😉
Thats an edge-case feature. So make it an Add-On! Much more usefull would be AutoCrypt by default and Key-Checks/-Sharing via known shared contacts. #PrivacyFirst
LG, a name synonymous with innovation and bold design in the smartphone industry, has left an indelible mark on the world of mobile technology. In April 2021, LG Electronics officially announced its exit from the smartphone market, leaving many fans and tech enthusiasts with a sense of nostalgia. What we miss from LG phones today accessibleandroid.com/what-we-… #Android #LG
This document is a practical guide for developers on how to add
accessibility information to HTML elements using the
Accessible Rich Internet Applications specification [WAI-ARIA-1.
Telling the screen reader everything what happens inside a GTK app is certainly nice, but sometimes it is too much. So, now thinking how to allow accessible property updates without the corresponding notification for rare circumstances. And I am afraid, that I will not manage it without increasing the accessibility layer API surface... Just so you know I am thinking about right now.
I'd just like to interject for a moment. What you're referring to as Laugh, is in fact, GNU/Laugh, or as I've recently taken to calling it, GNU plus Laugh…
We notice that the Mastodon icon is being used on your site, yes? Have you considered a Fediverse icon instead? Using a M'don icon misrepresents wider fediverse as M'don (now with previously rejected #darkPatterns). It misleads and invariably marginalises worthy instances that aren't M'don.
The following was developed in collaboration with great fedizens who felt a more sensible icon for fediverse was needed (campaign.openworlds.info/@dsfg…)
@riana but this doesn't mean folks should let up on tearing apart this awful bill.
Everyone agrees CSAM is fucking awful, but treating everyone as guilty until found innocent by scanning their devices ain't the way to police this, especially if that breaks encryption & the right to privacy
Mastodon Rules: Characterizing Formal Rules on Popular Mastodon Instances is a recently published research article that compares and characterises the rules of the most popular Mastodon servers. The researchers find that “Rules on Mastodon often pay particular attention to issues of harassment and hate — strongly reflecting the spirit of the Mastodon Covenant. We speculate that these rules may have emerged in response to problems of other platforms, and reflect a lack of support for instance maintainers.”
The report compares the rules on Mastodon servers to those on subreddits, and comes up with some interesting findings: “[R]ules about Hate Speech, Harassment, and Doxxing/Personal Info are far more common on Mastodon, while rules about Consequences/Moderation/Enforcement, Behavior/Content/Format Allowed, and Links & Outside Content are much less common. This contrast may suggest that these spaces have different values and purposes.” and “rules on Mastodon often explicitly engage with systemic oppression across many different intersectional identities beyond what is required by the Mastodon Covenant.”
And finally, this line in the report is a good indication of why I want to spend my time on the fediverse: “Mastodon instances seem to have more of an orientation towards justice”.
Mastodon Rules: Characterizing Formal Rules on Popular Mastodon Instances is a recently published research article that compares and characterises the rules of the most popular Mastodon servers.
Společnost dále hodlá nabídnout i levnější prémiové předplatné s plným objemem reklamy. Platforma X na reklamě vydělává asi polovinu méně, než kolik Twitter předtím, než ho Musk koupil.
@fabia_man Jo, taky zírám, když do toho občas nahlédnu. Nejhorší zjištění je, že jsem v tom roky byl a považoval to za normální. Naštěstí už tu máme honeypot na tyhle lidi (Bluesky), takže když Twitter řachne, nebudou svá zbytnělá ega přesouvat sem.
Jsem rád za tento kompromis, ale nemám z něj radost. Namísto plnohodnotného, jednoduchého a pro mnohé i odvážného řešení volíme jakési polovičaté, zmatene řešení, Které stále vytváří občany druhé kategorie.
Příznačné je, že podobnou metodu volíme U spousty jiných často méně konfliktních věcí. takový ten "pokrok ale jenom mírný a v mezích zákona". To není pokrok.
Znám plno lidí pro které je stejné pojmenování neprůchozí. Nedokážou mi vyargumentovat proč, ale prostě to tak mají. Není to ideální ale je to lepší než současný stav. 🤷
@stepan Může za to Orwell, který mi vštípil fobii z pozměňování významu slov Velkým Bratrem. Válka je mír. Svoboda je otroctví. Partnerství je manželství.
In 2013 I wrote a short (Chinese) article on the Israeli-Palestinian conflict that talked about misinformation, anger, and the power of potent symbols. It was one of my very first articles that were published in a newspaper.
In 2023 I’m seeing all the same things happening again, and I’m seeing people saying the exact same things I’ve said ten years ago.
En elDiario.es queremos incorporar a nuestro equipo de Datos a un periodista con experiencia en buscar noticias e historias periodísticas de impacto en bases de datos y con interés por contarlo de la manera más clara y atractiva a los lectores.
Busco #trabajo por cuenta ajena en A Coruña, ya sea presencial o virtual.
Si fuese posible, me gustaría encontrar algo donde pueda usar lo que mejor sé hacer y en lo que he invertido tanto durante estos últimos 20 años: #comunicación e #idiomas.
Si sabéis de algo, ¿podríais recomendarme o comentármelo en privado, por favor?
Mi correo electrónico es antoni@themedicalcommunicator.com.
➡️ Busco trabajo por cuenta ajena en A Coruña (Galicia).
Antes de la pandemia, ganaba por cuenta propia lo suficiente como para mantenerme a mí y a mi marido…
wow. were the mineral water bottles at the beginning filled with.. water or.. palinka? (lived this once in Craiova - smaller meeting, just 20-30 people.. "have some water! -with this inner smile trying to refrain itself- it was palinka..
When you're a project as big as curl sometimes you get some weird bug report and recently Daniel Stenberg got a completely AI generated made up report, pleas...
EXCLUSIVA | Las órdenes internas de Vox: “Regularizad el dinero que tengáis por merchandising, en ingresos inferiores a 299 euros”
🔹 Accedemos a circulares de la tesorería para el efectivo obtenido con ventas de lotería, bolígrafos o pines, de los que no ha presentado facturas ni inventario al Tribunal de Cuentas
🔹En uno de los documentos del partido en Valencia se dan instrucciones para ingresar “beneficios por donaciones anónimas”, prohibido por la ley de financiación eldiario.es/politica/ordenes-i…
El 27 de mayo de 2019, el departamento de tesorería de Vox envió un correo electrónico con instrucciones precisas a sus departamentos de contabilidad y la palabra “URGENTE” en el asunto.
Oakland trans woman had to remain closeted for years to get work in taquerias. She managed to get gender affirming care, and then realized her dream and bought a taco truck. She opened two months ago. Now, her taco truck has been stolen, and apparently her insurance company won't cover the loss. If you have a few bucks to share to help a trans woman of color recover her business after this devastating loss, click this link to the GoFundMe her friend set up for her. gofundme.com/f/miss-chiles-eny…
Sadly today our dear "Our dear wonderful, natural chef of Chiles and guisados, Enya San… Patricia Grant needs your support for Miss Chiles, Enya Sandoval
Tl'dr I'm looking for work again. Contact me if you're looking for a senior software engineer with more than 2 decades of open source and systems programming experience for a Rust role: github.com/zeenix/
I joined Mercedes-Benz last year as a contractor in the hope that they will be able to offer me a permanent position before my 1 year contract expires. Now we're approaching end of the year but they will unfortunately not be able to do so.
They did offer to renew my contract for another year and would like very much for me to continue my work but since they can only renew my contract once and it looks extremely unlikely they'll be able to offer me a position in 2024 either, I will be in this position again next year so there isn't much point in renewing the contract.
Venezuelan bond prices soar after US lifts trading ban
> Venezuelan government bond prices soared on Thursday after the US government eased sanctions that had barred American investors from trading them, handing immediate large gains to some hedge funds. The price of #Venezuela’s sovereign dollar bond maturing in 2027 jumped more than 70 per cent to 19 cents on the dollar, according to Bloomberg data. archive.is/2023.10.19-145149/f… #US #Economy
I believe that Youtube's warnings about adblockers are the beginning of the end for Youtube as a citizen of the Open Web, and the latest volley in the fight that will end with the death of youtube-dl, invidious, etc.
This road leads to DRM powered by EME, and that would be the fulfillment of the promise made by EME when it was launched.
I'm taking advantage of the fact that youtube has recently started rebuking people for using an adblocker to launch this thing I've been working on for a while.
I'm offering shared peertube hosting. $15/year for 10GB of storage. Larger packages available.
Big beefy server, lots of juice.
No live streams at this time. All content held for moderation until I know I can trust you.
@matt The image is a screen shot of an old computer game showing 10 options of screen resolutions (varying from 320x280 to 1024x768) and number of colors (2, 16, 256, B/W)
Da igual, porque la Orden PCM/313/2023 establece que el máximo de base de cotización está sobre los 4500 o así, que es menos de lo que habría que cobrar.
“There’s no surefire way to detect either malicious Google ads or punycode-encoded URLs. Posting https://ķeepass.info into all five major browsers leads to the imposter site.”
Ah, yes. But, using Privacy Browser Android, the true punycode URL of xn--eepass-vbb.info/ is revealed.
@lanodan I think it has a lot more to do with the GUI code than the rendering engine code. In my testing, Chrome and Firefox for Android do not display the correct URL. Lightning behaves correctly the same as Privacy Browser Android. FOSS Browser and Fulguris (a fork of Lightning) change the URL, but they cover it up with the website title, so you can't see it unless you tap to edit it.
@lanodan “This function provides protection against IDN homograph attacks, so **in some cases** the host part of the returned URI may be in Punycode if the safety check fails.”
Do you know which are the cases where it displays the punycode and which are the cases where it doesn’t?
Been a while since I checked the source code of it but if I remember correctly: It displays human-readable punycode/percent-encoded characters, unless there is known homographic characters (which are probably identified via ICU).
It's not great (like an hostname entirely in greek/cyrillic ought to be human-readable), but I would say it's safe enough.
The only real way to be safe anyway is by using bookmarks and an integration of password managers which matches on the hostname (because you don't always remember the exact spellings of websites).
While I'm at it: Consider using a font like monospace for URLs.
@lanodan I have to disagree with you on the password manager. Everyone should use an offline password manager that does not sync to some cloud service, but for security and privacy reasons, nobody should use a password manager that integrates with their web browser.
You never want something that is processing untrusted data inputs (a web browser) having any connection path to the data store that holds your passwords.
1. Length is far more important for entropy than characters that are hard to remember or type. Think xkcd.com/936/
2. Choose passwords that are unique and that you can easily remember. For example, if you think Microsoft or Google or Apple is the great evil, then your password for that site might be the following, including the spaces and punctuation.
@lanodan 3. Put that password in your password manager. If you use the site frequently, you will not need to reference the password manager frequently. But, if for some reason you forget, you can open the password manager and remind yourself.
4. Because you can type this password easily, you don't need to use copy/paste (which can be compromised) or an integration with the browser (which can be compromised) to input it. You can just type it.
> If you use the site frequently, you will not need to reference the password manager frequently.
You're joking here, right? That's based on keeping things like cookies/object-storage/… all the time, aka tracking. While depending on a password manager instead means you actively control what is stored on your machine.
@lanodan Just to be clear here, the reason why you will not need to reference your password manager frequently for sites you visit often is because the password is easy for you to remember and you type it every time you go there (because you have programmed every single browser you use to always delete cookies).
@lanodan I definitely agree with you there. I didn’t bring it up because I assumed you were advocating for a password manager that syncs to some cloud service, but because many other people do, so I felt it needed to be mentioned for completeness of the discussion.
How? Because the only real way of being sure the hostname matches is to be able to check for a match, and a computer is ridiculously good at this while a human will fail (dyslexia is a thing you know).
I don't mean a requirement on auto-filling information by the way, those ought to not exist due to things like JavaScript and hidden forms.
@lanodan If you are typing a password into a website, it better be because you typed the URL or loaded it from your own bookmark.
If you go back to the original article, it was about someone downloading a compromised version of KeePass from an invalid website (ironic in the context of a discussion of password managers). KeePass is what I use myself, but I don't tend to find their website through a Google ad before initiating the download.
@lanodan 😂 We are just going to have to agree to disagree. Personally, any programmatic integration of a password manager into the web browser is a much more likely vector of attack and one that I am unable to recommend to anyone.
Would just say there's one that's a widespread vector of attack (typosquatting) which has been effective and used for decades, and not really fixable unless you're using other methods. While password manager integration is rarely if ever something that gets compromised (specially given good password managers where you need user interaction and/or explicit consent for querying data).
@lanodan So, use bookmarks to access sites where you already have accounts and type the URL yourself for new sites where you want to create accounts. None of that needs password manager integration and all the potential security and privacy pitfalls that entails.
@lanodan How exactly would you recommend going to a new website, creating an account, and typing in the password without some version of typing the URL for the website where you want to create an account? I fail to see how any password manager is going to do this for you.
@lanodan Thinking more deeply about this, even though I often type URLs directly into a browser or use a bookmark, I don’t exclusively do so when visiting websites that require passwords. For example, sometimes I do a search for a website and load it from the organic results there. Or sometimes I click on a link from some other source. So, I retract my previous statement.
@lanodan I do, however, often look at URLs, which is good internet hygiene and why I made a statement in another part of this thread that it is not good when browsers try to hide or simplify any part of a URL.
I checked on android Cromite, Vivaldi snap and Kiwi - all three display punycode without masking, correctly. All three can connect custom phishing blocking lists. Sure, they're not the most common browsers - but PB isn't unique after all.
@i_understand There are some advantages and disadvantages to hardware passkeys. In general, I would only recommend one as a secondary form of authentication. Similar to 2FA OTP codes. I don’t think I could recommend one as a solitary form of authentication.
What happens if the passkey is lost or stolen? How do you recover your logins? If you are using biometric access, which is fairly easy to spoof, how do you prevent a thief from accessing your data?
@i_understand You get all of those benefits by using it as a 2FA. All I see is risks if you use it as a solitary authentication. I know that organizations like Google are all in on hardware passkeys replacing passwords. But I wouldn't trust them anymore than using a 2FA OTP as a solitary authentication.
@i_understand I would consider neither hardware passkeys or OTP to be secure enough to use as my primary or solitary authentication for anything. Either is fine as a secondary authentication, although I have a hard time being sure that hardware passkeys are more secure than OTP because I can audit all the code on my open source OTP implementation, but I can’t audit all the things the closed source hardware in the passkey is doing.
That is a point I often make to people. I might know exactly what the software on my devices is telling the hardware to do, but I don't know if my hardware is secretly programmed to do something different.
We don't currently have any open hardware general computing platforms. They are now where open software was thirty years ago. But thirty years from now, I expect that open hardware will dominate the computing landscape, for both security and privacy reasons.
@i_understand I can accept the argument that a hardware passkey implemented on open hardware is more secure than a OTP. So, it is a good 2FA.
But nothing that can be stolen, lost, broken, or in other ways removed from yourself so that you no longer have it could ever qualify as a primary means of authentication in my mind. In other words, your primary authentication should never be “something that you have”. It must always be “something that you know”.
@i_understand When you pair “something that you know” like a password with “something that you have” like a OTP or an PGP key or an SSL certificate or a hardware passkey (which is basically just a OTP or PGP key or an SSL certificate stored in some type of trusted computing environment), then you can be assured of a fairly high level of authentication security while also having data access redundancy.
In my personal case I use an encrypted KeePass database of passwords (which I don’t often need to access for reasons explained in another thread on this discussion). I also use andOTP. The database for KeePass is automatically synced to a personal Nextcloud instance running on hardware I own located on a premise I control. The andOTP seeds are exported in encrypted form to the same instance whenever there is a new addition.
@i_understand The Nextcloud instance automatically syncs to four different hard drives on four separate systems and also gets backed up onto two encrypted hard drives that rotate into cold storage.
This provides three things.
1. Easy access from all my devices I trust wherever they are in the world.
2. A high degree of security.
3. High redundancy. It is unlikely if even three of my devices were all destroyed at once that I would lose access to all my passwords and keys.
@i_understand Note that my PGP keys (used for authentication with Debian and encrypting email), as well as my Android Keystores (used for signing apps) are not synced to the Nextcloud instance because of their sensitivity. But they are replicated across multiple hard drives.
@i_understand The second link is what started this whole discussion. 😇
The first link has already been fixed, is insanely difficult to exploit, and even then often wouldn’t apply to my workflow because I rarely open KeePass and never leave it running in the background (again, see the description about how to choose long, secure, easily typeable, easily rememberable passwords that mitigate the need to frequently open a password manager).
@i_understand But along those lines, consider all the times that trusted computing environments, like TPM, Secure Enclave, Android's Keystore, Intel ME etc. have been compromised and convinced to give up their secrets.
Secure hardware environments have a horrible track record of not being secure. Much worse of a track record than KeePass.
@i_understand Like I mentioned in the previous post, given the number of documented vulnerabilities in trusted computing platforms, like Intel’s ME, TPM, Apple's Secure Enclave, Google’s Android Keystore, which are all functionally similar to hardware passkeys, I would say it is fairly well documented that if someone steals your passkey, it is only a matter of time until they can exfiltrate data from it.
@i_understand Something might be said about this being slightly more difficult than cracking an encrypted file. But the fact that your hardware passkey can also be lost or broken, which is almost guaranteed to happen at least once during your lifetime, makes it a non-option in my mind for a primary means of authentication.
Note that for security and privacy reasons, Privacy Browser will never allow a direct connection to a hardware passkey. Nothing that renders untrusted web content should ever have APIs to interface with hardware that directly.
But you could, for example, use a hardware passkey to unlock a standalone password manager, something like PassKey, for the few times you need it, instead of using a passphrase or a PGP key to do so.
@i_understand Having a hardware passkey talk directly to the internet through the browser is exactly the type of security dystopia that Google is currently pushing on the world.
I have been building software with "make" for *mumble* decades and I just found --output-sync=line to keep parallel make output from producing interlaced lines. Why is this not the default option when building in parallel? Do other CI systems already know about this? gnu.org/software/make/manual/h…
SuspiciousDuck
in reply to SuspiciousDuck • • •