Los hay que la vergüenza no la conocen. 7 años para cumplir la promesa de accesibilidad de la web y lo que queda pero hoy sueltan esta nota de prensa:

Renfe celebra la Semana de la Accesibilidad, coincidiendo con el Día Internacional de las Personas con Discapacidad, 3 de diciembre. A lo largo de la semana, la compañía llevará a cabo acciones para la toma de conciencia y compromiso con la accesibilidad.
renfe.com/es/es/grupo-renfe/co…

The day is almost here. Google will start deleting inactive Gmail and Google Photos accounts that haven’t been accessed within 2 years this week (December 1st).

This is a final reminder that if you have a Gmail or Google Photos account that you haven’t used in a while, log in to ensure it doesn’t get deleted.

forbes.com/sites/jaymcgregor/2…

I když je nyní mimosezónní období, tak si nelze nevšimnout následků overturismu v Nizozemí. V centru se přes davy turistů téměř nedá hnout, vlaky jezdí nacpané téměř k prasknutí. Odpoledne po třetí hodině výrazně klesá šance, že seženete místo na sezení v coffeeshopu. Na některé atrakce jsou vyprodané lístky předem. I tak se tam budu i nadále rád vracet, pokud to tam Wilders nezničí, ale budu určitě vybírat spíše jarní nebo letní termíny. Podzim/zima bývá moc chladno a deštivo.

☝️🤓 gdb can be attached to a process and used to poke its memory, print variables, etc. without altering its execution in any way*.

this is done by combining two (actually three) things:

  • non-stop mode stops only the currently selected thread
  • observer mode (which enables non-stop mode) prevents the backend from touching the inferior's memory, registers, etc.
  • background execution (continue &) allows the frontend to issue commands while the selected thread is running

you'd do something like this:

sudo gdb -iex 'set observer on' -p $PID -ex 'c&'<br>

(*) if the process makes use of signals or weird stuff then you may need some additional setup.

#AndroidAppRain at apt.izzysoft.de/fdroid today with 14 updated and 1 added apps:

* EasySync: sync your device with your WebDAV server (e.g. Nextcloud)

At F-droid, 46 apps were updated.

Plus 2 modules at apt.izzysoft.de/magisk

Enjoy your #free #Android #apps with #FDroid and the #IzzySoftRepo :awesome:

Wir wollen das Thema #Digitalzwang im nächsten Jahr auf die politische Agenda bringen. Und dabei denken wir groß.
Wir finden, das Grundgesetz braucht ein Update: Schutz vor Digitalzwang und ein Recht auf ein analoges Leben. Es geht um ein solidarisches Recht, einen digitalen Dienst nicht zu nutzen – aus welchen Gründen auch immer. Dazu wollen wir in einem ersten Schritt ein Rechtsgutachten einholen, das klärt, wie und mit welcher Definition das neue Grundrecht in die Verfassung aufgenommen werden kann. Wir haben schon eine Reihe Ideen, aber um sie umsetzen zu können, brauchen wir deine Hilfe: digitalcourage.de/spenden
This entry was edited (2 years ago)

reshared this

If you're like us, you want to be organized but...life happens. But if you want to start the week getting a handle on your virtual clutter, we've found an awesome organization workshop that uses open source and privacy respecting tools! Give it a try - or let us know the organization tips and tricks that work for you.

klemet.github.io/Workshop-Orga…

#Thunderbird #OpenSource #Organization

Jirka dělá skvělou práci. Díky tomuhle videu člověk aspoň vidí, že v případě podvodů na síti se policie snaží skutečně něco dělat. 👍
invidious.cz/watch?v=7UAAG817N…

307 sticker packs already awarded in November! But there's still time to get yours. Just post with the hashtag #LibreOffice about how much you love the suite, and you can claim your stickers in a few days 😊 blog.documentfoundation.org/bl… #foss #OpenSource

I'm not a fan of this new versioning system #libreoffice is moving to. It makes me feel like they will do releases even if they aren't quite ready just to hit their dates. Hopefully it works out because I definitely love LibreOffice and I hope they stick around forever!

phoronix.com/news/LibreOffice-…

Have you ever wondered how South Africa is different to what you might consider normal as a foreigner?
Let me know what you find the most shocking. I'm also always happy to answer questions if they're respectful.

youtube.com/watch?v=AIe7vJeoLy…

in reply to miki

@miki This is interesting, because I think the Western association between Christmas and those motifs is so so strong, that it doesn't really occur to us to do it differently. I have never seen a real Christmas tree for example. They're all fake. But I'm not sure if that's just an American thing.

There are a lot of summer adverts that target Christmas at the same time, but as someone who has only ever had this experience, and who doesn't really know anything else, I'm not super convinced we have such a different experience overall.

That said, we do have some (Afrikaans to my knowledge exclusively) songs about summer Christmases, which is interesting.

@miki
in reply to miki

@miki @elliewallwork Oh yeah, that's solid Christmas stuff right there. Swimming, icecream, eating outside among the flies and the heat, yeah. Very Christmas. /s

I get that people enjoy summer. I don't understand, but people will be people and I suppose some are just vaguely silly... But I would give so much to be able to spend a happy Christmas somewhere where it's cold.

A11yTalks tomorrow!!
Have you ever wondered how the A11yTalks team, month after month, delivers #accessible online events?

Tune into: Behind the Stream - How A11yTalks Creates Accessible Virtual Events
November 28th, 12PM (ET)
youtube.com/live/Z06Kqj2TI9o

Gergely Orosz has uncovered a tech conference organizer that regularly lists non-existent female speakers on its agenda.

The DevTernity conference occurring on December 7th & 8th lists a female Coinbase engineer and a WhatsApp engineer who are completely made up.

Similar fake profiles have been discovered on the speaker roster for JDKon, a Java conference by the same organization.

This is a new low.

There are too many talented female engineers to pull this crap. 🤬

linkedin.com/posts/gergelyoros…

This entry was edited (2 years ago)

Implications of access by the user www-data to all friendica folders


@Friendica Support

Hi there,
the friendica helpers page describes the installation process of friendica as follows:

/help/Install: wrote:

The Linux commands to clone the repository into a directory "mywebsite" would be
git clone https://github.com/friendica/friendica.git -b stable mywebsite
cd mywebsite

bin/composer.phar install --no-dev

Make sure the folder view/smarty3 exists and is writable by the webserver user, in this case www-data

mkdir -p view/smarty3
chown www-data:www-data view/smarty3
chmod 775 view/smarty3

Get the addons by going into your website folder.

cd mywebsite

Clone the addon repository (separately):

git clone https://github.com/friendica/friendica-addons.git -b stable addon


askubuntu.com: wrote:

What is the www-data user?
askubuntu.com/questions/873839…
The web server has to be run under a specific user. That user must exist.

If it were run under root, then all the files would have to be accessible by root and the user would need to be root to access the files. With root being the owner, a compromised web server would have access to your entire system. By specifying a specific ID a compromised web server would only have full access to its files and not the entire server.

I guess this observation goes both ways, a compromised friendica instalation get's access to all the friendica folders if I choose to first create/activate the www-data user, than create the friendica installation folder structure, than git clone friendica, than create the smarty3 folder and ultimately do the git clone of the addon folder as described here:
tupambae.org/display/0ac89072-…
The order in which the creation of www-data related folders in the above case is described makes all folders and files in the friendica directory belong to www-data.
In the friendica help description first comes the git-clone, than the the smarty3 folder part than the addon git-clone. Actually I guess that last part would make the addon folder belong to www-data too if I run one command after another. Is that intended?

I wonder if this could have some kind of security implications.
I guess www-data is somehow the friendica site and has permissions to do "what ever it wants" (-> "writable by the webserver user") with all the folders in the friendica directories if it's the owner of them.


@TupambAdmin [stable]

in reply to utopiArte

@utopiArte For a Friendica node to work properly, the web server user (here www-data) needs to have read access to the whole Friendica folder structure and write access to a few important places, including the smarty3 cache folder. The simplest way to achieve this is to grant ownership to the whole Friendica file tree to www-data.

The security implication is that if someone ever gains unauthorized access to www-data, they can indeed do "whatever they want" with your Friendica install, including deleting files, adding malware to Friendica pages, access the whole Friendica database including the user list, the private post and messages.

And if you host multiple websites on the same server, they can also access and tamper with those if their file trees are owned by the same user.

It's a big "if" though, as on Debian-based distribution like Ubuntu, the www-data user doesn't have shell access, meaning that you can't open a remote shell using this user. Any unauthorized access has to go through the actual hosted applications. For example WordPress is a popular unauthorized access vector for malicious actors because it's so popular and people don't always update their software timely.

I don't think Friendica is very secure, but it is a low-profile target and we do act quickly when we receive security reports, even releasing hot fix versions when the scheduled release date is a little to far.

You can make your install marginally more secure by only giving access to the file tree through group permissions and only giving read/traverse rights by default, granting write rights only for the specific locations that need it. This way, in case of a malicious access, it will prevent attackers from inserting malicious code in your Friendica node pages, but that's about it.

in reply to Hypolite Petovan

> granting write rights only for the specific locations that need it

What folders would that be?

What I have seen so far that would be:
/storage
/view/smarty3
and
/config
but only while installing local.config.php

Something I don't understand is why I do have a few folders in:
/view/smarty/compiled
that belong to the user root.
How is that possible?
How can friendica create folders as and/or for root?

What should I expect to happen if I just delete those folders, or even delete the complete /compiled folder. I guess friendica would start from there to create the folder compiled and subfolders as needed?

I ask because there are those subdirectories belonging strangely to root and one of my issues is that when I switch to the theme FRIO I have no access anymore to the settings of that respective profile, not even to change back to VIER. That renders that profile nearly useless and I'm trying to get around that problem.

in reply to utopiArte

@utopiArte That's a good list of exceptions.

Regarding the root-owned folders, it would prevent www-data from reading the cached template files and subsequently display the pages that uses the specific templates in this folder.

You should restore recursive www-data ownership to this or these folders. Please let me know if you need an example of a command line to do so.

in reply to utopiArte

result:

What I don't get is where these ownership settings came from.
They were not even from a specific day or had anything specific in common:
tupambae.org/display/0ac89072-…


Just checked all the 13 of 220 folders that were created as belonging to user and group root and that I consider shouldn't exist as owned by root i the folder /smarty3.

In general terms speaking I couldn't find a common property.

They refer to posts or replies by three different users.

Most refer to one specific post.

Two create a page:
Not Found
The requested item doesn't exist or has been deleted.
Request: XYZ

All were created with the theme VIER.


in reply to Shiri Bailem

Even tho there have been some trouble while setting up this installation what calls my attention ist that those folders had kinda random different dates of creation:

drwxr-xr-x 3 root root 4096 Nov 12 04:35 00
drwxr-xr-x 4 root root 4096 Nov 16 02:10 30
drwxr-xr-x 3 root root 4096 Nov 17 19:35 3e
drwxr-xr-x 3 root root 4096 Nov 11 01:57 49
drwxr-xr-x 3 root root 4096 Nov 16 22:25 4e
drwxr-xr-x 3 root root 4096 Nov 11 01:55 59
drwxr-xr-x 3 root root 4096 Nov 14 11:10 90
drwxr-xr-x 3 root root 4096 Nov 21 22:50 a3
drwxr-xr-x 3 root root 4096 Nov 23 00:45 a4
drwxr-xr-x 4 root root 4096 Nov 23 19:15 ae
drwxr-xr-x 3 root root 4096 Nov 23 20:35 b4
drwxr-xr-x 3 root root 4096 Nov 16 00:53 bf
drwxr-xr-x 3 root root 4096 Nov 14 11:10 e2
in reply to Shiri Bailem

That's what astonishes me.

My access is only via console SSH to the VPS and that shouldn't create any kind of cross implications with the firefox webbrowser that accesses the friendica installation.

Also apparently the installation itself was created the 8th of November, the first folder apparently the 11th of November so there was no relation to that.

If friendica is able to create a folder and files as root that's kinda scary isn't it?

in reply to Hypolite Petovan

> That's a good list of exceptions.

In theory I could there for run the following commands to set all folders except /storage and /view/smarty3 to root:

set ownership of everything recursively to root:
rootname@VPShosting:/var/www/# chown -R root:root html

set ownership of storage and smarty3 recursively to www-data:
rootname@VPShosting:/var/www/html/# chown -R www-data:www-data storage
rootname@VPShosting:/var/www/html/view/# chown -R www-data:www-data smarty3

The change of ownership wouldn't affect the specific read/write permissions of files and folders and www-data would have only access to the folders needed.

right?

in reply to Hypolite Petovan

I ended up doing the following:

First I created a backup folder of the existing html folder and subdirectories:

root@VPShosting:/var/www# cp -r html html_01.bak

By default that created a copy with all files and folders owned by root.

Than I changed the ownership of storage and smarty3 to www-data:

root@VPShosting:/var/www/html_01.bak# chown -R www-data:www-data storage

Screen of the new user and group owner ship setting of the /html folder

root@VPShosting:/var/www/html_01.bak/view# chown -R www-data:www-data smarty3

Screen of the new user and group owner ship setting of the /view folder

Once everything looked "fine" I moved the existing html folder to a new name.

root@VPShosting:/var/www# mv html html_www-data_old

By moving [mv] instead of copying [cp] the ownership of files and folders aren't affected. Than I moved the copy with the new ownership settings into place:

root@VPShosting:/var/www# mv html_01.bak html

Well see how this setup behaves.
In any case I'll have the old version at hand to change to it if necessary.

in reply to utopiArte

@utopiArte security implications are minor, mostly because they can only edit the thing they've already hacked into.

But if that's a particular concern, you should be able to make the entire directory read-only as I don't believe friendica edits any of those files after initial setup (since all the edits are in database, or a separate storage folder if you're using the folder storage backend)

The writable in your quoted instructions is for the setup process while logged in under that user, so of course it'll need write to be able to download files and install them in the webserver directory. But there's no indication that it's needing write past that.

@Friendica Support

I just tried to display /.well-known/host-meta as described in:

/help/Install wrote:

Verify the "host-meta" page is working
Friendica should respond automatically to important addresses under the /.well-known/ rewrite path. One critical URL would look like, for example: example.com/.well-known/host-m…
It must be visible to the public and must respond with an XML file that is automatically customized to your site.

Instead of displaying the xml file my browser (firefox) just downloaded it.
I'm used to get this page displayed.

Any idea what this could be?

The page /.well-known/ itself is "not found".

Inspecting websites and web views on iOS devices yatil.net/blog/inspect-web-ios by Eric Eggert #ios #webdev #dev #tips

LinuxUnplugged just released their latest episode featuring Wim Taymans talking about PipeWire 1.0, be sure to check it out.
linuxunplugged.com/538 #linux #linuxunplugged #pipewire

Fedora Magazine got an interview up of Wim Taymans about the PipeWire 1.0 release and plans going forward.
fedoramagazine.org/pipewire-1-…

#linux #pipewire #fedora #audio

in reply to PipeWire Project

"There is a GSOC project to implement video conversion filters using Vulkan, which would make it possible to link and process video streams in more cases."

Anybody knows, which project this is?

I am working on something, which sounds very similar. My idea is a form of a video mixer combined with a patchbay using Vulkan render pipelines.
gitlab.freedesktop.org/AdeptVe…

Would be interesting to see their approach.

Google Chrome will make it much harder for ad blockers. 😤

This is the final drop, it needed to make everyone switch to a more private solution! 🥳🔒

Check our recommendations! 👇
tuta.com/blog/best-private-bro…

#privacy #encryption #chrome #google #deGoogle #browsers

Feijóo ataca a Sánchez por anunciar que España reconocerá a Palestina pese a que el PP lo llevaba en su programa
eldiario.es/politica/feijoo-at…

Open Letter regarding the #eIDAS Regulation:

We strongly warn against the currently proposed trilogue agreement, as it fails to properly respect the right to privacy of citizens and secure online communication; without establishing proper safeguards as outlined above, it instead substantially increases the potential for harm.

See the full Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform here: blog.fiff.de/eidas-open-letter… #TLS

This entry was edited (2 years ago)

I confess to playing with suno.ai, the new generative AI web app that generates song clips from prompts, this weekend. I'd say it's mostly a gimmick at this point. It's also yet another thing that cheapens music. I'd definitely rather spend money supporting real musicians than subscribing to this service.

I'm curious about how it works, though. Like, does it generate multiple tracks and mix them, or generate the whole mix at once via some end-to-end model?

in reply to Matt Campbell

I played with it too, and as a musician I don't feel cheapened whatsoever. If AI ever becomes as good as me at what I do, I simply need to up my game. I'm not about to get all pissy because something else *other than a human) is sharing the piss-pot, you know? It's great and honestly inspiring to see this tech grow. Humans will *always* bring the human touch to something. An AI might be able to play piano like me including listening to the nuance of a vocalist for example, if that vocal is pre-recorded, but certainly not in realtime for the moment. Maybe a few years down the line, but for now, I still remain a human with useful skills. I remain hugely interested in what these AI things have to offer, out of pure interest sake.

Karjalan kielen sanakirja on julkaistu uudessa käyttöliittymässä, joka toimii hyvin puhelimellakin.

Sanakirjassa on nyt myös automaattisesti valikoitunut päivän sana (samoin kuin Suomen murteiden sanakirjassa ja Vanhan kirjasuomen sanakirjassa). Tämän päivän sana on oloine.

Hyvää karjalan kielen päivää!

kaino.kotus.fi/kks/?p=main

#karjalankieli #sanakirja

ÚLTIMA HORA | El Gobierno y la Junta de Andalucía acuerdan cerrar los regadíos ilegales de Doñana
eldiario.es/andalucia/gobierno…

China's clean energy revolution is a significant step towards a sustainable future. The scale and pace of this transition could set a precedent for other nations and significantly influence the global trajectory towards clean, renewable energy. While challenges remain, the sheer ambition of this initiative demonstrates that large-scale renewable energy adoption is achievable.

#renewables #cleanenergy

zenanalyst.substack.com/p/chin…