Several years ago when someone highlighted the fact for me that curl was credited in the ending sequence of the megahit game Grand Theft Auto V, I got a brief moment of acknowledgement from my kids that I might be doing cool stuff before they forgot …
The one accessibility area I don’t like and avoid working on is PDF files. I frankly find the process people have to go through to make a PDF accessible is far too complex and far too antiquated. …
Seven new projects have been selected to contribute to the three NGI Pilots. IzzyOnDroid and OWASP blint will join forces with NGI Mobifree which works on a more ethical mobile ecosystem. Nuxt, Flohmarkt & Open Banking Gateway will work on integrations with Taler, the privacy-preserving digital payment system. And NGI Fediversity - the effort to create a hosting stack in-a-box - will be joined by Drupal & Source-based Nextcloud + Onlyoffice. nlnet.nl/news/2025/20250122-pr… #NGI #FOSS
When not dabbling in undusting the venerable Email system we play with rewiring the Web to free it from the possibility of billionaire platforms. With a nod to @pluralistic 's "Ulysses Pact" we just published "Replacing billionairish platforms with ZIP files" highlighting a bunch of new #webxdc features and community developments. The challenge is on who wants to join in de-platforming Venture-Capital-backed web apps that try to mediate our private communications delta.chat/en/2025-01-23-webxd…
How can we evolve and deploy web apps without allowing developers or operators to become a “billionaire in the middle”? There are many ways to try to address this challenge and some involve the tec...
Also, because we might really need this right now, I thought I might try to post more unique accessibility practice examples from all around the world. Can't promise this being a regular thing as I don't have nearly as many examples at hand but as long as I've got the ideas, I'll try to post one every day. Here's one. While researching something else, I came across the "Plan an accessible journey" guide of the Transport of London where I have learnt that it is possible to order live updates on bus arrivals by text message. Not sure how practical this is or how many people use it but I love examples of accessibility being implemented in times where it wasn't just a matter of adopting an app according to common guidelines and you had to be creative to find a way of accommodating your customers. tfl.gov.uk/transport-accessibi… #Blind #Accessibility
How to use our accessibility services and travel tools to plan your journey and find maps, wayfinding and realtime audio/visual information when you're on the move.
My first contribution to #NoonScrolling: the 200th birthday of Louis Braille is being celebrated this year. On that occasion, the Braille working group of the European Blind Union hosts a year-long project, where each day a Braille-related piece is featured. Want to learn about a German man who's learnt 400 poems by heart by reading them in Braille first? They've got you covered! Looking for that Spanish summer hit of 2018 with millions of Youtube displays that references Braille? OK, that one is a bit far-fetched but still meets the filter so right you are. I love the advent calendar style of this, there is one new story to discover every day. I don't think they would say no to your contribution if you had one still: livingbraille.eu/ #Braille #Blind #Accessibility
From an excellent thread about the subreddits overwhelmingly rejecting X, and also helping educate each other on anti-fascist language - this isn't going to be the walkover they think anywhere...
The whole "Roman salute" thing needs some clarification. There's no such thing as a "Roman salute". It was made up by fascists in Italy and then copied by the nazi regime. Only fascists use it. End of story.
CVSS is short for Common Vulnerability Scoring System and is according to Wikipedia a technical standard for assessing the severity of vulnerabilities in computing systems.
At the risk of sounding stupid - could you associate your severity levels with a fixed CVSS score and publish that? In my mind that would stop-gap "helpful" completion attempts.
> Every CVE filed to MITRE is supposed to have a CVSS score set.
That's odd. I requested CVEs through them (cveform.mitre.org/), there is no field to provide a CVSS score. Not sure if that makes it better or worse. Someone else without a clue of the system rates it, or the researcher initially rates it a higher to make it "more important"? Both terrible choices.
I hear you loud and clear and agree. But as you say: "a little cog in a big machine". So many standards (like PCI-DSS) we have to adhere to, use CVSS as a basis and basically force us to use them. I think not a single week passes where I don't have to adjust the scores because they are to broard. And unfortunately it's unlikely things will change b/c too much money is bound to all that stuff.
To me it seems like CVSS is trying to do a dozen things at the same time, and is being potentially provided by multiple groups with conflicting ideas on what it should be based on what thing they're trying to make it do, and their own personal goals (explicit or implicit). There's no way that could ever work.
Heck, even simple risk assessment is two-dimensional - how likely is the risk, and how big is the impact when it happens. This is trying to flatten that, plus many more properties, into a single axis, and of course it's useless.
It would be much better if the CVSS was just dropped wholesale, and replaced with scores that have a relevant target. At the very least we can have the two axes that normal risk assessment puts on it, which would solve most of the CVSS sillyness already. Add a third axis / score for user involvement, too, since a bug that can be triggered without users acting is much worse than one a user has to choose to run.
For example, your 9.8 "integer overflow could be abused" from a year ago would be marked as "impact minimal", "user invoked", "likelyhood certain". Maybe even give a somewhat formatted field to indicate which platforms are affected, so things like vulnerability scanners can check if their platform is even listed in the first place. Critical Windows vulnerability that does not exist on Macs should not give rise to a forced update.
filling useless mandatory fields with dummies isn't lying, it's making the computer do what it should do. Bonus points for a semi correct made up number so other companies don't make it a 9.9 critical when it isn't.
the more I think and interact about the CVE ecosystem and the more I think we should have our own alternative and ecosystem that explicitly does not live in their taxonomy
Figure out the open source cooperation way of managing sec vulns and just make it so much better that the corporate world has to negotiate with us and we cease to be a cog
One approach you could take, which doesn't involve fictional CVSS scores but does avoid the risk of CISA (or others) causing you this kind of problem, would be to have a policy of using the mid-point of the severity range for each of your 4 severity bandings as the score.
That gives people a good idea of what the severity is, and avoids the problem you had here.
@raesene with a CVSS we must provide the calculator string showing how we came to that score. That would be the part where we would have to "lie" to get the score we want.
Ahh I see :( Back when I was a pentester, luckily we didn't need to provide the calculations, so we regularly back-ported a CVSS score, if required, to the severity we thought the issue had...
A rating is required for prioritization. Until you convince MITRE/CISA to abandon "CVSS rating", it would be helpful to put a sane value in the "CVSS box". All of us who get the flow of CVE alerts would thank you if you put your rating (set the vectors randomly as long as it gets your ratings!).
thank you so much for writing this up, and illustrating the problems with CVSS’s fake precision. Your post will be a helpful example next time I try convincing someone about the utility of CVSS scoring.
The comment form doesn't seem to work for me, so I'll reply here: FWIW, the OpenSSL team also seems to be in the same position; they publish severity ratings, but not CVSS scores.
very interesting read! I personally found CVSS as a good weapon to use against managers to convince them about severity of fixing stuff, as they like metrics. I wonder what could I use instead. High/critical doesn't have the same gravity as some number IMO 😀 Other than that, for me, it doesn't really have much difference without it, and I know better now not to focus on the score
The sad thing is: it could be a good system if used properly. It captures a lot of useful properties in the vector, especially when you go beyond the base score and include temporal and environmental score.
In my fever dreams, I'm imagining a system that captures my overall system architecture including security requirements, security boundaries, etc., so when a CVE is coming in, it automatically calculates an environmental score, based e.g. on "that's a local vuln, hard ro exploit, on an appliance that doesn't really have any internal security boundaries anyways, on a network physically protected and behind seven firewalls, get lost" or "unauthenticated remote code execution in all configurations on a service handling valuable data, actually exposed to the Internet, actively exploited, all hands on deck NOW".
So from a vulnerability information consumer point of view, data points like exploitability, authenticated vs. unauthenticated, local or remote, actually confirmed by a person with an understanding of the code,make a huge difference, and it would be good to have them in machine readable format. Of course, a 9.8 slapped on by some analyst who doesn't even bother to look at the code doesn't help anyone.
agreed. We stopped using cvss just a year into our project. Nowadays we work with our own scoring (cvss is a % part of) that actually tries to the reflect the real-world implications and infrastructural context. Great read, thanks for sharing! Gives me confidence in our decision to ditch cvss.
Uhmmmm... so, make yourself a CVE authority on your stuff [effectively blocking anyone else from publishing anything on your stuff), and do nothing else (i.e. no CVE published).
Of course, it's a bit late for #curl, but you know, other projects?
(and yes, it's naughty. I'm in a naughty mood, yeah?)
Really good article. My experience with "security experts" is that most actually have very limited knowledge in the field. And lack critical thinking. This leads to an almost blind trust in these tools that spit out reports on CVSS scores that can easily be exported to nice looking spreadsheets.
Unfortunately, those tend to be taken as gospel by management. Because management never have a clue about anything.
Thats why we (pentest company) do our own risk calculation method which actually includes likelihood and takes into account our customers setup, environment, etc.
We only add cvss scores if the customer explicitly asks for it.
how is it fake in case curl maps their 4 levels to some 4 values in cvss and at least sets it. This allows arguing for a better system while defending users from misinformation?
Well, maybe solving this allowing to use a custom project's policy is a way for a smooth transition for something better. AFAIU end users (like vulnerability scanners) rely on LOW/HIGH/CRITICAL/... scale anyway. So, this number is just an intermediate most of the time between curl's scale and scanner's scale that use the same system.
cURL and Go security teams are publicly rejecting CVSS as flawed for assessing vulnerabilities and are calling for more accurate, context-aware approa...
Remember the pretty-looking Windows 3.1 "high resolution" mode possible with Viaduct now? Well, as it turns out, the boot logo is displayed by a different piece of code, so despite the new driver it was still in 640x200, and thus, very ugly. 🤮
This isn't part of the DDK at all, so I had to disassemble the CGA and Hercules editions of the logo display code from Windows 3.1 binaries, then bodge one together, that can display the EGA monochrome logo in 640x400. 🤪 👍
🤔 Do you know which categories will be presented at #EOSAwards25?
1️⃣We kick-off with the Open Source Achievement Award!
🏆This award is recognises a European #opensource contributor working constantly to transform the technological landscape and boost the open source #community in Europe!
This award will be presented by Omar Mohsine, Open Source Coordinator for United Nations-ODET!
Billionaires have reached their final forms: selling their souls to the worst people alive just to get more.
It’s sick. They have more money than they could ever spend, more power than entire nations, but it’s never enough. Now they kneel before wannabe dictators, but pretend they’re visionaries or icons.
In truth - this isn’t genius, it’s a sickness. Hoarding wealth beyond reason, chasing power for its own sake, stepping on humanity just to climb higher.
Huge shout out to our newest team member, @shlee for organizing our amazingly successful Kickstarter, and helping us establish a long term vision for our platforms and community!
While we reached our initial goal, we are aiming even higher to accomplish even more this year!
Aquí está bien explicado lo de la modificación en las jubilaciones *activas* y etc. Estoy de acuerdo en que no supone un aumento de la edad de jubilación *per se*, pero lo de fomentar lo de jubilarse más tarde... me rechina.
Yo no lo veo tan mal, teniendo en cuenta la gente que tenemos por aquí que pide prórrogas del servicio activo. Hay gente que vive más feliz así, y tampoco es para decirles que no.
@modulux Puedo entenderlo a nivel personal. E incluso a nivel de organización, para seguir contando con activos valiosos por su capacidad o experiencia que, por la naturaleza del trabajo, pueden realizarlo sin problemas. Pero si lo miras de forma global, tenemos el problema del paro juvenil ahí. Y, para ciertas profesiones, debería de evaluarse que se está en perfectas condiciones para realizar ese trabajo (pienso en la profesión médica, por ejemplo) Como con la renovación del carné de conducir
De acuerdo en todo. La prórroga no debería de ser automática sino requerir por lo menos un mínimo de verificación de que la persona está en condiciones. De hecho yo sé de alguna que se ha denegado, sobre todo por problemas de absentismo que ponen de manifiesto que la persona no está para trabajar a esa edad.
Y lo del paro juvenil también es verdad, aunque ahora esté bajando bastante aún está ahí.
@modulux Lo que yo no compro es que el paro juvenil sea culpa de la gente que no se jubila, ese relato de la batalla generacional me rechina mucho más que una posible mejora voluntaria
@tinitun @modulux Seguro que no? ¿Y si a los 65 te queda una pensión más bien justita o menos, incluso insuficiente y te aumentan un 5 o 10% cada año de más trabajado hasta los 72? Y no, no digamos que eso no puede ocurrir, que el futuro se presenta muy oscuro y muy capitalista.
I trust you have figured out already that I have the highest ambitions for the curl documentation. I want everything documented in a clear, easy-to-read and easy-to-find manner.
I hope one day I'll be able to switch apt's man pages from docbook XML to a text format. But they are translated (with po4a), need a complete rewrite as they're horrible, and I must not break bootstrapping distros with exotic dependencies.
@juliank yeah, but a key is to generate the correct set and ship that in releases so that consumers don't necessarily need (all) the tooling. But yeah, we all have our different set of conditions and caveats to carry so it applies differently.
the curl docs are fantastic. When I was writing my libcurl ffi bindings for Perl I generate much of the code from the .h files and my documents for options and functions can link directly to the curl website because almost all of it is directly relevant to the Perl versions and there is no reason to duplicate them.
4.352 horas de pódcast en #AntennaPod son 181,33 días, 25,9 semanas o 6 meses escuchando información, historias, humor ...
Muchas gracias al proyecto de software libre por hacérmelo agradable y respetando mi privacidad.
A todas las personas tras el micro por su tiempo y dedicación, ya que el 98% de esos podcast son de gente que lo hace por "amor al arte" (amateur bien entendido) y que aunque aún no estén la lista oficial de @ultimosfeed para mi son #Feedlipinos
Y a quien como yo disfruta de este medio, haciendo crecer frente a otros más virales y algorítmicos.
@RaccoonForFriendica We finally did it: we got access to the production channel on Google Play! A big and heartfelt "thank you" to all those who participated in the closed test program, without you this would have been impossible! 🦝❤️
The latest beta has been promoted to the "open testing" track, so that now everyone can become a tester and install the latest beta, which is a preview of the next stable release.
I'll wait until I improve notification support, so probably there is another month or so to wait. Keep an eye on the issue tracker to know what I'm working on, just in case 😉
Your feedback is important, and now you'll have Google Play's reviews as an additional way to express your opinion. Let me know what you think and always #livefasteattrash
Da diversi anni ormai Mastodon ha introdotto una interessantissima sezione #notizie o #news.
Si tratta dei link più condivisi o contrassegnati come preferiti dai membri della vostra istanza. Un interessante indicatore quindi delle preferenze di altri utenti come voi.
ma a seconda della vostra distanza, potete raggiungerla digitando il link https://NOMEDELLAVOSTRAISTANZA/explore/links
Non tutte le istanze l'hanno attivata, perché potrebbe sembrare una eccessiva resa di fronte al potere degli algoritmi, Ma a differenza dei social commerciali, gli algoritmi di mastodon sono aperti e possono essere valutati da chiunque sia in grado di leggere la relativa documentazione.
Se la sezione risulta scarna è solo perché gli utenti dell'istanza sono un po' avari di ricondivisioni e stelline... 😅
Poliversity è una comunità dedicata alla ricerca scientifica e al giornalismo, all'università e all'istruzione ed è nata per promuovere il diritto alla conoscenza e la corretta informazione
El Gobierno federal de #EEUU🇺🇸 ordena a todos los empleados públicos a denunciar a todo aquél que considere que ha sido contratado o ascendido para aumentar la diversidad del sector público. Indica que no habrá consecuencias para quien lo haga pero advierte que quien NO lo haga en 10 días puede ser castigado.
La principal herramienta del fascismo, ayer y hoy, son los pequeños resentimientos. Contra eso, solo hay un arma: la decencia militante. chcoc.gov/sites/default/files/…
For those migrating to the #fediverse from #Facebook, the experience can be a bit overwhelming. Choosing an instance/server can be daunting, not to mention trying to match basic need with feature set. One thing I can recommend when inviting folks to the fedi is to gently get across that it's not exactly what they're used to. They have to be a bit more hands-on, since there is, for the most part, no algorithm.
From working in tech support for about 13 years, I learned that when introducing something new to the user, it's best to take one aspect and focus on teaching that to them. Get them a foundation, help them get comfortable, then move on to the next aspect. Education = empowerment.
Here's a list of the protocols I use/have used and my experience with them. I've done a little footwork, and made a list of servers by protocol for users to peruse. Courtesy of FediDB! I recommend going to each instance's about page and reading up on such info as character limit, location, instance focus, blocklists, and who they federate with.
One thing I can say for sure: My interactions in the fediverse - with a couple of exceptions - have been pleasant and rewarding. Fedi is truly a breath of fresh air when compared to the mainstream platforms.
Mastodonfedidb.org/software/mastodonOf course, the most widely known of the protocols. I've had more experience on it than any other. Mastodon instances usually have a 500 character limit. If one is particularly verbose, it may not be ideal, as you have to create a thread in order to have a longer post. There are other mastodon instances with larger character limits. Again, best to look at an instance's about page to get the lowdown.
Sharkeyfedidb.org/software/sharkeyProbably my favorite thus far. Sharkey is a fork of the MisKey protocol, and has a rich feature set. It has a selection of reaction emojis, so you can do more than just "like" a post. If you're versed in MFM formatting language, Sharkey also has you covered. Character limits are usually higher. Sharkey.world (the instance I'm on) has a 5000 character limit.
Friendicafedidb.org/software/friendicaFor a more Facebook-like experience, and a practically unlimited character limit, Friendica offers a bit more familiarity to a fediverse newcomer's experience. It has events, calendars, and you can create groups, though you actually create a new page to act as a group. In all honesty, I find Friendica a bit clunky, but that's just personal opinion.
And that's my offering. I hope this is useful, and as always, if what I presented needs correction anywhere, please feel free to let me know, just be constructive.
In general terms federation with #friendica works, even integration into public forum pages and reshare by those when the castopod profile is followed by the forum page in the first place, as tested with the forum page @podCasts. As of now following from castopod profiles apparently isn't implemented. Also as of now we didn't manage to get the cron job to work at that new instalation on a shared hosting.
What is strange is that a podcast episode publication doesn't embeed the audio player so it can't be reproduced inside the post shown over here on friendica. On mastodon this works, the post displayes a video like screen and reproduces the audio file.
Not sure if this is a specific issue of this friendica instance as it is stil 2023.05 or if this is something the latest versions experience to.
Over here on friendica 2024.12 the audio isn't displayed either.
I had expected that this would be some kind of activityPub convention of transmitting information about if a video or audio format is part of the content.
If I'm not wrong, when posting a mp3 URL like the following, the audio player is displayed right away: media.tupambae.com/audio/bauhe… (well, in the preview that's not the case)
The views on mastodon of the ways the audio posts are displayed. The orginal #castopod #podcast publication shows up in the preview as a video with the general podcast cover. If the play button is selected, the window changes into a audio replay option window. No download option, @bitPickup@cast.tupambae.com itself is set as "prevent copy". The MP3 audio URL posted in [audio] BBCode brackets by @utopiarte shows up as a different (black) audio file reproduction window. A download option is displayed.
there is no indication of something that should be played, there is only the link in the text content. Now, mastodon get the first link it find in post and try tho show a preview, I think using OpenGraph. Friendica sometimes does it also, I don't know the details and I don't know why it doesn't show a preview for this. I'm pretty sure that it will not show a player anyway.
The point is: there is nothing in that Note object which says "it's a podcast". It's just a note that an episode is published, with a link to it. The fact that mastodon show the player is unrelated from the fact that the note links to a podcast. I'm sure the fact the link is the first thing in the note is a deliberated choice by castopod devs, to take advantage of Mastodon's behavior
I had expected that this would be some kind of activityPub convention of transmitting information about if a video or audio format is part of the content.
Yes there is: attachment property. But then Friendica will shows attachments as icons at the end of the post. Still without a player.
Castopod devs chose to create their ActivityStream object of type 'PodcastEpisode', which you can get requesting the AS version of the episode page
But this is not a standard object, and Friendica (and I think many other services) does not know how to display it, failing back to render the "content", losing the link to the audio file.
A note with a link is a reasonable way to post something understandable by everyone.
@Castopod :podcasting2: @utopiArte Mh, quick correction. if the link to the audio file is in an "attachment" property, friendica will show the player. Just as in this post
But from a semantic prospective (acting like I know what it means), the audio file is not attached to the note, but to the episode.
Anti-trans laws and the blueprint of Project 2025 are meant to divide and conquer. Because it's big and scary, it can drive people to a sense of powerlessness, but the entirety of political power doesn't exist only in Washington. There are thousands of elected officials across the country with power, too. And they can push back against the federal government. popsugar.com/identity/blue-sta…
@ZBennoui Also, US does have an anti-government culture, for better or worse. It's a big country and you can't just rule it by executive order alone. In fact, I think many of Trump's supporters would get touchy the minute their freedoms are obsconded with, take abbortion as an example. It's not that many people in red states support it, but it's the fact that someone was telling you what to do and what not to do that pissed off a lot of people. (1/2)
How I use Padlet accessibility features with low vision, and tips for configuring Padlet designs so they are easier to read for students with visual impairments
Will be very interesting to see what this means for Accessibility. OpenAI Reportedly Launching ‘Operator’ That Can Control Your Computer This Week gizmodo.com/openai-reportedly-…
I do really like the @humanetech.bsky.social work, especially the #YourUndividedAttention #podcast. This week the Laughing at Power Episode is wonderful.
The Tactics4Change interactive website provides free access to information about more than 400 hundred cases of nonviolent dilemma actions, from all continents, and more than 100 countries.
On the Your Undivided Attention #podcast I heard about Tactics4Change tactics4change.org/ , a case guide to nonviolent dilemma actions and how to do activism with humor. This could be the year when activism is needed more than ever.
I've been slowly getting into making music in Reaper. This weekend, I made this trippy little thing. Me and @Evdog1245 called it Purple, because we both agreed it sounds purple. If you get it, you get it.
daniel:// stenberg://
in reply to Mårten Möller • • •