pkill

@pkill@programming.dev

I am working on fedi software that is hoping to allow Kodi, Plex and Popcorn Time get rid of IMDb/TMDB dependency. Dm me if you’re skilled in SvelteKit and/or Go, especially the Fiber framework, or machine learning with Rust and willing to contribute.

This profile is from a federated server and may be incomplete. Browse more on the original instance.

pkill,

defectivebydesign.org

pkill,

LLM is pretty much guessing the next word

pkill,

I mean, correcting a LLM until it spews out something that mostly works is just good old shotgun debugging, prove me wrong

pkill,

non-AMOLED devices spreading misinfo by enabling dark mode by default on low battery and it’s consequences…

pkill,

as soon as you realize you can’t easily contain your commit message within a 50-character conventional message (or slightly more if you wand to be more specific about the scope)

pkill,

Sadly the development stopped, but still one of the most feature-rich.

pkill,

gitui

pkill,

Fair point. For instance one thing that sucks about flatpaks is that you can’t torsocks them

pkill,

Why are they even still pushing that nonsense when flatpak at least somewhat gets closer to getting bwrap implemented right?

pkill,

yep. Good code is self-documenting and syntax highligting and having longer sections folded up may help more than having to process some greyed out text. But comments are still useful for generating proper autocompletion and avoiding having to skim through you '“self documenting code”. Also it helps greatly with TDD and maintaining good coding practices. For example if you need a numbered list to reliably sum up what some function does, it’s often a good sign that it should be broken into a couple smaller ones.

pkill,

This is Bill.

Bill doesn’t need to minify his code, he names things using a single character even in compiled languages.

Bill is a heckin chad who can guess what the code does merely by looking at types and control flow.

Be like Bill

Signal leaked random contacts to me! (feddit.de)

When I press on some message to forward it, it shows me Random usernames of contacts I don’t know. And it even shows some Mobile Numbers I don’t know. For example, one number starts with +964 that’s Iraq. I’m from Europe tho. These contacts and numbers are from all over the place....

pkill,

It wasn’t my intention to state that an extensions of certain big software is always better or should get all the credit. No. First of all, I consider Molly protestware and second of all, the thing about being able to do federation and whatnot with much smaller funding was not about Molly. It was about simplex, matrix, XMPP, E2EE for Fedi and handful other decentralized/federated projects. Signal already has been downloaded hundreds of millions of times according to App Store/Play Store and received countless endorsements. And they did in fact face outages after receiving one from Elon Muskrat. So, they needed to find ways to scale better. Their server software could in theory be self hosted, but unlike Matrix or XMPP, it won’t federate so in a way it’s even worse than e-mail when it comes to this. One would thus think that it’s implicit that they would finally add the possibility to let people run their own servers or even devolve towards more P2P-oriented design. But instead they’ve decided to partner with a pump and dump shitcoin scheme whose privacy-friendliness was absolute trash, though granted, that was also at a time when every tech company was trying to join the Web3 hype. Now their reach is even bigger, but has grown at a steadier pace. I won’t try to go more tinfoil here with any unsubstantiated suspicions and begging the question but even though decentralized or federated systems are harder to design in a way that makes them secure, centralized ones are more abusable and create a single point of failure that can affect a large share of the user base.

pkill, (edited )

Also regarding tiling compositors/WMs. Base rate fallacy. Yeah desktop linux has got 3% market share but probably somewhat more if you exclude company or public computers. But then, probably also higher among Signal users. Anyway, that’s probably an Electron issue. Glad to see Flare getting better, so hopefully if it doesn’t get abandoned we might soon have a viable alternative that is more lightweight, secure and integrates better with the system in a more agnostic fashion. Heck, I might be even inclined to contribute a little to that project myself.

pkill,

maybe try setting up a matrix bridge if you feel confident you can secure that properly. On one hand it might increase attack surface (use only servers and bridges with End to Bridge Encryption) but what’s an attack surface on software that is so ridiculously compromised. Also you can try using an alternative client such as Flare. Though YMMV, for me the last time I’ve used it it was quite rough around the edges but I’m happy to see it’s actively maintained so might be worth checking out.

Also no, flatpak doesn’t fix this issue. Yeah it provides some isolation which can be further improved with flatseal, and other defense-in-depth methods. But unless you are willing to face the trade-offs of using Qubes, you won’t compartmentalize your entire system. The key file in question is stored in ~/.local/share. I’m not denying vulnerabilities in userland applications, but thanks to it’s wide reach, often massive codebases and use of unsafe languages like C, it’s the core system or networked software that is the most common attack vector. And that doesn’t ship and will never ship via flatpak.

The most obvious way this is exploitable is directory traversal. But not only that. Just look up “Electron $VULNERABILITY”, be it CSRF, XSS or RCE. Sandbox escape is much easier with this crap than any major browser, since contextIsolation is often intentionally disabled to access nodejs primitives instead of electron’s safer replacements. Btw Signal Desktop is also an electron app.

pkill,

Use molly

pkill,

Also, Signal’s centralization, sussy shenanigans with mobilecoin and not updating their server app repo for over a year (latter they ceased afterwards iirc but still very detrimental to trust, especially since git reflog manipulation is ridiculously easy) and dependence on proprietary libraries and network services (in case of libraries there are thankfully at least a couple forks without such dependencies). Plus most of their servers that aren’t necessarily CDN being located in glowieland…

pkill, (edited )

I advise you stop using Signal Desktop immediately, they keep the database key in plaintext. Exposed over 5 years ago and still not fixed. Frankly I find this pretty pathetic. Making this safer could be as simple as encrypting such files with something like age and perhaps regenerate the keys on a frequent basis (yes I know full disk encryption is somehow a viable solution against unwanted physical access. But instead, they’d rather focus on security by network effect by adding shiny UX features instead of fixing infrastructural stuff, like improving trust by decentralization, not requiring phone numbers to join, or adding support for app pasphrase (which is available in case of Molly, along with regular wiping of RAM data which makes things like cold boot or memory corruption attacks harder)

pkill, (edited )

Also don’t get me wrong. Molly might be written by less experienced programmers. And if it was written from scratch, it could be very likely it would contain more vulnerabilities per 1000 lines of code than standard Signal app. But it’s mostly just it’s a hardened superset sans some nasty stuff. I’d compare that more to how Calyx or GrapheneOS are to plain AOSP than how some low maintenance random custom ROM from XDA with fuckton of bells and whistles that will leave your bootloader unlocked is.

voxel, (edited ) to privacy
@voxel@infosec.exchange avatar

is making the watching experience worse on and Microsoft Edge.

I didn't believe it the first time I heard abt it, since it sounded more like a conspiracy theory than a actual thing, but it's true. Google does add 5s timeout specifically to Firefox and Edge users when they try to watch a video on YT. If you want to know more about it, Mental Outlaw make a very good video abt it (Link: https://youtu.be/v4gXhmzQztE ). I think Google did this, to get people moving to Chrome since the majority will think this is a browser issue, nobody would expect YouTube to purposely doing this. In the attached Screenshot you can see that YouTube checks the user agent of browsers to see if it's Edge, Firefox or not. You can bypass this by changing your User agent to chrome.

Edit: Due a lot of people saying a lot of different things abt it, I want to say that I'm not 100% sure abt how exactly this works, there is a inbuild delay by Google, but who is actually affected, there are a lot of different opinions abt it. I wasn't able to verify this myself in LibreWolf, but this could be the case due my intensive hardening I did and this is just a result of what I found in the code and what Mental Outlaw and others shared across social media, if you got different or additional infos abt this feel free to comment and I suggest everyone ti also check the comment section.

@privacy

pkill,

lmao

https://programming.dev/pictrs/image/1ee439cb-1c9a-4972-ae26-13ce7054f850.png

pkill,

Not my ss

pkill,

piped and yt-dlp are also good

pkill,

Though beware that although good in terms of performance, features and sturdiness (as long as you encase that glass back) or camera, Pixels are not flawless in terms of plain quality. Their battery life could be better and mine loses signal from time to time. Some features like 5G might not be available at every carrier in your country as well if Google has no official distribution there.

pkill,

OsmAnd is better since Petal Maps is proprietary.

pkill,

Pixel has superior hardware security afaik

Proton Mail CEO Calls New Address Verification Feature 'Blockchain in a Very Pure Form' (tech.slashdot.org)

Proton Mail, the leading privacy-focused email service, is making its first foray into blockchain technology with Key Transparency, which will allow users to verify email addresses. From a report: In an interview with Fortune, CEO and founder Andy Yen made clear that although the new feature uses blockchain, the key technology...

pkill,

Who cares about their honeypot

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • localhost
  • All magazines
    •
    Loading…
    Loading the web debug toolbar…
    Attempt #