[-] evenwicht@lemmy.sdf.org 1 points 3 days ago

Good find. Apparently it’s just a matter of waiting for instances to upgrade.

[-] evenwicht@lemmy.sdf.org 2 points 5 days ago* (last edited 5 days ago)

I’ve often wondered about the reach of crawlers. Don’t crawlers need to be seeded with links? Don’t they rely on links that are published on crawled pages? If there is no navigable path to the repo, how would a crawler find it?

Of course if a friend publishes the link, all bets are off. And I would accept that.

8
submitted 5 days ago* (last edited 5 days ago) by evenwicht@lemmy.sdf.org to c/collaboration@sopuli.xyz

I need a repo that should not be publicly findable with explore. Does this mean the repo necessarily must be private? When it’s private, I cannot simply give an URL to friends to browse. IIUC, they must create an account, tell me their username, then I must add their username as a collaborator. That’s way overkill.

I just want to give out an URL that will reach the content when visited. It should not be discoverable by the general public but we are not talking state secrets. It must be hassle-free for read-only access. When browsing to a private repo (when logged out), it gives a 404 error.

update: A hack comes to mind: I could create a 2nd account on the same server, make that account a collaborator, then share the password to that acct with friends.

3

cross-posted from: https://lemmy.sdf.org/post/54045255

I have adopted the habit of ignoring red lights.

Rationale: If cars did not exist, cyclists would never have to stop. Every time I must stop at a traffic signal it is to cator for motorists who are mostly a self-serving detriment to public health and safety. #FuckCars.

I used to obey all the traffic rules but after coming to the realisation that much of my time is wasted and my journey is downgraded so copious lazy people can exploit a luxury (some demographics aside). Fuck that. I now run red lights like crazy.

Now I must consider that Tesla may fuck up my lifestyle because Tesla is a moving point of unchecked uncontrolled surveillance. Theoretically, Tesla could be grabbing the faces of cyclists. It could offer to report cyclists who run reds. It could sell that info to law enforcement. Am I overthinking this or is this a problem to watch out for?

OTOH, I am somewhat looking forward to a day when I can spot when a car is self-driving and (if I can ever gain confidence that they won’t mistake me for a tumbleweed) I would happily take liberties -- to cut-off the car and force it to slow down and give way. I hope that tactic can go from dream world to real world.

2

cross-posted from: https://lemmy.sdf.org/post/54045255

I have adopted the habit of ignoring red lights.

Rationale: If cars did not exist, cyclists would never have to stop. Every time I must stop at a traffic signal it is to cator for motorists who are mostly a self-serving detriment to public health and safety. #FuckCars.

I used to obey all the traffic rules but after coming to the realisation that much of my time is wasted and my journey is downgraded so copious lazy people can exploit a luxury (some demographics aside). Fuck that. I now run red lights like crazy.

Now I must consider that Tesla may fuck up my lifestyle because Tesla is a moving point of unchecked uncontrolled surveillance. Theoretically, Tesla could be grabbing the faces of cyclists. It could offer to report cyclists who run reds. It could sell that info to law enforcement. Am I overthinking this or is this a problem to watch out for?

OTOH, I am somewhat looking forward to a day when I can spot when a car is self-driving and (if I can ever gain confidence that they won’t mistake me for a tumbleweed) I would happily take liberties -- to cut-off the car and force it to slow down and give way. I hope that tactic can go from dream world to real world.

8
submitted 3 weeks ago* (last edited 3 weeks ago) by evenwicht@lemmy.sdf.org to c/selfhosting@slrpnk.net

I just bought a 2nd-hand CubieTruck which apparently has a cubieboard 3. The cubieboard.org website is a shit-show of dead links. There are some docs but all the drivers and software are dead links. No Android or Debian images. It’s also a shit-show over at archive.org:

http://web.archive.org/web/20171105012836/http://dl.cubieboard.org/software/a20-cubieboard/android/v2.0_A20_android_source.tar.gz

There is a tree of directories here:

http://web.archive.org/web/20180225200418/http://dl.cubieboard.org/

but 404 errors on all files. In principle, softwareheritage.org should have the software. But it doesn’t because (I suspect) s/w heritage fixates on github and probably needed someone to manually request that they keep software outside of Microsoft’s walled garden.

I don’t suppose anyone has cubieboard 3 files.. but in the very least I hope this post will serve to warn ppl to avoid cubieboard.

7
submitted 3 weeks ago by evenwicht@lemmy.sdf.org to c/glam@lemmy.cafe

cross-posted from: https://lemmy.sdf.org/post/53671520

I asked a library system to furnish their whole catalog of books, music, and movies in an open format (JSON, XML, or CSV). They refused, saying that the database is extremely large, composed of several hundred thousand bibliographic records that reference over 2 million documents. They say the database is highly dynamic and it would be obsolete by the time they export the data and likely not useful to more than one person.

So they have opted to limit everyone to using their web-based search. Is my request unreasonable? Or their response?

I’m trying to get a basic idea of the size we are talking about. I’m guessing 100,000 bibliographic records would consume roughly 100mb uncompressed (guessing an avg. record would not exceed 1k). And since text compresses very well, a zipped JSON would be what, ~10mb per 100k records? I believe a zip file of 900,000 bibliographies would be ~65mb.

The library did not give precise figures but I would like to work out what level of crazy my request is. Do any libraries in the world export a dataset of 100s of 1000s of book and media titles? Because if it’s done /somewhere/, it would give a clue about the reasonableness of my request.

I’ll give a couple use cases in case anyone is wondering how direct DB access would be useful.

Use case 1:

  1. fetch a list of titles of interest, e.g. award-winners (books, scripts, actors, musicians, directors, etc), or a list of banned books, because if it’s banned somewhere maybe it piques your curiosity
  2. search the library’s DB for matches against a list

If the list is more than ~15 or so items, you’re fucked because library query forms rarely accept a list as input. And as soon as you need to specify other criteria like works in English with a date range, the chance of a web form doing the job becomes increasing unlikely.

Use case 2: Suppose you are boycotting something or want to avoid something or someone (e.g. you want to avoid Tom Hanks because he is a sell-out with no sense of brand protection, who will act in any garbage film if it pays enough)

  1. fetch a list of titles you want to avoid (e.g. if you boycott Disney, get a list of Disney titles; or get a list of movies Tom Hanks was in)
  2. search the library’s DB for whatever you are looking for, but exclude matches against a list

Or you have a looooonng list of movies you have already seen or books you have read. Obviously you might want to exclude them from your queries.

Use case 3: The library has an extremely limited sense of genres. A conversation went like this:

Me: “Where is the EDM section? Where is the ambient and trip-hop section?” Librarian: “what’s that?” Me: Electronic music. Librarian: those would be under “rock”. Me: What about world music, like Ravi Shankar (classical Indian)? Librarian: check jazz

Fuck me. No wonder the rock and jazz sections are so huge and there’s little else. Picking through it would be unsurmountable and the web DB likely has the same sloppy genre problem. I suspect what has happened is young ppl just don’t do libraries much and they probably use Spotify or similar online surveillance system for music. In fact I rarely even see people browsing the music these days. So the library organisation just did not keep up genres and no one noticed because they are online. So again, like use case 1 it would be useful to find the intersection between a list of titles of interest and the library DB.

I have to wonder if the /real/ problem is that the library thinks I would be the sole user of the exported DB. I can understand resistence to doing a significant amount of work for just one person. But I would expect many people to have search needs that these GUI webforms cannot handle, no? And from there it would be the subset of those people who know SQL.

10

I asked a library system to furnish their whole catalog of books, music, and movies in an open format (JSON, XML, or CSV). They refused, saying that the database is extremely large, composed of several hundred thousand bibliographic records that reference over 2 million documents. They say the database is highly dynamic and it would be obsolete by the time they export the data and likely not useful to more than one person.

So they have opted to limit everyone to using their web-based search. Is my request unreasonable? Or their response?

I’m trying to get a basic idea of the size we are talking about. I’m guessing 100,000 bibliographic records would consume roughly 100mb uncompressed (guessing an avg. record would not exceed 1k). And since text compresses very well, a zipped JSON would be what, ~10mb per 100k records? I believe a zip file of 900,000 bibliographies would be ~65mb.

The library did not give precise figures but I would like to work out what level of crazy my request is. Do any libraries in the world export a dataset of 100s of 1000s of book and media titles? Because if it’s done /somewhere/, it would give a clue about the reasonableness of my request.

I’ll give a couple use cases in case anyone is wondering how direct DB access would be useful.

Use case 1:

  1. fetch a list of titles of interest, e.g. award-winners (books, scripts, actors, musicians, directors, etc), or a list of banned books, because if it’s banned somewhere maybe it piques your curiosity
  2. search the library’s DB for matches against a list

If the list is more than ~15 or so items, you’re fucked because library query forms rarely accept a list as input. And as soon as you need to specify other criteria like works in English with a date range, the chance of a web form doing the job becomes increasing unlikely.

Use case 2: Suppose you are boycotting something or want to avoid something or someone (e.g. you want to avoid Tom Hanks because he is a sell-out with no sense of brand protection, who will act in any garbage film if it pays enough)

  1. fetch a list of titles you want to avoid (e.g. if you boycott Disney, get a list of Disney titles; or get a list of movies Tom Hanks was in)
  2. search the library’s DB for whatever you are looking for, but exclude matches against a list

Or you have a looooonng list of movies you have already seen or books you have read. Obviously you might want to exclude them from your queries.

Use case 3: The library has an extremely limited sense of genres. A conversation went like this:

Me: “Where is the EDM section? Where is the ambient and trip-hop section?” Librarian: “what’s that?” Me: Electronic music. Librarian: those would be under “rock”. Me: What about world music, like Ravi Shankar (classical Indian)? Librarian: check jazz

Fuck me. No wonder the rock and jazz sections are so huge and there’s little else. Picking through it would be unsurmountable and the web DB likely has the same sloppy genre problem. I suspect what has happened is young ppl just don’t do libraries much and they probably use Spotify or similar online surveillance system for music. In fact I rarely even see people browsing the music these days. So the library organisation just did not keep up genres and no one noticed because they are online. So again, like use case 1 it would be useful to find the intersection between a list of titles of interest and the library DB.

I have to wonder if the /real/ problem is that the library thinks I would be the sole user of the exported DB. I can understand resistence to doing a significant amount of work for just one person. But I would expect many people to have search needs that these GUI webforms cannot handle, no? And from there it would be the subset of those people who know SQL.

8

Hope no one minds me being slightly off-topic in a relatively inactive group, but it’s the best fitting community I could find for the question.

I plan to build a directional wifi antenna using a can (aka the Pringles can antenna). I am baffled at how costly the connectors are. Why are the prices so high for a connector? Cantenna instructions always say to use an N-type connector. Is that really necessary? Coax cable connectors are a dime a dozen. Would those work?

Or what if I just strip the end of the coax cable to the right length and find a way to skip the connector and secure it to the can.. will that work?

Otherwise it’s ~$12 for the panel mount N connector + $10 for the connector that mates to it + $10 for the RP-SMA connector that attaches to the wi-fi AP. So over $30 for a home built wi-fi antenna. Fuck that.

10
submitted 1 month ago* (last edited 1 month ago) by evenwicht@lemmy.sdf.org to c/selfhosting@slrpnk.net

Fujitsu abandoned their Celvin NAS customers. The proprietary software is over 10 years old. And worse, Fujitsu had an app store to get apps that were not part of the stock stock distro, like a bittorrent app, which are no longer reachable.

The hardware uses a Marvell arm SOC. FreeNAS is x86 only. QNAP has some fairly recent distros that may be compatible. It’s proprietary and perhaps somewhat risky. What are the chances that a QNAP image from 2024 bricks my Fujitsu from 2013?

Is QNAP my only option, or is there a FOSS option? There are at least 15 FOSS NAS platforms:

https://techcult.com/best-free-and-open-source-nas-software/

but I have no idea if any are built for a Marvell arm SOC. Anyone know?

4
submitted 2 months ago* (last edited 2 months ago) by evenwicht@lemmy.sdf.org to c/isitdown@infosec.pub

The linked account is very busy.. almost 10,000 repos. Whoever the asshole is behind that attack, it’s the reason the public has lost the ability to create a new account on nixnet.

This matters in particular because Nixnet is the only gitea/forgejo host that has both a clearnet and onion host -- apart from disroot, but disroot’s onion is dysfunctional.

Note that the XMPP support channel is shut down because that was attacked as well.

3
submitted 2 months ago by evenwicht@lemmy.sdf.org to c/IRC@lemmy.cafe
14
submitted 2 months ago by evenwicht@lemmy.sdf.org to c/bugs@sopuli.xyz

The stock lemmy web client has had this annoying shitty bug as long as I remember. Not sure how or why ppl have tolerated it for so long.

I started this thread:

https://lemmy.sdf.org/post/52956979

Then I wanted to cross-post to !IRC@lemmy.cafe. The first defect is that it’s impossible to enter the full address of the target forum. Lemmy forces us to enter only part of the name and choose from a pull-down list. Then from there it’s not even smart enough to prioritise the user’s subscribed forums to the top. So entering “IRC” gives a long list of circle jerking forums, while the more simple match !IRC@lemmy.cafe is pushed off the list.

5
submitted 2 months ago by evenwicht@lemmy.sdf.org to c/irc@lemmy.sdf.org

cross-posted from: https://lemmy.sdf.org/post/52956979

It looks like the most common method to use irssi over tor is to use a transparent proxy to tamper with network libraries, like torsocks or using proxychains4. Those approaches are useless when you also use Irssi with #Bitlbee, because bitlbee runs a local agent obviously becomes unreachable with torsocks in the loop.

So I must use a more complex approach:

$ socat -T9999999 -s TCP4-LISTEN:13999,ignoreeof SOCKS4A:127.0.0.1:libera75jm6of4wxpxt4aynol3xjmbtxgfyjpu34ss4d7r7q2v5zrpyd.onion:6697,socksport=9050,ignoreeof &
$ socat_pid_libera=$!
$ irssi
$ kill ${socat_pid_libera}

Then irssi is configured to point the libera network to 127.0.0.1:13999.

That’s the idea. There is a separate socat process for every IRC host I might reach, which is about a dozen in my case. Apart from ugly tediousness, it works for like 30 min on avg then dies. I believe that’s the nature of Tor. Circuits die and get replaced, and when that happens socat is left with a dead connection for some reason.

Is there a remedy? I there a way to make socat resilient to tor volatility?

[-] evenwicht@lemmy.sdf.org 7 points 4 months ago

In those days, DOS was the OS. Windows and DESQview were just window manager apps that ran other apps.

[-] evenwicht@lemmy.sdf.org 13 points 11 months ago* (last edited 11 months ago)

If you think it’s over the money, you’ve missed the plot.

There is an ethical problem with how they operate. If you let them get away with their shenanigans, you support them. I will not. Fuck banks. And fuck their shenanigans. When they pulled this shit, it became my ethical duty to cost them. Their postage cost exceeds the value of the check, and their phone operator costs are high. So I’m happy to ensure their profit-driven exploitation backfires fully.

Mobile deposits: most banks have scrapped remote deposits via web. Most banks are happy to exclude those not on their exclusive smartphone ecosystem and try to push you into Google’s walled garden to obtain their forced-obsolescence app (so Google can know where you bank after getting a mobile phone subscription in order to activate a Google acct). Anything to cattle-herd boot lickers onto the bank’s closed-source spyware app is part of their game. The ethical problems with this could fill a book.

I tried hacking together an Android emulator to take a JPG of a check and emulate the camera within the android v/m using the linux gstreamer tool. I tried that back when I was willing to briefly experiment with a closed-source bank app I exfiltrated using Raccoon. Shit didn’t work with the banking app.. it was too defensive. I was lucky the app even ran on the emulator. Many banking apps detect the emulator and refuse to run.

Can’t reach an ATM for deposits from overseas. But also, when I am in the country, it’s a long drive from the house to an ATM.

So deposits by mail are the most sensible in my situation.

They fucked up. They made you whole.

The idiot who charged the interest was just the first fuckup. And it’s not a significant fuckup. The notable fuckup here is the deliberate corporate-wide policy in how they deal with small credits that leads to a paper check in the mail. It’s the shitty policy that disables them from fixing their fuckups. A fuckup is fine if they can fix sensibly. But this is not the case here.

IIUC, it’s what the Scots call a running goat fuck.. which is fuck up after fuck up on top of fuck ups.

[-] evenwicht@lemmy.sdf.org 8 points 1 year ago

Diligent consumers don’t do that. They pay their bill off faster than fees can be incurred. It’s the other consumers, the undisciplined and the poor, who get sucked dry by fees. These are not the demographic of international travelers. One demographic is subsidizing another.

The interesting thing is that if you’re in the diligent demographic, you can make the shitty bank lose money. Profit from those they exploit is the same whether you create a loss for the bank or not.

[-] evenwicht@lemmy.sdf.org 10 points 1 year ago

I’ll have a brief look but I doubt ffmpeg would know about DVD CSS encryption.

[-] evenwicht@lemmy.sdf.org 19 points 1 year ago* (last edited 1 year ago)

If anyone is writing or maintaining a playbook/handbook for how to run an authoritarian regime, removing open data would be a play to add.

[-] evenwicht@lemmy.sdf.org 8 points 1 year ago* (last edited 1 year ago)

It’s possible that it’s an accident, but unlikely IMO. The accidental case is overload and timing fragility. Tor introduces a delay, so if a server already has a poor response time and the user’s browser has a short timeout tolerance, then it’s a recipe for a timeout. Firefox does better than Chromium on this (default configs). But I tried both browsers. At the state level I think they made a concious decision to drop packets.

It’s also possible that they are not blocking all of Tor but just the exit node I happened to use. I did not exhaustively try other nodes but I was blocked two different days (thus likely two different nodes). In any case, this forum should help sort it out. Anyone can chime in with other demographics who are blocked, or tor users that are not blocked.

(edit) ah, forgot to mention: www.flsenate.gov also drops Tor packets.

[-] evenwicht@lemmy.sdf.org 8 points 1 year ago* (last edited 1 year ago)

infosec 101:

  • confidentiality
  • integrity
  • availability

If users who should have access (e.g. US taxpayers) are blocked, there is an availability loss. Blocking Tor reduces availability. Which by definition undermines security.

Some would argue blocking Tor promotes availability because a pre-emptive strike against arbitrary possible attackers revents DoS, which I suppose is what you are thinking. But this is a sloppy practice by under-resourced or under-skilled workers. It demonstrates an IT team who lacks the talent needed to provide resources to all legit users.

A mom and pop shop, sure, we expect them to have limited skills. But the US federal gov? It’s a bit embarrassing. The Tor network of exit nodes is tiny. The IRS should be able to handle a full-on DDoS attempt from Tor because such an effort should bring down the Tor network itself before a federal gov website. If it’s fear of spam, there are other tools for that. IRS publications could of course be on a separate host than that which collects feedback.

[-] evenwicht@lemmy.sdf.org 8 points 1 year ago* (last edited 1 year ago)

This is not a news forum. It’s a boycott organisation and support forum. Do your boycotts tend to last less than 1 year? That’s not really impactful. (which is not to say impact is the only reason to boycott… I boycott just to ensure that I am not part of the problem, impact or not)

I have been boycotting Mars at least since 2018 when I found out they spent $½ million lobbying against GMO labeling in the US. Even if they were to turn that around and pay more money to lobby for GMO transparency, I would still boycott their vending machines. Not just because they got caught in a data abuse scandal, but because they lied about it, which means they cannot be trusted with technology.

[-] evenwicht@lemmy.sdf.org 7 points 2 years ago* (last edited 2 years ago)

Don’t Canadian insurance companies want to know where their customers are? Or are the Canadian privacy safeguards good on this?

In the US, Europe (despite the GDPR), and other places, banks and insurance companies snoop on their customers to track their whereabouts as a normal common way of doing business. They insert surreptitious tracker pixels in email to not only track the fact that you read their msg but also when you read the msg and your IP (which gives whereabouts). If they suspect you are not where they expect you to be, they take action. They modify your policy. It’s perfectly legal in the US to use sneaky underhanded tracking techniques rather than the transparent mechanism described in RFC 2298. If your suppliers are using RFC 2298 and not involuntary tracking mechanisms, lucky you.

[-] evenwicht@lemmy.sdf.org 16 points 2 years ago* (last edited 2 years ago)

You’re kind of freaking out about nothing.

I highly recommend Youtube video l6eaiBIQH8k, if you can track it down. You seem to have no general idea about PDF security problems.

And I’m not sure why an application would output a pdf this way. But there’s nothing harmful going on.

If you can’t explain it, then you don’t understand it. Thus you don’t have answers.

It’s a bad practice to just open a PDF you did not produce without safeguards. Shame on me for doing it.. I got sloppy but it won’t happen again.

view more: next ›

evenwicht

joined 2 years ago
MODERATOR OF