4
submitted 2 weeks ago* (last edited 2 weeks ago) by evenwicht@lemmy.sdf.org to c/isitdown@infosec.pub

The linked account is very busy.. almost 10,000 repos. Whoever the asshole is behind that attack, it’s the reason the public has lost the ability to create a new account on nixnet.

This matters in particular because Nixnet is the only gitea/forgejo host that has both a clearnet and onion host -- apart from disroot, but disroot’s onion is dysfunctional.

Note that the XMPP support channel is shut down because that was attacked as well.

3
submitted 2 weeks ago by evenwicht@lemmy.sdf.org to c/IRC@lemmy.cafe
13
submitted 2 weeks ago by evenwicht@lemmy.sdf.org to c/bugs@sopuli.xyz

The stock lemmy web client has had this annoying shitty bug as long as I remember. Not sure how or why ppl have tolerated it for so long.

I started this thread:

https://lemmy.sdf.org/post/52956979

Then I wanted to cross-post to !IRC@lemmy.cafe. The first defect is that it’s impossible to enter the full address of the target forum. Lemmy forces us to enter only part of the name and choose from a pull-down list. Then from there it’s not even smart enough to prioritise the user’s subscribed forums to the top. So entering “IRC” gives a long list of circle jerking forums, while the more simple match !IRC@lemmy.cafe is pushed off the list.

5

cross-posted from: https://lemmy.sdf.org/post/52956979

It looks like the most common method to use irssi over tor is to use a transparent proxy to tamper with network libraries, like torsocks or using proxychains4. Those approaches are useless when you also use Irssi with #Bitlbee, because bitlbee runs a local agent obviously becomes unreachable with torsocks in the loop.

So I must use a more complex approach:

$ socat -T9999999 -s TCP4-LISTEN:13999,ignoreeof SOCKS4A:127.0.0.1:libera75jm6of4wxpxt4aynol3xjmbtxgfyjpu34ss4d7r7q2v5zrpyd.onion:6697,socksport=9050,ignoreeof &
$ socat_pid_libera=$!
$ irssi
$ kill ${socat_pid_libera}

Then irssi is configured to point the libera network to 127.0.0.1:13999.

That’s the idea. There is a separate socat process for every IRC host I might reach, which is about a dozen in my case. Apart from ugly tediousness, it works for like 30 min on avg then dies. I believe that’s the nature of Tor. Circuits die and get replaced, and when that happens socat is left with a dead connection for some reason.

Is there a remedy? I there a way to make socat resilient to tor volatility?

3
submitted 2 weeks ago* (last edited 2 weeks ago) by evenwicht@lemmy.sdf.org to c/dabradio@feddit.uk

When a daylight savings change occured recently, all my DAB radios failed to update. An alarm clock would have been off by 1 hour. This is apparently because DAB radios only listen to the time signals that come from radio signals they are tuned into, thus only when playing.

All my humidistats and thermometers all had the correct time because they are always listening to time broadcasts.

My smartphones and PCs always have sufficiently correct time despite being offline because they have a locality configuration which implies when daylight savings is expected.

I think all my household DAB radios have alarm functionality, so it’s perhaps a widespread bug. Shouldn’t the radio software be able to detect the locality from the radio signals, and then use that to schedule time changes? Or short of that, it should be able to silently listen to a DAB signal from 1am to 1:15 am to set the clock from the signal.

Imagine as well that when the alarm triggers and DAB plays, the clock is then updated. So you get alarmed at the wrong time but imagine the confusion when the clock gets corrected before you look at it.

I also wonder what a disaster it must be when a DAB signal becomes too weak to make sound. Then what? Does the alarm clock try to wake us up with silence? Is this another case where FM is superior, or are any DAB radios smart enough to switch to a preprogrammed sound when there is no DAB signal?

1
submitted 2 weeks ago by evenwicht@lemmy.sdf.org to c/tor@infosec.pub

It looks like the most common method to use irssi over tor is to use a transparent proxy to tamper with network libraries, like torsocks or using proxychains4. Those approaches are useless when you also use Irssi with #Bitlbee, because bitlbee runs a local agent obviously becomes unreachable with torsocks in the loop.

So I must use a more complex approach:

$ socat -T9999999 -s TCP4-LISTEN:13999,ignoreeof SOCKS4A:127.0.0.1:libera75jm6of4wxpxt4aynol3xjmbtxgfyjpu34ss4d7r7q2v5zrpyd.onion:6697,socksport=9050,ignoreeof &
$ socat_pid_libera=$!
$ irssi
$ kill ${socat_pid_libera}

Then irssi is configured to point the libera network to 127.0.0.1:13999.

That’s the idea. There is a separate socat process for every IRC host I might reach, which is about a dozen in my case. Apart from ugly tediousness, it works for like 30 min on avg then dies. I believe that’s the nature of Tor. Circuits die and get replaced, and when that happens socat is left with a dead connection for some reason.

Is there a remedy? I there a way to make socat resilient to tor volatility?

2

The link goes to my findings, which are simply a count of CTAN listings.

3
submitted 1 month ago* (last edited 2 weeks ago) by evenwicht@lemmy.sdf.org to c/tex_typesetting@lemmy.sdf.org

I would like to find a good forge to host a latex package. Not Github. Fuck Microsoft.

CTAN.org shows the repo for each of the packages known to CTAN, but I am struggling to get a list of repos. It seems we can only see one repo at a time by visiting each package individually. There is no public dataset, correct?

It would be useful to see which forge is the most popular (after nixing github).. or whether there is a gitea forge that is TeX-focused.

There is an API to make it easy enough to harvest the CTAN DB → https://ctan.org/help/json

16

I bought a 2nd-hand Lenovo USB-C PSU (ADLX65YLC3D) which indicates a range of voltages (20v, 15v, 9v, 5v) on the label. Tried to charge a few different bicycle lights but the charging indicators did not light up on any of them. I almost tossed it because the 2nd-hand market I bought from is definately dodgy. But then I tried to power a Rasberry Pi and it seems to work on that. So wtf? An a/c adapter either works or it doesn’t. What would cause this: works on some devices but not others? The Rasberry Pi needs 5v just as the bicycle lights. That is the default voltage for USB-c.

20

I bought a 2nd-hand (but new-in-box) Kenwood radio that requires USB-C @ 9 volt 1.5A. It did not come with the original charger, so I bought a separate universal USB-C charger (145 watt, full range of voltages incl. 9v 3A). The charger is not Kenwood, but it should work, no? Because we have standards, right?

I plugged it in and LCD was dead for like the first 45min. Then it started to show the 3-stage charging indicator. The device would never power on. I assumed it had to be well charged, but then saw in the manual that it’s expected to function while it charges. It never got fully charged and the display eventually simply went off.

Day 2:

I plugged it in again and it was again dead for like 30 min before it started charging for hours. LCD went off again. Never made charging progress and never powered on.

Day 3:

I plugged it in and the LCD was off, as usual. But this time it stayed off. It no longer shows a charging indicator even when plugged in overnight. I wonder if the charger killed the radio (or the internal battery).

I went to a retail shop that has the same model radio on display. The display model had no juice but I plugged it in and it instantly indicated it was charging and also instantly powered on. Then I noticed the stock factory PSU is strictly 9v. WTF?

Is that compliant? USB PD chargers are supposed to default to 5v until the device asks for more. There is a handshake process, per the spec.

The handshake is importantIf a device needs 12v, for example, you cannot just take a 12v PSU and solder a USB-C connector to it. It will fry things because the device expects to start with 5v and negotiate for 12v.

So WTF is Kenwood doing making a USB-C PSU that is strictly 9v? Did they actually just hardwire a 9v PSU to USB-C connector and build a device that skips the USB PD handshake?

The manual says: only use the Kenwood PSU that is made for the device. When I read that shit, I thought: yeah yeah, the usual liability bullshit. They want us to be loyal and only use their products. But now I wonder if they did something seriously obscure to where it’s in fact true that only their 9v PSU will work -- and yet it does not seem to be sold separately.

Crappy design?It’s certainly indisputably a crappy design that the radio has an internal battery that (according to the manual) must never be replaced by the consumer. But the more interesting question is whether it’s a crappy design to produce a USB-C charger that is 9v-only. As well as whether it is a crappy design to produce a radio that requires a non-universal non-PD-compliant power source with a USB-C connector.

I brought the dodgy radio into the store and plugged it into the Kenwood OEM PSU. It’s still dead, which I suppose is concrete proof that the radio is toast.

11

I love DAB but it has problems:

  1. DAB tuning is slow. The receiver must collect data and spend 3+ seconds decoding before sound is output. Flipping through channels is annoying as opposed to FM. FM plays instantly.
  2. Multiple DAB radios simultaneously tuned to the same station results in unsychronized output. So forget about having radios in different rooms tuned to the same signal as you walk around the house (cleaning, throwing parties, etc). Also means a group of cyclists cannot simultaneously tune the same DAB station. FM is immune to this problem.
  3. Many stations share a single transmitter. When a signal goes bad for one station (e.g. bad weather), it’s also bad on ~20—30% of all other DAB stations. Many eggs in one basket.
  4. Weak DAB signals are intolerable. The sound cuts off and on repeatedly oscillating between silence and sound (as opposed to analog where there is a relatively steady amount of static that is often tolerable). E.g. In Brussels Bruzz on FM is decent but Bruzz on DAB rarely works. Some people report getting terrible DAB reception indoors.
  5. Vulnerable to Internet down time & cyber attacks, I suspect, because the DAB transmission tower likely sources its signals from the cloud.
  6. All receivers vulnerable to EMF pulses (thus solar events, nuclear war, and artificially generated EMF). No digital radios use vacuum tubes. Importance of functioning radio is greatly heightened in these scenarios.
  7. Most DAB radios do not feature manual tuning. And auto-tuning is unreliable. My current frustration is knowing that a good BBC4 signal reaches Brussels but none of my radios tune it. A Brussels retailer’s demo shelf had a DAB radio playing BBC4, but after auto-tuning the channel was lost.
  8. DAB probably does not work well in mountainous areas -- unlike AM, which will likely be ditched with FM.
  9. Reduced range regional applications possibly complicated or non-viable. E.g. some airports transmit their announcements about flight delays/cancellations over a limited range AM radio which only tunes as you approach the airport.

When stations have both FM and DAB transmissions, you can quickly channel surf on FM. When something good is heard, you can then switch to the DAB version. Newer cars with DAB+ devices automatically switch between DAB and FM variations of the same station. They will lose this advantage when FM is gone.

FM can also seek in realtime. That is, it quickly finds the next strong signal at a given moment. With DAB, you apparently must run a scanning procedure in advance and that takes time. Then those stations are stored but signal quality can change from one hour to the next. Or if DAB can seek for the next station in realtime, I’ve not seen that on any of my radios. In DAB mode, the seek functions are gone.

7

I have never seen an Attorney General take action on a consumer complaint. The best outcome I’ve seen is they make the complaint public record, then do nothing. Other AGs reply to say “not a violation of deceptive trade practices”. And some AGs do not respond at all - they just ignore complaints.

The FTC and CFPB are also options but those are also often deadbeat agencies particularly under republican governance.

What’s the recourse? Who generally oversees a state’s AG?

[-] evenwicht@lemmy.sdf.org 7 points 2 months ago

In those days, DOS was the OS. Windows and DESQview were just window manager apps that ran other apps.

[-] evenwicht@lemmy.sdf.org 13 points 9 months ago* (last edited 9 months ago)

If you think it’s over the money, you’ve missed the plot.

There is an ethical problem with how they operate. If you let them get away with their shenanigans, you support them. I will not. Fuck banks. And fuck their shenanigans. When they pulled this shit, it became my ethical duty to cost them. Their postage cost exceeds the value of the check, and their phone operator costs are high. So I’m happy to ensure their profit-driven exploitation backfires fully.

Mobile deposits: most banks have scrapped remote deposits via web. Most banks are happy to exclude those not on their exclusive smartphone ecosystem and try to push you into Google’s walled garden to obtain their forced-obsolescence app (so Google can know where you bank after getting a mobile phone subscription in order to activate a Google acct). Anything to cattle-herd boot lickers onto the bank’s closed-source spyware app is part of their game. The ethical problems with this could fill a book.

I tried hacking together an Android emulator to take a JPG of a check and emulate the camera within the android v/m using the linux gstreamer tool. I tried that back when I was willing to briefly experiment with a closed-source bank app I exfiltrated using Raccoon. Shit didn’t work with the banking app.. it was too defensive. I was lucky the app even ran on the emulator. Many banking apps detect the emulator and refuse to run.

Can’t reach an ATM for deposits from overseas. But also, when I am in the country, it’s a long drive from the house to an ATM.

So deposits by mail are the most sensible in my situation.

They fucked up. They made you whole.

The idiot who charged the interest was just the first fuckup. And it’s not a significant fuckup. The notable fuckup here is the deliberate corporate-wide policy in how they deal with small credits that leads to a paper check in the mail. It’s the shitty policy that disables them from fixing their fuckups. A fuckup is fine if they can fix sensibly. But this is not the case here.

IIUC, it’s what the Scots call a running goat fuck.. which is fuck up after fuck up on top of fuck ups.

[-] evenwicht@lemmy.sdf.org 8 points 10 months ago

Diligent consumers don’t do that. They pay their bill off faster than fees can be incurred. It’s the other consumers, the undisciplined and the poor, who get sucked dry by fees. These are not the demographic of international travelers. One demographic is subsidizing another.

The interesting thing is that if you’re in the diligent demographic, you can make the shitty bank lose money. Profit from those they exploit is the same whether you create a loss for the bank or not.

[-] evenwicht@lemmy.sdf.org 10 points 1 year ago

I’ll have a brief look but I doubt ffmpeg would know about DVD CSS encryption.

[-] evenwicht@lemmy.sdf.org 6 points 1 year ago* (last edited 1 year ago)

Knee-jerk fix: we make a FOIA request for the data that was removed.

But the shame of it is that FOIA reqs are not gratis, which means we have to pay again for the data. Elon’s DOGE office would just see it as a success that they are getting extra compensation for the data.

[-] evenwicht@lemmy.sdf.org 19 points 1 year ago* (last edited 1 year ago)

If anyone is writing or maintaining a playbook/handbook for how to run an authoritarian regime, removing open data would be a play to add.

[-] evenwicht@lemmy.sdf.org 8 points 1 year ago* (last edited 1 year ago)

It’s possible that it’s an accident, but unlikely IMO. The accidental case is overload and timing fragility. Tor introduces a delay, so if a server already has a poor response time and the user’s browser has a short timeout tolerance, then it’s a recipe for a timeout. Firefox does better than Chromium on this (default configs). But I tried both browsers. At the state level I think they made a concious decision to drop packets.

It’s also possible that they are not blocking all of Tor but just the exit node I happened to use. I did not exhaustively try other nodes but I was blocked two different days (thus likely two different nodes). In any case, this forum should help sort it out. Anyone can chime in with other demographics who are blocked, or tor users that are not blocked.

(edit) ah, forgot to mention: www.flsenate.gov also drops Tor packets.

[-] evenwicht@lemmy.sdf.org 8 points 1 year ago* (last edited 1 year ago)

infosec 101:

  • confidentiality
  • integrity
  • availability

If users who should have access (e.g. US taxpayers) are blocked, there is an availability loss. Blocking Tor reduces availability. Which by definition undermines security.

Some would argue blocking Tor promotes availability because a pre-emptive strike against arbitrary possible attackers revents DoS, which I suppose is what you are thinking. But this is a sloppy practice by under-resourced or under-skilled workers. It demonstrates an IT team who lacks the talent needed to provide resources to all legit users.

A mom and pop shop, sure, we expect them to have limited skills. But the US federal gov? It’s a bit embarrassing. The Tor network of exit nodes is tiny. The IRS should be able to handle a full-on DDoS attempt from Tor because such an effort should bring down the Tor network itself before a federal gov website. If it’s fear of spam, there are other tools for that. IRS publications could of course be on a separate host than that which collects feedback.

[-] evenwicht@lemmy.sdf.org 8 points 1 year ago* (last edited 1 year ago)

This is not a news forum. It’s a boycott organisation and support forum. Do your boycotts tend to last less than 1 year? That’s not really impactful. (which is not to say impact is the only reason to boycott… I boycott just to ensure that I am not part of the problem, impact or not)

I have been boycotting Mars at least since 2018 when I found out they spent $½ million lobbying against GMO labeling in the US. Even if they were to turn that around and pay more money to lobby for GMO transparency, I would still boycott their vending machines. Not just because they got caught in a data abuse scandal, but because they lied about it, which means they cannot be trusted with technology.

[-] evenwicht@lemmy.sdf.org 7 points 1 year ago* (last edited 1 year ago)

Don’t Canadian insurance companies want to know where their customers are? Or are the Canadian privacy safeguards good on this?

In the US, Europe (despite the GDPR), and other places, banks and insurance companies snoop on their customers to track their whereabouts as a normal common way of doing business. They insert surreptitious tracker pixels in email to not only track the fact that you read their msg but also when you read the msg and your IP (which gives whereabouts). If they suspect you are not where they expect you to be, they take action. They modify your policy. It’s perfectly legal in the US to use sneaky underhanded tracking techniques rather than the transparent mechanism described in RFC 2298. If your suppliers are using RFC 2298 and not involuntary tracking mechanisms, lucky you.

[-] evenwicht@lemmy.sdf.org 16 points 1 year ago* (last edited 1 year ago)

You’re kind of freaking out about nothing.

I highly recommend Youtube video l6eaiBIQH8k, if you can track it down. You seem to have no general idea about PDF security problems.

And I’m not sure why an application would output a pdf this way. But there’s nothing harmful going on.

If you can’t explain it, then you don’t understand it. Thus you don’t have answers.

It’s a bad practice to just open a PDF you did not produce without safeguards. Shame on me for doing it.. I got sloppy but it won’t happen again.

[-] evenwicht@lemmy.sdf.org 6 points 2 years ago* (last edited 2 years ago)

That would indeed be the practical answer assuming he has a credit card with those protections. Credit cards not issued in the US or UK often lack chargeback protections in non-fraud situations.

Note as well that even in the US the chargeback merely moves the money back to the consumer and does not affect legal obligations. If AXS were motivated, they could sue the customer in that case and likely point to a contract that indemnifies them from software defects and incompatibilities.

I think most banks have a threshold where they eat the loss. I did a chargeback once for around ~$20 or 30. Then I found out that the bank’s cost of investigating the chargeback exceeds something like $50, so the bank just takes the hit instead of the merchant. I found that a bit disturbing because a malicious or reckless merchant has no risk on small transactions. But in the case at hand for $200, the bank would likely clawback the money from AXS.

view more: next ›

evenwicht

joined 2 years ago
MODERATOR OF