[-] evenwicht@lemmy.sdf.org 1 points 1 day ago

Was your email verified? I’m confused because github never sent me anything by email after that step, and passkey being the highest security possible, your scenario should not happen.

MS does not get my IP address. I ensure every single login is over Tor. MS makes sure ~97% of logins require plaintext email 2FA. On a few very rare occasions over the past several years, I was able to login without the email bullshit. Maybe once per year I got lucky like that (which is perhaps comparable to the odds of getting a fresh new exit node that MS does not know about). I thought I was getting that shitty treatment for being on Tor but some non-Tor users told me they have to do the email verify every time as well, so I figured it was imposed on everyone not just Tor users.

[-] evenwicht@lemmy.sdf.org 2 points 1 day ago* (last edited 1 day ago)

Passkeys and/or 2FA.

It’s unclear what you mean. I have my username and passkey (1FA). I did not setup any kind of 2FA (I have nothing I care to protect on their shit site), but MS imposes email verification as a forced-2FA.

But I agree that a token in one email is insecure.

Not at all. Security policy is designed for a purpose. You can never have absolute security. You can only have something that is secure enough for a task and for the assets under protection in light of threat risks. The token via email was OVERLY secure in the case at hand -- and as a consequence security was lost (specifically, availability was lost, which is part of security).

Anyway ure Codeberg next time.

Impossible to use Codeberg to submit a bug report or comment on existing bug reports that are MS Github hosted. I would never voluntarily use MS Github for any project that I control.

I only use GH to collaborate on other people’s projects. And even then, I simply do not report many bugs because I cannot be bothered to dance for Microsoft and deal with their garbage. But now it looks like I will not be reporting /any/ bugs to any GH projects.

BTW, it’s bizarre that you suggest using Codeberg just after saying email-based 2FA is “insecure”. Codeberg allows 1FA (and rightfully so).

3
submitted 1 day ago* (last edited 1 day ago) by evenwicht@lemmy.sdf.org to c/infosec@infosec.pub

cross-posted from: https://lemmy.sdf.org/post/45188081

I am locked out of Github because the disposable email address I was willing to trust Microsoft with is no longer reachable. Every single login into GH requires an email confirmation. So if you cannot enter the 1-time access token, you’re fucked.

You might think a big corporation like Microsoft would not make such an amateurish mistake.

9

A long-ass time ago I had a big heavy laser printer that was well documented. It only had a parallel (LPT) port (to give an idea of the age). The documentation gave various control codes that could be sent to the printer. I vaguely recall sending plain text to the port and controlling things like font size using the control codes that were specified in the printer manual. I suppose that was a driver-free mode of operation.

Some LaTeX doc talks about how to produce a DVI file with printer control codes inserted wherever you want. So imagine if you have a cover letter followed by a document you intend to enclose with the letter. You would not generally want the first page of the document to print on the backside of the cover letter, but you might still want the doc to use full duplex mode. In principle, you could have the lp command send it in simplex mode but inject a control character that switches to duplex mode after the first page.

Of course you can inject a deliberately blank page but that’s sloppy. The digital version should have no blanks and the printed version should have blanks in certain places. The \cleartooddpage command is good for the latter but the former. I suppose the caveat is PDFs are disadvantaged and likely cannot handle printer control signals the way DVI can.

Printer manuals apparently no longer acknowledge the existence of control codes. So have we lost a capability because manufacturers insist on dumbing everything down for the stupid masses?

What about driverless printers? The CUPS docs mention that CUPS will become driverless. I really hope that does not mean CUPS is going to obsolete my current driver-dependent printer. But in any case, does driverless imply that there will be a standard for controlling printers, so e.g. we can send a signal mid-printjob to switch to full duplex?

8

Dumbing down of technology and competency over the past decade has led to a number of situations where sophisticated users are actually the ones being marginalised.

  • PDFs are being wrapped with some exclusive JavaScript garbage that only works for GUI users. Terminal users are losing the ability to simply download PDFs. Links to files with a “.pdf” extension are often not actually PDFs anymore - they are HTML w/js embedded masquerading as PDFs. Mozilla is on board with this deception.
  • Ethernet: public libraries have disabled ethernet ports, mostly. Some librarians even go apeshit when someone plugs into them (not understanding that it’s another way for wifi-less people to connect). You either subscribe to mobile phone service & disclose your number to pass the captive portal’s verfication, or you can fuck off, as far as the library is concerned. And yes, people are generally okay with /public/ libraries excluding people this way.
  • The value of compatibility is totally lost. Young network admins just assume everyone runs the same latest browser as them, and that everyone has a recent model smartphone. If you don’t buy a new phone every couple years, they believe it’s your fault you’re excluded. The concept of design and engineering for compatibility is a lost competency. The word “compatibility” is becoming history despite the decline of interoperability. Soon dictionaries will tag the entry for “compatibility” with “(rarely used)”.
  • We can no longer access public services like court system search tools, business registries, and public libraries book catalogs from a text terminal. The drive to dumb everything down has led to fancy UIs that work with fewer clients.
  • Access restrictions block access to resources unless you have a non-Tor IP address. Sophisticated users know better than to expose their personal IP addresses while also exposing to their ISP where they go. Sophisticated users are in such a small minority that it’s trivial to oppress them.
  • Using asymetric encryption to protect email payloads was a thing in the 90s. Who predicted that we would /devolve/ to 100% in-the-clear email payloads ~25 years later?

There are a lot more examples but to cut to the chase: How did we fuck this up?

Instead of teaching users to become sophisticated, as a society we just threw in the towel and decided we cannot teach people.. that they cannot even learn the speed and utility of terminals and keyboards. So we said “fuck it, give everyone a GUI and a mouse”. And so now we are at a point where even the technicians themselves seem to be helpless without a GUI and mouse, so they are oblivious to the demographic of users who are slowed down by their UIs.

Then we decided: since everyone has a GUI and a mouse, throw graphical CAPTCHAs their way. Surely no one uses terminals anymore, right? And why stop there.. get rid of documents (simple HTML).. make every webpage an /application/ instead, because surely everyone can run any random JavaScript we shoot their way.

This is not to say low tech users should be left behind. Indeed some people are truly incapable of terminals, scripting, Tor, PGP, etc. The problem is catoring for the tech illiterates exclusively results in disempowering sophisticated users.

It parallels the situation where classroom instruction moves so slow for some of the faster learners at the top of the class that they get bored and drop out of school, and waste their potential. I’m at a point where I’m fighting to retain an analog life because the digital workflows being pushed on us are so dumbed down that I just cannot accept being forced to click through shitty oppressive technology that forces interaction with tech giants and walled-gardens.

If I could choose between broadband with today’s garbage (ads, CAPTCHAs, Cloudflare, anti-bot, anti-tor, …) and 9600 baud dial-up to garbage-free text services that just work, I would seriously choose the latter. I am serious about that.

6
submitted 1 month ago* (last edited 3 weeks ago) by evenwicht@lemmy.sdf.org to c/tex_typesetting@lemmy.sdf.org

Anyone know of a template or sample doc that prints markers around the edge of an A4 paper?

Or even just a good centralised reference?

I can’t believe what shit results my searches are getting. Surely this must be a common need for millions of people. I am not going to go to the printshop, write down their printer model numbers, try to locate online manuals in an ocean of shitty manual sites, to try to dig up the printable area specs, which are likely untrustworthy anyway. I’ve done that before, and IIRC Canon specs were a lie.

Canons seem to have a quite large unprintable area. I know Ricoh does better. It would be useful to see a centralised table with the printable area specs of (at least) all the large industrial printers.

\documentclass[DIV=66, draft=true]{scrartcl} % The draft switch produces a ruler along the boundary of the printed space (which is controlled by the DIV value)

Update1: CUPS test print reveals unprintable area dimensions

It’s worth noting that the test page for CUPS gives “media limits” info. Which is vague but seems to correspond with the printer’s edge of printable area. It’s unclear if that comes from the printer driver or if the printer is somehow queried for that info.

This is of course only useful if you’re not using a print shop.

Update2: came up with code to generate a test print:

% Purpose:
%
% 1) Test whether the unprintable region documented in the printer specs is accurate.
% 2) If not, find the real dimensions.
% 3) Find the maximum DIV setting for the KOMAscript package that does not encroach into the unprintable area.
%
% Procedure:
%
% 1) Lookup the expected unprintable area dimensions for the printer under test.
% 2) Edit SetBgContents below to match the dimensions, which are added to (current page.*)
% 3) Trial and error/tuning: Set DIV=99 and compile. Then set DIV=9 and compile. Notice how the rectangle ruler gets smaller as DIV gets smaller. Find the max value for which the rectangle does not go outside of the violet rectangle.
% 4) With DIV at the max, fiddle with the size and position parameters of the large circle (in DeclareNewLayer). The goal is for the circle to touch the top and bottom edges of the paper.

\usepackage{scraddr}
\usepackage{scrlayer-scrpage} % needed for \cofoot
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc} % suggested to avoid ``OT1 encoding''
\usepackage{pict2e}
\usepackage{scrlayer}

\usepackage[firstpage=true, color=violet]{background}
\usepackage{tikz}
\usetikzlibrary{calc}

% from another suggestion below:
\SetBgPosition{current page.north west}% Select location
\SetBgOpacity{1.0}
\SetBgAngle{0.0}
\SetBgScale{1.0}
% \SetBgColor{black}

% The line width setting below specifies 1pt but it really looks thicker compared to other lines. Nonetheless, it gives a good thickness for the job.
\SetBgContents{%
  \begin{tikzpicture}[overlay,remember picture]
    \draw [line width=1pt]%,rounded corners=4pt,]
    ($ (current page.north west) + (4.2mm,-4.2mm) + (1pt,-1pt) $)
    rectangle
    ($ (current page.south east) + (-4.2mm,4.2mm) + (-1pt,1pt) $);
  \end{tikzpicture}}

% The following gives circles and must /follow/ the tikz stuff above.
\DeclareNewLayer[%
textarea,background,mode=picture,
contents={%
  \putC{\circle{\LenToUnit{\paperwidth}}}%
  \put(0.5\layerwidth,0.5\layerheight-3pt){\circle{\LenToUnit{\paperheight}-0pt}}%
}
]{showtextarea}
\DeclareNewPageStyleByLayers{test}{showtextarea}
\pagestyle{test}


\begin{document}
\phantom0 % There must be /something/ here or else 0 pages are generated. So we put an invisible phantom object.
\end{document}
7
submitted 1 month ago* (last edited 1 month ago) by evenwicht@lemmy.sdf.org to c/dabradio@feddit.uk

I was reading EU Directive 2019/882 which mandates accessibility requirements for products and services -- not because I am disabled or impaired but I’m always looking for legal angles to use against enshitified products/services or to liberate data. Not much interesting law except this:

Section IV
Additional accessibility requirements related to specific services

(b) Services providing access to audiovisual media services:
(i) providing electronic programme guides (EPGs) which are perceivable, operable, understandable and robust and provide information about the availability of accessibility;

IIUC, the EPG tech is already baked into DAB radio standards. But many broadcasters do not exploit the option, and even fewer receivers make use of it. In fact I have never seen a DAB radio that exploits EPG info (only album art and metadata for what’s playing at the moment).

It falls a bit short of being complete. Broadcast services may have a legal obligation to send EPG info, but I see no requirement for hardware to exploit it.

(hope no one is bothered by the post-brexit irrelevance of this.. it’s the only free-world DAB forum in the threadiverse)

1
submitted 2 months ago by evenwicht@lemmy.sdf.org to c/abop@slrpnk.net

cross-posted from: https://lemmy.sdf.org/post/41454997

Europe’s block on boycotting banks

No law directly prohibits boycotting banks AFAIK, but it’s effectively illegal to boycott banks because:

  • It is illegal to be paid wages in cash in some (all?) countries.
  • Some EU countries governments insist on tax payments by bank transfer. This is for all kinds of tax (income tax, property tax, and other forms of tax).
  • EU level: all cash transactions above €10k are illegal in the whole of Europe. Most of western Europe reduces that limit to €1—3k.

Belgium’s ban on boycotting energy suppliers

Offgrid energy is illegal.

Denmark: you cannot boycott email, as of this year

Denmark eliminates the postal service this year. This essentially means you cannot boycott email because the snail mail option is generally gone. Exceptionally, you can perhaps send letters using UPS or FedEx, but that’s not really affordable if you are boycotting email. Not sure if hand-delivery is an option. Consider Germany, where postal boxes are not always public access and couriers are given a key to the lobby. If that happens in Denmark, then hand-delivery cannot be relied on.

US ban on boycotting Israel

You can boycott the US in the US if you want, but you cannot boycott Israel if your job is from the US government. This tyranny was showcased in Texas when a Palestinian school contractor who taught kids how to speak Arabic had to renew her contract. The new contract required her to agree to not boycott Israel. She could not in good conscious sign such a bizarrely oppressive contract, so she was let go.

14

Europe’s block on boycotting banks

No law directly prohibits boycotting banks AFAIK, but it’s effectively illegal to boycott banks because:

  • It is illegal to be paid wages in cash in some (all?) countries.
  • Some EU countries governments insist on tax payments by bank transfer. This is for all kinds of tax (income tax, property tax, and other forms of tax).
  • EU level: all cash transactions above €10k are illegal in the whole of Europe. Most of western Europe reduces that limit to €1—3k.

Belgium’s ban on boycotting energy suppliers

Offgrid energy is illegal.

Denmark: you cannot boycott email, as of this year

Denmark eliminates the postal service this year. This essentially means you cannot boycott email because the snail mail option is generally gone. Exceptionally, you can perhaps send letters using UPS or FedEx, but that’s not really affordable if you are boycotting email. Not sure if hand-delivery is an option. Consider Germany, where postal boxes are not always public access and couriers are given a key to the lobby. If that happens in Denmark, then hand-delivery cannot be relied on.

US ban on boycotting Israel

You can boycott the US in the US if you want, but you cannot boycott Israel if your job is from the US government. This tyranny was showcased in Texas when a Palestinian school contractor who taught kids how to speak Arabic had to renew her contract. The new contract required her to agree to not boycott Israel. She could not in good conscious sign such a bizarrely oppressive contract, so she was let go.

4
submitted 2 months ago* (last edited 2 months ago) by evenwicht@lemmy.sdf.org to c/isitdown@infosec.pub
4
submitted 2 months ago* (last edited 2 months ago) by evenwicht@lemmy.sdf.org to c/infosec@infosec.pub

cross-posted from: https://lemmy.sdf.org/post/41050620

Spy chips are:

  • Intel CPUs after ~2008
  • AMD CPUs after ~2013
  • Arm CPUs (not sure when they started the trustzone stuff but likely around 2013 since AMD uses trustzone)

I believe IBM Power9 chips are spy chip free, but not sure about the successors.

Anyway, the question is about Apple chips. Web searches are lousy these days. I find nothing to confirm or deny the presence of management engines in Apple (Motorola?) CPUs.

Intuitively, I don’t think it would make business sense for Apple to do that because a majority of their customers are non-corporate individuals (unlike intel). OTOH, if that were sound logic then it would seem to contradict Arm chips which are also largely bought by non-corporate individuals.

Anyway, if anyone knows plz mention it here, ideally with a source.

Thanks!

1
submitted 2 months ago* (last edited 2 months ago) by evenwicht@lemmy.sdf.org to c/macosbeta@discuss.tchncs.de

Spy chips are:

  • Intel CPUs after ~2008
  • AMD CPUs after ~2013
  • Arm CPUs (not sure when they started the trustzone stuff but likely around 2013 since AMD uses trustzone)

I believe IBM Power9 chips are spy chip free, but not sure about the successors.

Anyway, the question is about Apple chips. Web searches are lousy these days. I find nothing to confirm or deny the presence of management engines in Apple (Motorola?) CPUs.

Intuitively, I don’t think it would make business sense for Apple to do that because a majority of their customers are non-corporate individuals (unlike intel). OTOH, if that were sound logic then it would seem to contradict Arm chips which are also largely bought by non-corporate individuals.

If anyone knows plz mention it here, ideally with a source.

Thanks!

1
1
submitted 2 months ago* (last edited 2 months ago) by evenwicht@lemmy.sdf.org to c/macosbeta@discuss.tchncs.de

I often acquire quite old hardware either cheap 2nd-hand or rescue stuff dumped on curbs typically w/out drivers or s/w. Ultimately all h/w will eventually be used on linux. But linux is often not ideal for testing to quickly assess whether something functions well -- obviously because very little hardware is designed for linux.

So before investing time researching linux drivers and hacks for whatever obscure thing I am dealing with, I need to quickly test whether the thing works without searching forums for what complex installation procedure worked in Bob’s basement lab.

Apparently Windows is very dicey with both forwards and backwards compatibility. I thought win7 would be good for testing because it’s historically close enough to XP that things designed for XP might run on it, yet just barely new enough that hardware ~2—10+ yrs old might likely run on it.

But it seems to be more of a shit show than I expected. Some drivers demand a specific version of Winblows. Matching OS version is often not good enough either because they demand a particular service pack, or specific DirectX or “.Net” version (what a shitty name, btw), which cannot be too old OR too new (e.g. old TomToms are extremely fussy about .Net version IIRC). So even though some form of Windows has the best official support for any given piece of hardware which underwent the most rigorous of its testing on Windows, using Windows for testing hardware is a shitshow nonetheless. Plus I make it worse because I insist on Windows boxes being airgapped, which limits me to drivers I can get off the web and usb-side-load.

A virtualbox with a few different Windows VMs is not good either because virtualisation brings its own baggage of issues that blow the idea of quickly testing arbitrary hardware to confirm that it works.

Is hackintosh a better solution?

I will not be buying any recent Apple hardware. Fuck that.. the cost defeats the purpose. I can (reluctantly) get really old Apple machines cheaply, but I suspect those tend to be incapable of any somewhat reasonably recent MacOS version. So I am tempted to try the hackintosh route on an old PC. Is it safe to say that MacOS drivers are more flexible across various MacOS versions than windows?

It has been decades since I tinkered with hackintoshes.. is it still practical these days? I get the impression that it might still be good for my purposes (but perhaps not in ~5+ years from now considering this).

[-] evenwicht@lemmy.sdf.org 13 points 4 months ago* (last edited 4 months ago)

If you think it’s over the money, you’ve missed the plot.

There is an ethical problem with how they operate. If you let them get away with their shenanigans, you support them. I will not. Fuck banks. And fuck their shenanigans. When they pulled this shit, it became my ethical duty to cost them. Their postage cost exceeds the value of the check, and their phone operator costs are high. So I’m happy to ensure their profit-driven exploitation backfires fully.

Mobile deposits: most banks have scrapped remote deposits via web. Most banks are happy to exclude those not on their exclusive smartphone ecosystem and try to push you into Google’s walled garden to obtain their forced-obsolescence app (so Google can know where you bank after getting a mobile phone subscription in order to activate a Google acct). Anything to cattle-herd boot lickers onto the bank’s closed-source spyware app is part of their game. The ethical problems with this could fill a book.

I tried hacking together an Android emulator to take a JPG of a check and emulate the camera within the android v/m using the linux gstreamer tool. I tried that back when I was willing to briefly experiment with a closed-source bank app I exfiltrated using Raccoon. Shit didn’t work with the banking app.. it was too defensive. I was lucky the app even ran on the emulator. Many banking apps detect the emulator and refuse to run.

Can’t reach an ATM for deposits from overseas. But also, when I am in the country, it’s a long drive from the house to an ATM.

So deposits by mail are the most sensible in my situation.

They fucked up. They made you whole.

The idiot who charged the interest was just the first fuckup. And it’s not a significant fuckup. The notable fuckup here is the deliberate corporate-wide policy in how they deal with small credits that leads to a paper check in the mail. It’s the shitty policy that disables them from fixing their fuckups. A fuckup is fine if they can fix sensibly. But this is not the case here.

IIUC, it’s what the Scots call a running goat fuck.. which is fuck up after fuck up on top of fuck ups.

[-] evenwicht@lemmy.sdf.org 8 points 5 months ago

Diligent consumers don’t do that. They pay their bill off faster than fees can be incurred. It’s the other consumers, the undisciplined and the poor, who get sucked dry by fees. These are not the demographic of international travelers. One demographic is subsidizing another.

The interesting thing is that if you’re in the diligent demographic, you can make the shitty bank lose money. Profit from those they exploit is the same whether you create a loss for the bank or not.

[-] evenwicht@lemmy.sdf.org 10 points 6 months ago

I’ll have a brief look but I doubt ffmpeg would know about DVD CSS encryption.

[-] evenwicht@lemmy.sdf.org 6 points 9 months ago* (last edited 9 months ago)

Knee-jerk fix: we make a FOIA request for the data that was removed.

But the shame of it is that FOIA reqs are not gratis, which means we have to pay again for the data. Elon’s DOGE office would just see it as a success that they are getting extra compensation for the data.

[-] evenwicht@lemmy.sdf.org 19 points 9 months ago* (last edited 9 months ago)

If anyone is writing or maintaining a playbook/handbook for how to run an authoritarian regime, removing open data would be a play to add.

[-] evenwicht@lemmy.sdf.org 8 points 9 months ago* (last edited 9 months ago)

It’s possible that it’s an accident, but unlikely IMO. The accidental case is overload and timing fragility. Tor introduces a delay, so if a server already has a poor response time and the user’s browser has a short timeout tolerance, then it’s a recipe for a timeout. Firefox does better than Chromium on this (default configs). But I tried both browsers. At the state level I think they made a concious decision to drop packets.

It’s also possible that they are not blocking all of Tor but just the exit node I happened to use. I did not exhaustively try other nodes but I was blocked two different days (thus likely two different nodes). In any case, this forum should help sort it out. Anyone can chime in with other demographics who are blocked, or tor users that are not blocked.

(edit) ah, forgot to mention: www.flsenate.gov also drops Tor packets.

[-] evenwicht@lemmy.sdf.org 8 points 9 months ago* (last edited 9 months ago)

infosec 101:

  • confidentiality
  • integrity
  • availability

If users who should have access (e.g. US taxpayers) are blocked, there is an availability loss. Blocking Tor reduces availability. Which by definition undermines security.

Some would argue blocking Tor promotes availability because a pre-emptive strike against arbitrary possible attackers revents DoS, which I suppose is what you are thinking. But this is a sloppy practice by under-resourced or under-skilled workers. It demonstrates an IT team who lacks the talent needed to provide resources to all legit users.

A mom and pop shop, sure, we expect them to have limited skills. But the US federal gov? It’s a bit embarrassing. The Tor network of exit nodes is tiny. The IRS should be able to handle a full-on DDoS attempt from Tor because such an effort should bring down the Tor network itself before a federal gov website. If it’s fear of spam, there are other tools for that. IRS publications could of course be on a separate host than that which collects feedback.

[-] evenwicht@lemmy.sdf.org 8 points 9 months ago* (last edited 9 months ago)

This is not a news forum. It’s a boycott organisation and support forum. Do your boycotts tend to last less than 1 year? That’s not really impactful. (which is not to say impact is the only reason to boycott… I boycott just to ensure that I am not part of the problem, impact or not)

I have been boycotting Mars at least since 2018 when I found out they spent $½ million lobbying against GMO labeling in the US. Even if they were to turn that around and pay more money to lobby for GMO transparency, I would still boycott their vending machines. Not just because they got caught in a data abuse scandal, but because they lied about it, which means they cannot be trusted with technology.

[-] evenwicht@lemmy.sdf.org 7 points 1 year ago* (last edited 1 year ago)

Don’t Canadian insurance companies want to know where their customers are? Or are the Canadian privacy safeguards good on this?

In the US, Europe (despite the GDPR), and other places, banks and insurance companies snoop on their customers to track their whereabouts as a normal common way of doing business. They insert surreptitious tracker pixels in email to not only track the fact that you read their msg but also when you read the msg and your IP (which gives whereabouts). If they suspect you are not where they expect you to be, they take action. They modify your policy. It’s perfectly legal in the US to use sneaky underhanded tracking techniques rather than the transparent mechanism described in RFC 2298. If your suppliers are using RFC 2298 and not involuntary tracking mechanisms, lucky you.

[-] evenwicht@lemmy.sdf.org 16 points 1 year ago* (last edited 1 year ago)

You’re kind of freaking out about nothing.

I highly recommend Youtube video l6eaiBIQH8k, if you can track it down. You seem to have no general idea about PDF security problems.

And I’m not sure why an application would output a pdf this way. But there’s nothing harmful going on.

If you can’t explain it, then you don’t understand it. Thus you don’t have answers.

It’s a bad practice to just open a PDF you did not produce without safeguards. Shame on me for doing it.. I got sloppy but it won’t happen again.

view more: next ›

evenwicht

joined 1 year ago
MODERATOR OF