Source: https://beige.party/@intransitivelie/117057396732763183

Why is everything screenshots these days :(

My first thought: If it isn’t always running it honestly not a major concern how much memory the weather app uses.

My second thought: 1.2GB WTF? Ok, that is way over the top. The executive in charge should be fired.

My third thought: 250MB? That is still a little unnecessary, even if it probably does fall under the “doesn’t matter” threshold.

My fourth thought: gnome-weather uses 180MB, not great, not bad.

I really don’t care what you use but I highly recommend picking something extensible or fully featured. No need to cut yourself off of valuable tools.

(Also I use Neovim BTW)

Me neither. I heard the hype so I went, I love me a good chicken sandwich. It was fine. But I don’t think I’ve gone again. Might if I was hungry and it was nearby. But it always has a line up the door and was packed. These people must see something that I don’t in it.

In theory it is safe. When a Nix package is built it isn’t “installed”. Unless root is running/installing random packages out of the Nix store there is no problem. As long as the user’s aren’t added to the trusted-users option they shouldn’t be able to cause any problems for other users.

However like any multi-user system you are sharing a Linux kernel. A kernel is a very complex piece of software with a huge attack surface. Privileged escalation vulnerabilities are commonly found. (This also applies to the nix-daemon, but it is a bit smaller attack surface but vulnerabilities are still occasionally found.) So you shouldn’t assume strong security isolation. I would say that a setup like this is acceptable for mostly-trusted people like coworkers or friends that are not expected to actively exploit vulnerabilities but definitely wouldn’t let random unknown users use the system.

So if you want strong isolation use a VM or separate hardware, but then you won’t be able to share the builds and packages defeating the point in this case.

Every team has a QA environment. The fancy ones have a separate production environment.

In most distros shutdown is a symlink to systemctl.

I’ve definitely ran into the situation where I fucked something up half-way though installing a new distro, then had to wipe it to go back to an old distro so that I could access the internet and find out what I did wrong so that I could start from scratch.

I hate doing debugging on my phone, but man sometimes is it better than the alternative.

I understand that this is frustrating but it is arguably the right option. If the correct owner can recover the account without TOTP then the TOTP isn’t really protecting the account.

Of course there are various ways to authenticate and it can make sense to have authentication to be (username + password + OTP) OR (email verification) but for a lot of people that email verification is a weaker link. It is more secure to only allow the former.

What I wish is that more sites would document their account recovery procedure. Often times they ask for a phone number for verification or notifications and that silently becomes a backdoor into the account. Even better would be if users can select what authentication combos are supported on a per-account basis (there are a few companies with “lockdown” settings that are a simplified version of this).

Of course it then becomes important to make it clear to the user “if you ever loose you X your account is forever lost”. It shouldn’t be surprise.

This advice feels like “Have you moved to the surface of the sun? Make sure to drink lots of water.” It’s not wrong, but also not particularly helpful. The only solution is to stop buying these things. Ideally take them back and get a refund if it isn’t too late.

CSS != HTML

I don’t think there is any way to play audio from CSS.

But I mean it is open source, you could patch it to do whatever you want.

I built Chibichange to have a way to conveniently deliver changelogs to Dawarich users

Have you considered just posting a changelog to your blog? That would be much more convenient than every app I run pinging me in its own way by phoning home to its server.

Yes, on one hand every commit to nixpkgs needs review (to some degree) on the other hand there are far too many committers to nixpkgs.

There are also gaps such as the bots to auto-merge packages with maintainer approval, so a simple attack looks like this:

1. Submit a package with you as a maintainer.
2. Create a new GitHub account and send a malicious update to that package.
3. Use a bot to merge with maintainer approval.

So nixpkgs is better than the AUR, but it isn’t great and unlike Arch has no separate official repos.

https://xkcd.com/1200/ comes to mind.

Games have no sandboxing anyways. They can access most of the data on the systems on which they run. Whether the game, crack or a HV crack makes little difference.

Sure, running a hypervisor or kernel level does allow them a bit more access, mostly around persistence. But I don’t think it is a huge difference to most people.

So IMHO you are already putting a lot of trust in any pirated software or crack, hypervisor bypasses are really just a small matter of degree. If you don’t trust the crack don’t run it. Easy as that. Or if you want robust protection run games on dedicated hardware with no personal information or in a dedicated untrusted gaming VM.

Because every three letter acronym means more than one thing. There are only 17 576 TLA so they are going to be heavily duplicated.

You should almost always spell out acronyms on the first use.

As much as I hate it, I’m 90% sure that they did some analysis (probably 10 years ago now) and found that there are enough people that don’t properly configure their computer that IP location is actually a better indicator than the Accept-Language header.

…which of course perpetuates the problem.

Oof, that is really not a good look. This should have been clearly disclosed and probably with a per-notification for the patch release.

There are a few main benefits.

1. For hardware-backed keys they can’t be stolen aside from physically stealing the hardware. So unless your machine has malware there is no way for an attacker to authenticate using them.
2. Even for software keys the site you authenticate to doesn’t learn enough to impersonate you. For example if for some reason your bank leaked some logs with PW + MFA someone could use that to log in as you (although admittedly short timeouts on MFA validity makes that window very small).
3. The browser ensures that you only authenticate to the correct domain. So it prevents phishing. (Although a password manager that only fills into the correct domain also accomplishes this.)

So I think if you are using unique passwords with an automated password manager the effective benefit is quite small. However for the “average computer user” who likely has less than 5 passwords that they use for everything it forces a pretty high base level of security.

I doubt Gaussian blur is an accurate model of real-world situations.

At the end of the day if you are worried about the codes being painted over print a few out and paint over them. Then scan with a variety of scanners.

If I had to come up with some more digital tests I would guess that a few of these are more representative of real-world situations:

1. Lower contrast. For example lighten or darken the whole code. This would simulate things like scanning in low light or with glare.
2. Block out sections of the code. This will test error correction levels and simulate partial damage or pockets of extreme glare.
3. Skew the code in various ways. This simulates the perspective shift of people scanning the code from an angle.

Ideally combine them in a bunch of scenarios then try to scan with a variety of scanner implementations.

No, the DRM wouldn’t work at higher levels so you would have the same requirements with regard to 4k.