Posts
24
Comments
144
Joined
2 yr. ago
Restricting access to files within a user is why sandboxing is useful. It in theory limits the scope of a vulnerability in an app to only the files it can read (unless there is a sandbox escape). Android instead prevents apps from accessing other apps' files by having each app run as a separate user.
One way to keep the encryption keys encrypted at rest is to require the login password (or another password) to open the app, and use it to encrypt the keys. That said, if an adversary can read Signal's data, they can almost certainly just replace Signal with a password-stealing version.
While I don't disagree, it is possible that Kling picked up the writing style of he/him for unspecified gender. Kling is Swedish, and Swedish only recently made their gender neutral pronoun official. On the English side, it seems he/him for unspecified gender started getting pushed in the 1800s, though I can't find info on when they/them regained usage.
As a reminder, you can always just uninstall OneDrive and call it a day.
Until Microsoft takes that option away as well....
European Commission sends preliminary findings to Apple and opens additional non-compliance investigation against Apple under the Digital Markets Act
Not PeerTube, but he is on Odysee/LBRY.
On the one hand, having an AI generated alt-text on the client side would be much better than not having any alt-text at all. On the other hand, the pessemist in me thinks that if it becomes widely available, website makers will feel less of a need to add proper alt-text to their content.
The original research was regarding supercapacitors, not Lithium-ion. Based on the PNAS preview it seems it has to do with changing the design of a supercapacitor to increase charge rate.
Increasing capacitance (how much charge is stored to reach a certain voltage) or the voltage it is charged to would indeed increase the capacity. Putting several in parallel would work, as would making a bigger capacitor. The main problem as far as I can tell is that the energy density of even supercapacitors is low, so you'd need a much larger volume to have the same capacity (and thus a much thicker phone).
Alexandria and Stract use their own open source crawlers. Brave is also independent, if I recall correctly.
Although it is possible that some messaging apps send completely unencrypted messages, most (reputable) non-E2E apps are probably still using HTTPS. It just means that when the message arrives at the messaging app's servers, they can decrypt the message and store it in plaintext.
DDG's AI chat isn't a search engine. It's just a chat interface for GPT-3.5 Turbo and Claude, without any search access. It's also not very up to date.
GPT-3.5 Turbo:
Who is the PM of the UK?
As of my last update, the Prime Minister of the United Kingdom is Boris Johnson. Please note that political positions can change, so I recommend checking the latest news sources for the most up-to-date information.
Is Queen Elizabeth still alive?
Yes, as of my last update, Queen Elizabeth II is still alive.
The Claude version doesn't fare any better:
Is Queen Elizabeth still alive?
Yes, Queen Elizabeth II is still alive. She is the current and longest-reigning monarch of the United Kingdom, having ascended to the throne in 1952. As of 2023, she is 96 years old.
Are there any search engines other than perplexity that tie the sources to sections rather than just popping them all at the bottom? That always felt like the most practical layout for being able to easily cross-check information against their supposed sources.
Also, superior depends on the user and use case. One person might find that GIMP has all the tools they actually use in Photoshop, and another might find that the ones they use are missing from GIMP. Without knowing the audience, it's hard to know what they want to hear.
The example implemented in Mithril.js, for comparison.
fedoramagazine.org OMG! We’re at forty! (Announcing the release of Fedora Linux 40) - Fedora Magazine
Announcing the release of Fedora Linux 40 with a description of it's contents, features, and improvements.
It's mostly minor changes, but the most noticable one for me was that Gnome 46 now has expandable notifications, no extensions needed. (Making it impossible to read the full notification text was one of the design choices of all time.)
It's more the other way around. Both distribution on the App Store and through third parties will incur the fee. However, if you don't distribute on third parties, you can stay under Apple's old terms, avoiding the fee. It's a way of monetarily punishing third party app distribution.
www.theverge.com The free Delta game emulator for iPhones is live on Apple’s App Store
Delta has years of polish behind it.
Caveat: It isn't available in the app store in the EU, and is instead only available via the developer's marketplace, AltStore¹. As far as I can tell, this genuinely isn't because of greed, but because of a little detail in Apple's EU rules (possibly wrong):
[...] Developers can choose to remain on the App Store’s current business terms or adopt the new business terms for iOS apps in the EU.
Developers operating under the new business terms for EU apps will have the option to distribute their iOS apps in the EU via the App Store, Web Distribution, and/or alternative app marketplaces. [...] Developers who achieve exceptional scale on iOS, with apps that have over one million first annual installs in the past 12 months in the EU, will pay a Core Technology Fee. ²
The problem being, if you're under the old terms, there is no "Core Technology Fee." However, in order to dist
Email subscriptions also sometimes have that, with bonus points for several vague and similar sounding categories, and emails not mentioning what category they're in.
IIRC the main reason it isn't enabled by default is because >=1080p is only available via DASH. Normally Invidious can just point the client to fetch videos from Google's servers, but for technical reasons DASH requires the Invidious instance to act as a proxy (the client asks the instance for video data, then the instance fetches it from Google and sends it to the client). The net result is that watching 1080p streams requires much more bandwidth from the server.
As far as I can tell running xz directly should be fine, but for the extra paranoid check the version of the xz-utils package. If it is safe, it will be either less than 5.6.0, or it should be 5.6.1+really5.4.5-1 (xz 5.4.5 with a spoof version number to ensure compromised systems get the update).
Thanks, edited this into the post (along with the distros listed by LWN)
A backdoor in xz (current versions are impacted)
TL;DR: Update immediately, especially if SSH is enabled. xz versions 5.6.0 & 5.6.1 are impacted. The article contains links to each distro's specific instructions of what to do.
https://news.opensuse.org/2024/03/29/xz-backdoor/
Current research indicates that the backdoor is active in the SSH Daemon, allowing malicious actors to access systems where SSH is exposed to the internet.
In summary, the conditions for exploitation seem to be:
- xz version 5.6.0 or 5.6.1
- SSH with a patch that causes xz to be loaded
- SSH daemon enabled
Impact on distros
- Arch Linux: Backdoor was present, but shouldn't be able to activate. Updating is still strongly recommended.
- Debian: Testing, Unstable, and Experimental are affected (update to
xz-utilsversion5.6.1+really5.4.5-1). Stable is not affected. - [Fedora](https://www.redhat.com/en/blo
Apple will require notarization for apps from third party app stores, and will disable updates for apps installed via third party app stores if staying outside EU
As far as I can tell this basically means that all apps must be approved by Apple to follow their "platform policies for security and privacy" even if publishing on a third party app store. They will also disable updating apps from third party app stores if you stay outside the EU for too long (even if you are a citizen of an EU country, with an Apple account set to the EU region).
The idea that preventing app updates is in line with their claims of protecting security is utterly absurd. "Never attibute to malice what can be explained with stupidity," but Apple isn't stupid.
Alan Pope: "Multiple genuine-looking scam cryptocurrency miners and fake Bitcoin wallet applications have been published in the Snap store since 2018."
popey.com Exodus Bitcoin Wallet: $490K Swindle
tl;dr: A Bitcoin investor was recently scammed out of 9 Bitcoin (worth around $490K) in a fake “Exodus wallet” desktop application for Linux, published in the Canonical Snap Store. This isn’t the first time, and if nothing changes, it likely won’t be the last. This post turned out longer than I expe...
I used a sentence from the article as the title since I felt it represented the actual issue better, let me know if I should change it.
Essentially, Snap Store has basically no restrictions on publishing new applications, allowing for scammers to impersonate legitimate applications. In this case (and several times in the past) the target was a cryptocurrency wallet, resulting in ~$490,000 worth of bitcoin being stolen.
The "Safe" rating reminds me of this xkcd:
(For comparison, it seems being proprietary is an automatic unsafe rating for any application, which could be considered too extreme in the other direction.)
Sora: Creating video from text
There's also more example videos on the technical report
Personal take: If they didn't say how the videos on the page were created, I genuinely think that several of the AI generated videos could be passed off as being made with a camera or CGI (though there's probably still inconsistencies when looking hard enough).
chadaustin.me I Just Wanted Emacs to Look Nice — Using 24-Bit Color in Terminals
Thanks to some coworkers and David Wilson’s Emacs from Scratch playlist, I’ve been getting back into Emacs. The community is more vibrant than the last time I looked, and LSP brings modern completion and inline type checking.
TL;DR: Explanation of why the escape sequence for 256 color and 24 bit color modes are weird and can vary. \E[38:5:_n_m is technically the correct form for 256 color, but \E[38;5;_n_m is the form terminals more widely support.
I saw this on Hacker News today, and found the article interesting because I'd recently seen a Terminal Guide page on 256 color that mentioned how terminals support different versions of the codes (with semicolons being the most compatible). Semi-relatedly there's XTerm's criticism of Gnome Terminal and VTE (which is talks about compatibility in general).
scriptscrub (script output pruner / watcher)
Edit 2024-01-26: I ended up feature creeping it a bit. It can now be used as a less input filter, and asciinema-esque recording playback.
Original post:
A less bad name TBD.
This is a little program I made to convert script captures into properly laid out text. A lot of the behaviour still isn't quite right, but I'm pretty happy with it as a proof-of-concept.
Wine 9.0 released
gitlab.winehq.org Wine 9.0 · wine / wine · GitLab
The Wine team is proud to announce that the stable release Wine 9.0 is now available. This release represents a year of development effort and over...
Kakao Entertainment seems to be planning legal action against Tachiyomi (and forks)
We have collected personal details of most individuals involved in [Tachiyomi] and plan to proceed with strong legal and institutional responses against over 100 forked GitHub pages.¹
It sounds like Kakao Entertainment's "Global Anti-Piracy Task Force" (P.Cok) might plan on directly targetting the developers, rather than just the project itself ¹ [²][2]. Tachiyomi has in response removed all of their extensions except for selfhosted services [³][3].
I'm not too sure how much of a legal leg they have to stand on, but it isn't very surprising since Tachiyomi did have a lot of extensions for... dubious sources. It doesn't seem like they plan on adding back extensions that scrape official sources though.
Fossify Gallery is now on F-Droid, and Simple Gallery got removed due to a proprietary dependency
Fossify Gallery on the official F-Droid repo
The removal isn't directly related to the buyout/fork. Simple Gallery was taken off of F-Droid due to a dependency on the nonfree Google VR being discovered by IzzySoft¹ ². Fossify's fork has removed the dependent features to be compliant³.
Updates regarding the IndieLand / The Completionist charity fraud allegations
AFTD: Open Hand Foundation Provides AFTD $600K for FTD Research
IGN: YouTuber The Completionist Responds to Allegations of 'Charity Fraud' Against Him and Open Hand
Karl Jobst: The Completionist's Response is the Worst Thing Ever
TL;DR: Things look incredibly bad. The completionist has practically admitted to misleading donors, and it seems like he is expecting the IRS will get involved (IGN). It also seems he's threatening legal action for slander (Jobst).
The allegation that the money was not donated seems to be true (up until the AFTD donation in November of 2023) (IGN, AFTD). The Completionist has admitted he "mad
My opinionated list of FOSS applications
Edit: Updated the page with some cleanup and better navigation. It can now be filtered by OS and GUI/CLI.
Making posts for individual apps tends to only make sense when there's some actually notable event that takes place, so I figured why not just make a page that lists most of the open source applications that I use? So here is that listing. The webpage version has a nice table of contents for at a glance viewing; below is the page translated to Markdown, powered by Markdownr:
Writing
Joplin (Notes)
Website • Source Code • Get from F-Droid
I haven't been using it for very long. I used to use Logseq, but I've been finding that the more document/page oriented style of note-taking works better in some cases.
LyX (Math & Documents)
L
Nissan vehicles recalled due to zombie virus contamination
"My neighbor used to brag about his big diesel truck, but he's recently gone green. I think he turned over a new Leaf."
www.ign.com YouTuber The Completionist's Open Hand Foundation Accused of Keeping Charitable Donations - IGN
The Open Hand Foundation charity, which YouTuber The Completionist has an "active" role in, has been accused of keeping public donations despite claiming the money is being spent on dementia research.
Tl;DR: Funds raised during IndieLand were claimed to be going to charities, which is contradicted by Open Hand's tax filings showing the money never went anywhere.
fedoramagazine.org Fedora Linux 39 is officially here! - Fedora Magazine
We’re pleased to bring you Fedora Linux 39, our complete, community-built operating system. And stop by our virtual release party! It's free!
I rebased my Silverblue install yesterday. The most notable change in my opinion is the tweaks to the UI and theming of Gnome 45.
NileRed: Making bulletproof wood (based on a 2018 paper)
lbry.tv Making bulletproof wood
Head to https://brilliant.org/NileRed for a 30-day free trial + the first 200 people will get 20% off their annual subscription!
Any handwriting keyboards?
Are there any FOSS handwriting input methods? I'm looking for something like Gboard's; the closest I've found is Unistroke.