So most modern activitypub servers backfill threads and profiles. My single user instance processes 30000 notes a day. If I was actually trying, I’m sure it’d be easy to grab much more while appearing well behaved.
How does that help? My personal instance currently has a database of several million posts thanks to the various Mastodon relays. I don't need to scrape your instance to sell your posts. I don't, of course, but it'd be easy for some company to create friendlycutekittens.social and just start collecting posts. Do you really have time to audit every instance you federate with?
So does Reclaim The Internet still involve purchasing an advertising company, letting multiple employees go, and generally behaving like a VC-backed startup? Just checking!
When watching a movie or tv show by ourselves, blind people can’t see the picture. So unless we are watching with a sighted friend, we would rather save on storage and bandwidth by only downloading the audio.
Audiovault.net is the website you want. Made by and for blind folks, it has thousands of AD tracks in mp3 format. You should be able to just sync them with the video. Though blind folks never bother; we only care about audio anyway.
From the article:
The TLS-SNI header is used by CDN servers to route requests based on the Server Name in the header. However, a typical front end server, or even a load balancer (LB), belongs to a single app or organization, and does not typically need to handle the SNI header. The easy and reasonable way to configure TLS certificates on such a server, is to either: Serve all requests with a single TLS certificate that has SANs (Subject Alternative Names) for all the domains that are used Have multiple certificates, chosen according to SNI, with one of them as the default. In both of these common cases, sending a HTTPS request directly to the IP of a front end server, without any SNI, will present us with a default server certificate. This certificate will reveal what domains are being served by this server.
So apparently the real issue is that people aren't using SNI correctly.
The tech blog is much better: https://www.zafran.io/resources/breaking-waf-technical-analysis
It boils down to scanning all IPV4 space, and grabbing the SSL certificate returned by any webservers on port 443. If the server is incorrectly configured the fields in the SSL cert will tell you what domains it serves. And using Certificate Transparency logs to figure out what domains you want to target. I wouldn't really call this a flaw that breaks anything. It's just a byproduct of how SSL, IPV4, and WAFs work.
Start with the first two episodes of season 1; you need them for worldbuilding. Strange to say about a show like this, I know! But it's true. If I were you, I might consider skipping to Dragonshy; it was my favourite episode in s1. Then maybe Winter Wrap-up, Call of The Cutie, and Look Before You Sleep. If you're loving the show, then just watch it all! But if you didn't find anything to like in those episodes, give up. MLP isn't for you.
Let me check out the Lemmyverse website for accessibility, and if it doesn't have any major problems, I'll add it! Thanks! I'd heard of LemmyApps, but I was unaware that it allowed filtering by accessibility. I'll also go and add that.
We had some hosting problems back in September. However, we have that resolved, we've vastly improved the reliability of email delivery, and in more exciting news, we have a designer working on a more accessible custom theme that we intend to contribute to the Lemmy community overall as well as make our default. It's taken us a while, but better email deliverability and a custom theme were the two things on our list we felt we needed before we could start actively promoting the instance. This post was one of the steps in preparing for that promotional work.
Proof of work is pretty good. Also, email and phone number verification can reduce the need for this type of verification at all. Similarly, punting the problem to someone else and allowing login via Apple/Facebook/other open ID provider can help. Apple also has a system for verifying that a request comes from a real apple device that services like cloudflare use. But if you have to do it yourself, the key is offering a visual captcha, an audio captcha, and a text-based captcha. Also, try to maintain a trust score for both accounts and IP addresses. Captchas have to made so difficult today to keep out the bots that you need to make sure your users only have to solve them once. As well, if I know the captcha will only happen once, while it’s not ideal, I could request help with it. But if the captcha is on every login, or once a day or whatever, I can’t. Between proof of work, rate limiting, and email verification, and trust scores, 99 percent of captchas aren’t needed and aren’t doing anything. So the first step is understanding the problem you’re trying to solve, and determining if a captcha is the best way to solve it at all. It probably isn’t.
All responsible server admins have them defederated. Hate speech and genocide denial, that is almost certainly against the law in Canada, Germany, and other places. We defederated lemmygrad for the same reason.