moonpiedumplings

joined 2 years ago

I've been thinking about this for a very long time. The only platform that actually passes all of Soatok's tests is Simplex. But it's only briefly mentioned in the article about session

(For example: SimpleX was audited in December 2024. Don’t ask me about SimpleX, you have a goddamn report from professionals I respect right there.)

Wait no. I think only server builds are reproducible.

But there is an Android build on F-droid and F-droid does offer reproducible builds, so that's a way to get them.

A big problem, however, is that the creator of simplex is an antivaxxer, anti-DEI, anti-abortion, climate change denialist, etc. I can understand why people would be hesitant to push a platform like that, given they may also be pushing the creator's beliefs. I think it's okay to do the recommendation with a little asterisk of "please be aware that the creator of this app is crazy".

[–] moonpiedumplings@programming.dev 1 points 2 weeks ago (1 children)

This site doesn't seem to let me link to a specific comment: https://lobste.rs/s/aa7ske/anubis_now_supports_non_js_challenges

But on that page, the creator has a comment explaining that the meta refresh challenge does more than just reload the page and wait. They explain that it actually checks if the browser supports modern desktop browser features like gzip encoding, cookies, and more that's not documented.

[–] moonpiedumplings@programming.dev 1 points 2 weeks ago* (last edited 2 weeks ago) (1 children)

Is there a file transfer app that could transfer a file directly to a nearby

I don't think there's anything exactly like Apple Airdrop. Apple's airdrop uses a combination of bluetooth to find nearby devices, and a temporary wifi link to send them. It's a custom protocol, that only works because Apple controls the hardware, firmware and software, whereas on nonrooted android phones you simply don't have that level of control over the devices.

In addition to that, many wifi adapters only support being in one "mode" at once, so they are unable to be simultaneously connected to a network, and connected to another device via a direct conenction. Apple gets around this via hardware control, where they can ensure that all their devices, essentially have two wifi adapters inside them.

If you want an alternative to just send wifi files without an internet connection however, bluetooth supports sending and receiving files. Although, bluetooth is much slower than wifi, and you will have to pair the devices first.

EDIT: it looks like a commenter above has claimed that apple devices don't support bluetooth file transfer. So an alternative you could consider is bluetooth tethering, where you connect to a wifi network hosted over bluetooth, and then send files through there. But this requires even more setup, and I dunno if Apple devices support this as well.

Ubunti used to have a a tool that did something similar, but that tool is dead now.

I'm very happy to see a successor.

[–] moonpiedumplings@programming.dev 2 points 2 weeks ago* (last edited 2 weeks ago) (3 children)

No, they also added a non webassembly non js based challenge as well.

Anubis finally has support for running without client-side JavaScript thanks to the Meta Refresh challenge

[–] moonpiedumplings@programming.dev 5 points 3 weeks ago* (last edited 3 weeks ago) (2 children)

Although google happily lets you log into more than one account from the same browser, microsoft doesn't let you.

I used to, and still do use profiles, which are basically entirely seperate instances of firefox for each main account.

Back when I tried containers, they were really frustrating, because they would always ask which container I wanted a tab in. But that was a while ago, and they've probably fixed my annoyances so I will try them again sometime.

[–] moonpiedumplings@programming.dev 3 points 3 weeks ago (1 children)

Straying away from utilities, games are always fun to host. I got started with self hosting by hosting a minecraft server, but there are plenty of options.

[–] moonpiedumplings@programming.dev 0 points 3 weeks ago (1 children)

So instead you decided to go with Canonical's snap and it's proprietary backend, a non standard deployment tool that was forced on the community.

Do you avoid all containers because they weren't the standard way of deploying software for "decades" as well? (I know people that actually do do that though). And many of my issues about developers and vendoring, which I have mentioned in the other thread I linked earlier, apply to containers as well.

In fact, they also apply to snap as well, or even custom packages distributed by the developer. Arch packages are little more than shell scripts, Deb packages have pre/post hooks which run arbitrary bash or python code, rpm is similar. These "hooks" are almost always used for things like installing. It's hypocritical to be against curl | bash but be for solutions like any form of packages distributed by the developers themselves, because all of the issues and problems with curl | bash apply to any form of non-distro distributed packages — including snaps.

You are are willing to criticize bash for not immediately knowing what it does to your machine, and I recognize those problems, but guess what snap is doing under the hood to install software: A bash script. Did you read that bash script before installing the microk8s snap? Did you read the 10s of others in the repo's used for doing tertiary tasks that the snap installer also calls?

# Try to symlink /var/lib/calico so that the Calico CNI plugin picks up the mtu configuration.

The bash script used for installation doesn't seem to be sandboxed, either, and it runs as root. I struggle to see any difference between this and a generic bash script used to install software.

Although, almost all package managers have commonly used pre/during/post install hooks, except for Nix/Guix, so it's not really a valid criticism to put say, Deb on a pedestal, while dogging on other package managers for using arbitrary bash (also python gets used) hooks.

But back on topic, in addition to this, you can't even verify that the bash script in the repo is the one you're getting. Because the snap backend is proprietary. Snap is literally a bash installer, but worse in every way.

[–] moonpiedumplings@programming.dev 0 points 3 weeks ago* (last edited 3 weeks ago) (3 children)

Except k3s does not provide a deb, a flatpak, or a rpm.

I consider it a lesser evil to use curl | bash once to install Nix and then get the latest version of packages like rustup and deno than to use curl | bash twice or more to install software on their own (in addition to my opposition to developers installing software on users machines).

And again, cycling all the way back around to what I said in the earlier comments, you still have not provided an example of bash scripts you would like packaged that do stuff other than installing software. You talk about wanting a general repo of scripts, and I have also expressed my concerns about that, and the problems with losing it's portability when you need an extra tool instead of bash and curl/wget.

We are just rehashing the same points.

[–] moonpiedumplings@programming.dev 0 points 3 weeks ago (5 children)

Canonical's snap use a proprietary backend, and comes at a risk of vendor lock in to their ecosystem.

The bash installer is fully open source.

You can make the bad decision of locking yourself into a closed ecosystem, but many sensible people recognize that snap is "of the devil" for a good reason.

[–] moonpiedumplings@programming.dev 0 points 3 weeks ago (7 children)

I've tried snap, juju, and Canonical's suite. They were uniquely frustrating and I'm not interested in interacting with them again.

The future of installing system components like k3s on generic distros is probably systemd sysexts, which are extension images that can be overlayed onto a base system. It's designed for immutable distros, but it can be used on any standard enough distro.

There is a k3s sysext, but it's still in the "bakery". Plus sysext isn't in stable release distros anyways.

Until it's out and stable, I'll stick to the one time bash script to install Suse k3s.

 

Incus is a virtual machine platform, similar to Proxmox, but with some big upsides, like being packaged on Debian and Ubuntu as well, and more features.

https://github.com/lxc/incus

Incus was forked from LXD after Canonical implemented a Contributor License Agreement, allowing them to distribute LXD as proprietary software.

This youtuber, Zabbly, is the primary developer of Incus, and they livestream lots of their work on youtube.

 

This card game looks really good. There also seems to be a big, open source server: https://github.com/cuttle-cards/cuttle

 

Source: https://0x2121.com/7/Lost_in_Translation/

Alt Text: (For searchability): 3 part comic, drawn in a simple style. The first, leftmost panel has one character yelling at another: "@+_$^P&%!. The second comic has them continue yelling, with their hands in an exasperated position: "$#*@F% $$#!". In the third comic, the character who was previously yelling has their hands on their head in frustration, to which the previously silent character responds: "Sorry, I don't speak Perl".

Also relevant: 93% of paint splatters are valid perl programs

 

https://security-tracker.debian.org/tracker/CVE-2024-47176, archive

As of 10/1/24 3:52 UTC time, Trixie/Debian testing does not have a fix for the severe cupsd security vulnerability that was recently announced, despite Debian Stable and Unstable having a fix.

Debian Testing is intended for testing, and not really for production usage.

https://tracker.debian.org/pkg/cups-filters, archive

So the way Debian Unstable/Testing works is that packages go into unstable/ for a bit, and then are migrated into testing/trixie.

Issues preventing migration: ∙ ∙ Too young, only 3 of 5 days old

Basically, security vulnerabilities are not really a priority in testing, and everything waits for a bit before it updates.

I recently saw some people recommending Trixie for a "debian but not as unstable as sid and newer packages than stable", which is a pretty bad idea. Trixie/testing is not really intended for production use.

If you want newer, but still stable packages from the same repositories, then I recommend (not an exhaustive list, of course).:

  • Opensuse Leap (Tumbleweed works too but secure boot was borked when I used it)
  • Fedora

If you are willing to mix and match sources for packages:

  • Flatpaks
  • distrobox — run other distros in docker/podman containers and use apps through those
  • Nix

Can get you newer packages on a more stable distros safely.

 

cross-posted from: https://programming.dev/post/18069168

I couldn't get any of the OS images to load on any of the browsers I tested, but they loaded for other people I tested it with. I think I'm just unlucky. > > Linux emulation isn't too polished.

 

I couldn't get any of the OS images to load on any of the browsers I tested, but they loaded for other people I tested it with. I think I'm just unlucky.

Linux emulation isn't too polished.

 

According to the archwiki article on a swapfile on btrfs: https://wiki.archlinux.org/title/Btrfs#Swap_file

Tip: Consider creating the subvolume directly below the top-level subvolume, e.g. @swap. Then, make sure the subvolume is mounted to /swap (or any other accessible location).

But... why? I've been researching for a bit now, and I still don't understand the benefit of a subvolume directly below the top level subvolume, as opposed to a nested subvolume.

At first I thought this might be because nested subvolumes are included in snapshots, but that doesn't seem to be the case, according to a reddit post... but I can't find anything about this on the arch wiki, gentoo wiki, or the btrfs readthedocs page.

Any ideas? I feel like the tip wouldn't just be there just because.

 

I've recently done some talks for my schools cybersecurity club, and now I want to edit them.

My actual video editing needs are very simple, I just need to clip parts of the video out, which basically every editor can do, as per my understanding.

However, my videos were recorded from my phone, and I don't have a presentation mic or anything of the sort, meaning background noise, including people talking has slipped in. From my understanding, it's trivial to filter out general noise from audio, as human voices have a specific frequency, even "live", like during recording or during a game, but filtering voices is harder.

However, it seems that AI can do this:

https://scribe.rip/axinc-ai/voicefilter-targeted-voice-separation-model-6fe6f85309ea

Although, it seems to only work on .wav audio files, meaning I would need to separate out the audio track first, convert it to wav, and then re merge it back in.

Before I go learning how to do this, I'm wondering if there is already an existing FOSS video editor, or plugin to an editor that lets me filter the video itself, or a similar software that works on the audio of videos.

 

cross-posted from: https://programming.dev/post/6822168

I was watching a twitch streamer play the game pogostuck (A game similar in frustration and difficulty to Getting over it with Bennett Foddy — Don't Fall!).

They were also reading chat at the same time (usually out loud, as well). Multitasking.

Lots of sources (here's one) say that true multitasking is impossible. Rather, it's very fast switching, where there is a degradation of performance.

Knowing this, I naturally made it my mission to trip the streamer up with seemingly benign messages.

I was sharing some actual information about another streamer who beat another game, but a made a typo something like:

I remember a streamer beat the game a game ...

And I noticed how much more the streamer struggled to read this compared to previous, accidental typos (missing spaces, extra spaces, etc.). He spent a good 5 seconds on this message, and during the process, he fell really far. 😈

So I decided to do some testing. Inserting words, swapping them around, and whatnot, to see what tripped him up the most. Most typos didn't affect him.

There was one typo that tripped him again, where I said something like:

If it wasn't for a for

So it seems to be repetition? But I couldn't always replicate this with other forms of repetition.

Later on, I copied the two guards riddle, with an alteration:

One of the guards always lies and the other always lies as wekk. You don't know which one is the truth-teller or the liar either. However both guards know each other

Sadly, I didn't cut the part about "don't know which is truth teller or liar" out.

The streamer spent a good 5 minutes interpreting this puzzle, and eventually interpreting it as the original puzzle. Then, he was trying to solve a riddle, game, and read chat all at once.

He was stuck on the bottom until he gave up on the riddle (I revealed that I meant what I said when I said both guards lie). 😈

Anyway, that was a bit off topic but still relevant.

I'm wondering if any studies have been done on this? I know studies have been done on human's ability to read words with the letters partially scrambled, but what about typos?

How can I improve my distraction game (with plausible deniability of course)?

 

I was watching a twitch streamer play the game pogostuck (A game similar in frustration and difficulty to Getting over it with Bennett Foddy — Don't Fall!).

They were also reading chat at the same time (usually out loud, as well). Multitasking.

Lots of sources (here's one) say that true multitasking is impossible. Rather, it's very fast switching, where there is a degradation of performance.

Knowing this, I naturally made it my mission to trip the streamer up with seemingly benign messages.

I was sharing some actual information about another streamer who beat another game, but a made a typo something like:

I remember a streamer beat the game a game ...

And I noticed how much more the streamer struggled to read this compared to previous, accidental typos (missing spaces, extra spaces, etc.). He spent a good 5 seconds on this message, and during the process, he fell really far. 😈

So I decided to do some testing. Inserting words, swapping them around, and whatnot, to see what tripped him up the most. Most typos didn't affect him.

There was one typo that tripped him again, where I said something like:

If it wasn't for a for

So it seems to be repetition? But I couldn't always replicate this with other forms of repetition.

Later on, I copied the two guards riddle, with an alteration:

One of the guards always lies and the other always lies as wekk. You don't know which one is the truth-teller or the liar either. However both guards know each other

Sadly, I didn't cut the part about "don't know which is truth teller or liar" out.

The streamer spent a good 5 minutes interpreting this puzzle, and eventually interpreting it as the original puzzle. Then, he was trying to solve a riddle, game, and read chat all at once.

He was stuck on the bottom until he gave up on the riddle (I revealed that I meant what I said when I said both guards lie). 😈

Anyway, that was a bit off topic but still relevant.

I'm wondering if any studies have been done on this? I know studies have been done on human's ability to read words with the letters partially scrambled, but what about typos?

How can I improve my distraction game (with plausible deniability of course)?

 

cross-posted from: https://programming.dev/post/5669401

docker-tcp-switchboard is pretty good, but it has two problems for me:

  • Doesn't support non-ssh connections
  • Containers, not virtual machines

I am setting up a simple CTF for my college's cybersecurity club, and I want each competitor to be isolated to their own virtual machine. Normally I'd use containers, but they don't really work for this, because it's a container escape ctf...

My idea is to deploy linuxserver/webtop, as the entry point for the CTF, (with the insecure option enabled, if you know what I mean), but but it only supports one user at a time, if multiple users attempt to connect, they all see the same X session.

I don't have too much time, so I don't want to write a custom solution. If worst comes to worst, then I will just put a virtual machine on each of the desktops in the shared lab.

Any ideas?

 

docker-tcp-switchboard is pretty good, but it has two problems for me:

  • Doesn't support non-ssh connections
  • Containers, not virtual machines

I am setting up a simple CTF for my college's cybersecurity club, and I want each competitor to be isolated to their own virtual machine. Normally I'd use containers, but they don't really work for this, because it's a container escape ctf...

My idea is to deploy linuxserver/webtop, as the entry point for the CTF, (with the insecure option enabled, if you know what I mean), but but it only supports one user at a time, if multiple users attempt to connect, they all see the same X session.

I don't have too much time, so I don't want to write a custom solution. If worst comes to worst, then I will just put a virtual machine on each of the desktops in the shared lab.

Any ideas?

view more: ‹ prev next ›