Caligatio

The only thing I want (not need) that is unavoidably distributed via snap is Canonical's Livepatch. I don't want it enough to keep snapd around but it irritates me that I can't have a useful security feature.

A few months ago I started noticing failed login attempts on my non standard SSH port (> port 1024) so I moved it up a few port numbers. About 2-3 weeks ago, I noticed that it was getting hit again by failed login attempts. I then changed the port to the original and immediately started getting login attempts again... it kind of spooked me.

I thought about using fail2ban but every login is a different IP (using my eyeballs, I didn't parse the logs).

You can really go down the rabbit hole trying to figure out where the wheel+Alpine problem should be fixed. https://github.com/pypa/packaging-problems/issues/69 is a newer bug that is tracking this. Python relies on the "manylinux" specification (https://github.com/pypa/manylinux) which originally pinned build environments to CentOS 5, was updated in 2018 to use CentOS 6, and then updated in 2019 to use CentOS 7.

It's entirely possible that the Alpine user base isn't as big/important as I would think but this seems like something that needs to be solved.

The final output of Poetry is a wheel so it's not an egg/sdist/wheel competitor.

I'm a big fan of Poetry (I have a few commits in there) but it's not without its downsides.

At least a few months ago, you needed to install an entire compilation suite if you wanted to install a pure-Python source distribution (sdist) that was created with Poetry on Alpine. Somewhat by design, sdists created with Poetry require Poetry to install. Poetry itself is dependent on the cryptography package which, like all like all packages that use native-C extensions, suffers from a lack of musl-compatible wheels.

I recommend checking out the "Don't F$#k with Paste" extension which allows you to essentially control the setting per site: https://addons.mozilla.org/firefox/addon/don-t-fuck-with-pas...

There is also a version for Chrome: https://chrome.google.com/webstore/detail/dont-fuck-with-pas...

EDIT: Made the link locale independent and censored the name better.

I feel like it's really easy for these sites to have their cake and eat it too. Anything the company writes is considered publishing and anything someone not affiliated with the company says falls under platform.

If a forum's owner/admin participates in the forum, does that mean it's no longer a platform?

The Quest can link to your computer and essentially act as a Rift using a USB cable (needed to be USB 3.0, a recent beta update knocked that down to USB 2). I can easily see the Rift being removed from the product line in the future.

There's a huge difference between criticizing the people/science and criticizing the decision. We collectively need to have a real conversation about the pros/cons/risks of reopening parts of society. However, we're stuck in this rut of just calling the science bad (it's not) in order to avoid talking about the harsh reality of increased death rate.

While I'm excited that Poetry hit 1.0, I'm actually more excited about the fact more devs were added to the maintenance team and that it transitioned to a project namespace. Sébastien was previously the sole dev with commit access so I'm hopeful this gives the project a much healthier future.

* Still weak support for JSON (use Dict[str, Any])

Python 3.8 added TypedDict which finally helps this particular shortcoming.

I'm not a proponent of facial recognition at all and would not endorse it especially in this use case. But, if you believe the 17,000 hours/year number, that's ~$500,000/year (assuming $30/hour, random guess) in potential savings. Are you saying there can't possibly be system that could be designed to take attendance while not further infringing on a student's privacy that's cheaper than that?

What is probably happening is that this is some sneaky way of introducing facial recognition in schools and something benign like attendance was the excuse. That, however, is a separate conversation from my original post of how would you automate attendance without using facial recognition.

The 17,000 number does seem incomprehensibly high unless it's across the whole district. I'm not a teacher but I'm guessing the attendance gets compiled together and stored? Maybe this starts from hardcopy and includes all the work until its in the final digitalized format?

Speaking purely on the technical side of this problem: if you had to design a system to take attendance without some sort of human in the loop (e.g. a teacher), what other workable solutions are there? ID scanned by itself? A student could scan multiple IDs for their friends. ID + PIN? Due to the bursty nature of entering classrooms, that would cause a jam up at the PIN reader. Short of an ID shackle (that's a joke), nothing really comes to my mind that is foolproof.

Fun article about the Savannah at https://arstechnica.com/information-technology/2017/07/aboar...

Are you aware of the microG project? It is entirely possible to run Android apps without Play Services. Is it perfect? Far from it but it's disingenuous to say "Android is barely more Open Source than iOS".

If you want to add in the Play Store into the mix, things change slightly.

I don't think something like "foo bar %s".format(foobar) would work either in this situation. I think you're conflating format strings with the lazy evaluation associated with logging.

I am, however, in complete agreement that logging should adopt at least the same formatting used by .format

I still don't understand why disabling the MAC extension nukes your settings where seemingly every other extension keeps its settings when toggled.

To be clear though, FPI is the real weapon here against things like Facebook tracking.

I'm a huge fan of Firefox's first party isolation (FPI) and using Containers to control Google. FPI kills trackers and Containers allow me to stay logged into certain Google services without having things like my search history tracked.

Saying your physical address is private ignores the reality of the situation: it's on your driver's license that you hand over to people that you don't explicitly trust (getting carded at bars, airports, stores, etc), it's sold between companies that you don't give explicit permission, you give it out to receive goods, and there is no law to force people to remove your address (to your point, try to request removal from sites like 411.info). Given all of that, it's unfortunately a fantasy to think that this is somehow private.

Private information isn't private if you have to give it out.

I really don't know what it is going to take to shift people from thinking "oh no, my private data leaked" to "I really don't have any private data." Honestly, look at the stuff that was leaked:

- Names: this is public information

- Addresses: this is public information

- Bank Account Details: this is on every check you've ever written

- SSN: this is on so many applications for things and compromised so many times it can't be realistically called private

- Account Login Details: not to be pedantic but this is a shared secret and should be treated as such

I know there have been some rumblings about actually trying to change the financial identification system in the US but really this needs to be the focus. We've been pretending that we have any sort of "secure" identification system for too long and now it's finally catching up to us. Solutions exist for a majority of these problems:

- For stolen credit card numbers: Force the issuers to add one-time CC number generation and have that one-time number locked to a merchant. Discover had this years ago and got rid of it; I'm sure others had it as well. This effectively solves the online merchant problem. Things like Visa Checkout and Masterpass also can help here by eliminating the need to give merchants your actual number (as can Android Pay, Apple Pay, Samsung Pay, PayPal, etc)

- For stolen credit cards: Actually change over to chip and pin

- For online financial identification: Issue smart+national ID cards like Estonia that can provide digital authentication. Is it perfect? No. If people don't like the concept of a smart+national ID card, put the risk of doing anything online on them. https://www.login.gov/ is a baby step in this direction.

I don't remember how I stumbled onto it but I ended up using Pledgie who then uses PayPal under the hood... it sucks. Pledgie takes some reasonable cut but then PayPal considers it a business transaction and takes like a flat $0.30. Remember when I said a few low dollar amount donations? I end up losing 20-30% due to PayPay/Pledgie overhead.

I then tried adding a Bitcoin donation link in markdown in my README (before the transaction fees got silly) but the GitHub and NPM don't know what to do with it.

I maintain a moderately successful JavaScript library and there are a few things that absolutely make my day: people sending me an email telling me how they're using it (I see dependent projects on NPM but I love hearing about cool things!), people saying thanks, and people sending me any donation. I've had a handful of people send me a few bucks over the years and I was absolutely floored each time. In total I might be able to buy myself a beer with the donations but it means a surprisingly large amount knowing someone is willing to go through the hassle to send you money.