jesprenj

I guess one could choose between v4 or v6 but not both at the same time (dual stack). My mobile ISP also does it this way -- you either use IPv4 only on mobile data or IPv6 only with NAT64 and DNS64 to reach v4 hosts.

For using google without it's UI, you can use SearXNG: https://github.com/searxng/searxng

... or this little PHP script I made: http://ni.4a.si./sijanec/r/tree/prog/sear.php/index.php demo: http://searphp.4a.si.

It would be pretty useful if we could somehow convince birds to relay our messages using birdsongs -- just use a speaker to transmit a message, encoded in birdsong with some special preamble header, and it will get broadcast or unicast to the desired destination bird that happens to be located near a microphone that receives this message. Could this scheme beat IPoAC? Maybe if we manage to reverse engineer birdsongs well enough, BGP could be ported to birds!

Maybe they got some special permission?

> Free to use under the CC BY-SA 4.0 license

Really? Can you even copyright a font? As far as I know, fonts can't be copyrighted, meaning they can be used by anyone without needing a licence. IANAL, but it seems like font users aren't required to comply with attribution and share-alike requirements of the CC licence.

I panicked a little when I heard the news as I run a cupsd open on the Internet. But as it turns out, the issue is misrepresented in headlines, just like here. This is not an issue in the core cupsd, but in a separate package/component, called cups-browsed. My distribution of choice for servers, Gentoo Linux, ships cups-browsed in a separate package which I had not installed, meaning I, as well as most other cups users that did not install this additional package, am not affected by this bug.

Saying that all systems running cups can be hacked is a misrepresentation of the scale of the issue.

Was the spacecraft from the event described in the article an actual spacecraft in space or a simulation of a space mission on the ground?

I disagree. GPON is WAY cheaper to deploy.

Where I live, you can replace an ONT easily. GPON in my small country is only secured with the ONT serial number and a static well known password.

From a security perspective, that's perfectly fine. No one is going to hack their own neighbours or dig out fibre cables. From a usability and freedom of hardware choice, that's even better -- SN is written on the ONT and can be easily input into another ONT, unlike passwords and encryption keys that are largely unnecessary and only complicate things, providing little security because no one will hack GPON infrastructure.

You run into problems, however, if you are subscribed to telephony. It's possible that the ONT will handle VoIP for you and provide you just with a RJ11 jack. In that case, you can't easily swap your ONT. But for IPTV and Internet, it works out of the box.

> But for the one I'll have hanging in my office, I have loftier goals. With swap enabled, the kernel sources can actually be built right on-device. It will take some number of years. The partition where the kernel lives is /dev/pvd2 and is mounted under /boot. The device can build its own kernel from source, copy it to /boot/vmlinux, and reboot into it. If power is interrupted, thanks to ext4, it will reboot, recover the filesystem damage from the journal, and restart the compilation process. That is my plan, at least.

Doesn't getaddrinfo respect /etc/resolv.conf? So LittleSnitch should install itself there if it wants to be used by getaddrinfo.

Besides, apps can always make direct lookups to a resolver of their choice, bypassing any resolver hints of the operating system.

How do they get $1 million+ from a single video? AdSense or sponsors?

Or the actual PDF file instead of Google docs: http://splet.4a.si/dir/How-To-Succeed-At-MrBeast-Production....

I think they still have a contributor licence agreement, meaning every contributor transfers the copyright of his contribution to the owner of Elasticsearch.

It does not seem to support IDN domains.

I actually meant DNS prefetching, not HTTP prefetching. I don't think browsers will prefetch (make HTTP GET requests before they are clicked) links by default (maybe slack does to get metadata), but they quite often prefetch the DNS host records as soon as an "a href" appears.

In case of DNS prefetching, a wildcard record wouldn't be needed, you just need to control the nameservers of the domain and enable query logging.

But I'm not sure how do browsers decide what links to DNS prefetch, maybe it's not even possible for links generated with JS or something like that ... I'm just guessing.

Wouldn't it be better to put "confetti" -- the API key as part of the domain name? That way, the key would be leaked without any required clicks due to the DNS prefetching by the browser.

ln -s /root /home/root

What's next? A list of all bitcoin private keys: https://privatekeys.directory/keypage/1?coin=btc

ALL CREDIT CARD PIN CODES IN THE WORLD LEAKED: https://pastebin.com/Nn2ZcdfC

Why does this work? How does archive.ph bypass the paywall?

It took me a shockingly long amount of time before I realized it was silly to have a username on my machines. I am the only person using this, why am I typing unnecessary cruft? Username switched to “root” on all my machines and I remove the username from PS1. /root is shorter than /home/a (:

Freezing? Wouldn't it boil instead due to the low pressure?

> The additional time to deliver a document over HTTPS is imperceptible to humans on any remotely modern (last ~15 years) hardware on almost any connection outside of the absolute worst network environments.

    b:~[0]# time curl --no-progress-meter --output /dev/null http://noiseprotocol.org
    
    real    0m0,353s
    user    0m0,004s
    sys     0m0,003s
    b:~[0]# time curl --no-progress-meter --output /dev/null https://noiseprotocol.org
    
    real    0m0,705s
    user    0m0,041s
    sys     0m0,006s
    b:~[0]#

It takes double the time to load the page with TLS. No matter the hardware and network (tested with high bandwidth low latency not congested FTTH) you can't go faster than the speed of light and the additional TLS handshake does not make loading any faster.

Notice also the increase in CPU time when using HTTPS (user field in time).

> That it doesn't receive sensitive data is moot -- it sends what can easily be considered sensitive data. White papers about encryption and obfuscation protocols are often of interests to, for example, political dissidents both in countries where they're at risk and abroad, and they may be targeted in either case. Modern extensions like ECH (which is beginning to be widely available[0]) offer a degree of protection against that, and prevent snooping in general.

AFAIK ECH only works with a central MiTM proxy like cloudflare, not with a selfhosted page. It's debatable what privacy implications hosting using cloudflare has. You cannot prevent the hostname from being sent in plaintext to a selfhosted third party website if you want SNI, which servers often expect clients to send. EDIT: ECH is disabled globally on Cloudflare currently: https://developers.cloudflare.com/ssl/edge-certificates/ech/

Whenever you connect via TLS, Firefox sends an unencrypted OCSP HTTP request to the CA servers that includes the hostname. Yet another thing that slows you down when requesting websites protected by TLS that wasn't measured in my curl benchmark (unless OCSP stapling is used, of course).

> Political dissidents aside, it's another channel advertisers can use to see your browsing habits and build up a targeted advertising profile. There have been isolated incidents where ISPs were caught injecting ads into users' pages; I think a more realistic issue would be ISPs auctioning off browsing histories.

ISPs can only do that if you allow them to. Where I live, they can't; it's forbidden by law and network history is considered personal data. Injecting ads is also illegal where I live; ISPs tampering with anything above layer 3 is not allowed as per Internet neutrality laws here.

Just the IP address is enough to figure out someone is browsing the Noise Protocol website: Try visiting http://138.68.46.44

> I wouldn't have noticed that that document is plain-HTTP if not for the fact that I decided to toggle Firefox's HTTP-only mode earlier that day just to see what impact it has on day-to-day browsing.

Maybe set this your browser up so that it automatically changes the protocol to HTTPS from HTTP without failing? This way, you wouldn't've noticed any issue at all.

Bottom line: There is no reason to force users to use TLS on noiseprotocol.org and doing so would be worse for users of the website without providing much benefits.

> For some reason, this page doesn't have a 301 redirect set up when you access the plain HTTP page.

My opinion on the topic:

I think that's perfectly reasonable. Why would they want to force users to use TLS? I don't understand the appeal of HTTP->HTTPS 301 redirects on every single website.

A static document is served on the linked page, no passwords are transmitted. Plaintext is perfectly enough for fulfilling requests for this document. TLS would just use more processing power and time to deliver the document.

If the website visitor is interested in downloading the document encrypted, he is free to use the HTTPS protocol with a browser setting.

If the website publisher is interested in sending the document encrypted, he is free to use HSTS or the redirect hack you described.

But I don't see any reason why noiseprotocol.org would like all connections to them being encrypted; they are not an online bank. Enforcing TLS just prevents visitors without TLS support from being able to view documents on their website.

> My original project had all sorts of complex stuff for detecting hallucinations and incorrect, spurious additions to the text (like "Here is the corrected text" preambles

> asks it to correct OCR errors

So, if I understand correctly, you add some prompt like "fix this text" and then the broken text?

Why don't you do it differently, by not using a chat model but instead a completion model and input the broken OCRd text in the model token by token and then get next token probabilities and then select the token that matches the original document as best as possible, maybe looking 3-5 tokens in advance?

Wouldn't this greatly decrease "hallucinations"?

I'm not trying to insult your approach, I'm just asking for your opinion.

Aha, thanks for that, the paper seems to reason better at first glance, I'll read it.

You mention sybil attacks on Kademlia, especially those that arise because nodes may set their ID and "camp around" some known key in the hash table. How is this addressed here? By glancing over the standard draft, I see the identifier is just a SHA-512 of the pubkey. Wouldn't it be feasible to bruteforce the first some bits of the key and "camp around" some keys a malicious sybil actor wants to deny service to?

Great, I stand corrected! I still don't know how they convince firefox/chromium to use a pipe as a websocket transport layer.

This is not always possible as some machines don't support network namespaces, but it's a perfectly valid solution. But this solution is Linux-only, do BSD OSes like MacOS support UID and NET namespaces?

Yes, but where did sqrt come from that the parent commenter mentioned?