justusw

Agreed, it doesn't offer a root cause analysis. Remedies are good but how do you prove that it won't happen again? Remember that these are never singular incidents but part of a bad security culture.

The author of the article linked here demoed his Onion service-based WordPress app this year at DWeb Camp:

https://onionpress.org/onionhome/

The extra trick that Brewster uses here is that by sharing your Onion service's private key with someone you trust, they can take over hosting your website when your computer goes offline.

Thanks for the reference links. I blocked RTC connections initiated on the SBI Shinsei banking log in page at bk.web.sbishinseibank.co.jp with the following custom uBlock Origin filter:

    bk.web.sbishinseibank.co.jp##+js(nowebrtc)

You can see that it works because typing `new window.RTCPeerConnection()` in the browser console prints this:

     Document tried to create an RTCPeerConnection:  undefined

Which comes from uBlock, see https://github.com/gorhill/uBlock/blob/5efb8ee4891c09720011e...

Edit: I gave a shout-out to your comment on the blog post linked in this submission. Thanks again.

Perhaps someone here knows how to make uBlock Origin block STUN/TURN connection attempts to domain names that are in its block list?

Same here with a Japanese ISP. Is this related to the AWS outage?

I've finally fixed a bug in Hugo that I've told myself to fix for a while now. The experience was pleasant and I want to share my experience with the review process with everyone.

Thank you for the link, I'm quite intrigued by myba. At least on macOS, I spend way too much time finding workarounds, even with borgmatic.

Can confirm, I've got a DKIM passing email today asking me to sell my "Illuvium". DKIM auth result header:

> Authentication-Results: spamfilter01.heinlein-hosting.de (amavisd-new); > dkim=pass (2048-bit key) header.d=autodesk.com

For this DKIM-Signature:

> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=autodesk.com; > h=from:subject:mime-version:list-unsubscribe:content-type:reply-to: > cc:content-type:from:subject:to; > s=s11; bh=...

MTA:

> Received: from ec2-3-8-140-122.eu-west-2.compute.amazonaws.com (unknown) > by geopod-ismtpd-13 (SG) with ESMTP id n5WDORJ6Taauv7FuUNA9Ug

I wonder if just their DKIM selector got stolen or someone owned their AWS accounts as well?

Chiming in to say the same.

I was there in their earlier years. Ecosia set the standard for me what an ethical company should be like.

And hey odiroot ;)

Funny that you mention it, I also went Homebrew -> MacPorts -> Nix. Homebrew had analytics and broke versions too often. MacPorts is way more stable, but some niche packages would not build well, and I had terminfo issues with tmux.

Nix allows me to override most of that, and I can share home manager config with my Debian workstation.

Thanks for your feedback. You are right. I've lowered the minimum version to Python 3.10. If you want to give it another try, the package is on PyPI now.

Good one! That's pretty much how I started and then ended up with Pomoglorbo instead. I have wanted the timer to integrate with timewarrior, and automatically time what I am working and also keep track of my breaks. Another issue is that when your computer sleeps, you'd want to keep counting seconds in the background, so time.sleep(1) will lose accuracy very quickly.

Thanks! Nice find. I've just fixed the j/k mixup and made version 2024.6.19.3 available on PyPI / codeberg (https://codeberg.org/justusw/Pomoglorbo)

Apologies if this sounds completely defeatist, but wouldn’t it be better to just mostly get rid of colors in product design? That is, yes, you absolutely want to use color for branding and recognizability, but given the fact that widely deployed color models and accessibility metrics do not completely reflect the reality of human color perception, using them to convey information is just not worth the trouble.

Again, there are exceptions to everything, but WCAG 2.1 says UIs shouldn’t fully rely on color to convey information (please correct me if I am wrong), the same goes for icons.

I can see how other sectors and industries will treat this differently (think color bands on resistors or topographical maps), but for me, creating a SaaS product with a focus on accessibility, I have almost completely given up on this topic.

Charts, statistics and so on are way easier to make accessible when using good old HTML tables.

The increase in product quality is marginal when optimizing for color.

oklch.com is an absolutely fantastic resource, thank you for sharing it.

I was able to see how limited our devices are when it comes to high chroma colors and I was only able to select purple. We are fooling ourselves and our users if we keep using HSL and think it’s acceptable.

All these years using Firefox, I did not know this feature existed.

On the other hand, a few years ago I accidentally triggered PiP in mobile Safari, and it worked so inconsistently especially on YouTube when switching to another app, that I dread using it.

(Recently invidious showed how to do it properly)

Interesting. Is that the budget for only search related development or other products as well? (think Stadia, Google Plus etc)

In hindsight, the victor claiming they won because they were better than Bing et. al is exactly what I would say as well if I rigged the game.

We are so commonly assuming that Google has the secret juice that makes search work, and we are so deep in that we can’t trace our steps back and see if this statement still holds in 2023 or not!

Same goes for companies perpetuating the myth that they only hire mega-brained geniuses. That is far from the truth! Most exceptional companies are bound to regress to the mean at some point :)

As a consumer, having my freedom of choice so severely limited appears decisively anti-capitalist. Ffs Firefox please remove Google as the default.

„Competition is for losers“

Peter Thiel on WSJ https://archive.li/2014.09.12-221631/http://online.wsj.com/a...

The common advice is to negotiate prices excl tax, and that advice has been there for quite a while. Even before the new invoice system you could have your revenue taxed if it exceeds a certain amount (10mil JPY) for a certain amount of years.

What is surprising to me is how low the business side skills of most freelancers are. E.g., they don’t have a grasp of double entry bookkeeping, despite doing the blue tax declaration (青色申告). And as soon as there is a complicated payable or receivable scenario, the simple data entry freee and the like provide breaks down.

In my opinion the general skill level is pretty low. To me it is no wonder that the tax agency organizes tax lawyer led study groups, we need more of that.

Again, no surprise that people freak out over this system, but it‘s been years in the making. And the fact that sole entrepreneurs have been able to “pocket in“ the VAT so to say has always felt like a massive ripoff to me. This is especially so because the tax burden is even higher for me as a corporation here.

Being from Germany, having proper rules for VAT deduction appears as the most normal thing to me.

That sounds somewhat similar to the “I rewrote X - in Rust”, or “Why isn’t Linux rewritten in Rust?!” posts that get upvoted quite a lot, or used to.

Sheesh, clickbaity title.

No, it’s not a scam. Should you use it for your data? Yes. Does it prevent you being h4x0red? No. Defense in the depth.

May I perhaps add my rant 50 cents here and link to my post about this?

https://www.justus.pw/garden/telemetry.html

It’s opt out, and it doesn’t even completely disable it (unless given an env var as well)

The devs know about this:

https://github.com/storybookjs/storybook/discussions/19910

I wonder what some of the regional quirks are, instances where the implementation strays from the standard, but if you don’t do it in quirks mode, you can’t connect to the cellular connection or calls will not go through etc.

A sort of woops, non-strict YAML moment, but in telecommunications.

Wow… has he been on a train?

Fujitsu? I am sure the link is only the company name, but the Japanese government contracted out the ID card deployment largely to them, leading to a catastrophic rollout:

https://www.theregister.com/2023/06/30/fujitsu_japan_micjet_...

Some were able to do bank related activities as unrelated people because their cards were issued around the same time, and this thing will be our medical insurance ID at the end of 2024

So if governments are sniffing on high entropy traffic, could we just send normal seeming (SSH or whatever) packets with the payload coming from /dev/urandom? Would that be a denial of service?

This is great. I often look at unit tests to understand how to use legacy code. Seeing a law come with concrete examples that are part of the legal text, would allow us to test if a rule is logically consistent, and test our understanding as well. Sort of how you want to convince your reviewer that your code works by proving it with a unit/integration/e2e test.

End to end tests for legal frameworks?

This is what I love about the internet: to anything you can write you can get the most enlightened or insane response. I hope that years later, your response will end up on the right side of these two. (Provided this lands on some kind of internet archive)

Reminds me of the old I’m color blind, I don’t see race trope. Recognizing where someone is coming from, even if you don’t personally like it, that’s a basic requirement for communication.

Those instance where people complain about misgendering? That’s not when someone accidentally uses the wrong pronoun. It’s when a person purposefully ignores someone else’s wishes and calls them in a way that is hurtful.

To me saying it’s just messages in a bug tracker, and identity doesn’t matter, that person can’t be serious. I feel we have to learn this lesson over and over again.