snailmailman

I think most browsers have patched this out? i didnt do super concrete tests, but at least on my machine their demo is failing to fingerprint me across private browsing/incognito sessions as they claim. Tested in firefox and edge.

Firefox's "Resist fingerprinting" does this. It sets timezone to UTC, standardizes the fonts, standardizes a whole bunch of other fingerprinting data, etc. It also has a "letterboxing" option to round screensize down to the nearest 100px and stuff too. Tor uses all of those settings by default, though they are also in standard firefox in about:config.

When i use Resist Fingerprinting my main issue is the timezone being set to UTC. most of the other stuff it does never causes issues. I guess sometimes sites need to read the canvas, but theres a permission box that allows that when needed. I wish there was a similar permission box for timezone.

The only other drawback to the "resist fingerprinting" option is you will encounter cloudflares' captcha checkbox everywhere and all of the time :(

I've always wondered to what extent these culling techniques still work with raytracing? A reflective surface can bring a bunch of otherwise-offscreen things into the scene. Its what makes screen-space reflections look so bad sometimes, they can't reflect whats not on-screen.

I try to disable a lot of web tracking stuff, so I kinda understand if advertisers have trouble targeting me. But the information they should be able to use to target me just isn't getting used at all. Are other people getting well-targeted ads? because in my experience, ad companies suck at it.

I constantly receive ads on Youtube in languages I don't speak. I can kinda make out whats happening in some of the ads, I know a bit of Spanish for instance. But the ads entirely in Turkish, Vietnamese, Arabic, Japanese, Chinese, etc, are completely lost on me. I often cannot even tell what the product is that they are advertising. My google account has language preferences set, my browser has them set, my device has them set. Google should *know* what languages I can speak. I'm not on a VPN, I'm pretty sure google knows my exact location. None of these languages are spoken particularly frequently in my area, I don't understand how I'm getting advertisements in these languages.

I used to have targeted advertisements turned off on youtube. I changed this several months ago, because the ads were literally 100% scams, deepfakes, and illegal products. I just got sick of it. I've intentionally turned on targeted ads, as it lets you have some control over the advertisements. Now I finally no longer get as many ads for pornography and illegal drugs, but its still mostly scams, and I still constantly receive ads that are completely and wildly outside of my demographic. Languages I can't speak, political ads for companies and politicians hundreds of miles away. I am shocked when i rarely receive an ad for a local restaurant or business, because it happens so incredibly rarely. When it happens, I wonder, did they actually target me to show me the local business? or was it luck? I'm convinced its the latter.

how well does the battery hold up after that long?

Mine is only like 2-3 years old and I charge it so rarely. I can read several entire books on a charge easily. It lasts months. I imagine even if the battery degraded significantly it would be quite usable.

This is absolutely what it is. The easiest way to strip drm from a kindle book was through this app. You download the file, strip the drm, done. I think newer versions of the app made it harder? But old versions were still supported.

The more locked down kindle mobile apps and kindle e-readers make it more difficult, but stripping the drm will always be possible.

It’s more difficult, but KFX drm is still possible to break.

Generally speaking, they auto update, and the latest firmware is always patched to not be jailbreakable. However airplane mode easily dodges the auto update process, and new vulnerabilities are found to enable jailbreaking eventually.

When I bought mine, it was updated to the latest firmware. I wanted to jailbreak mine, the method was “there isn’t one yet” so I set it in airplane mode. For a bit I manually copied all books over usb to the kindle, or disabled airplane mode to read new books if there wasn’t a new firmware version out yet anyway. A few months later, there was a jailbreak method. Now ive jailbroken. I can even connect it to the internet, and auto updates are prevented.

If the kindle is old enough it doesn’t recieve updates anyway though, then it should be very easy.

https://kindlemodding.org/kindle-models.html

It’s infuriating when I do a search and get an entire page of AI slop articles, “helpfully” prefixed with the search engines’ own AI summary of the AI slop articles

I searched for a specific niche product the other day. Second result down was AI blogspam “what to buy now that product X has been discontinued. We reviewed these 9 alternatives now that the company shut down.”

The company didn’t shut down. The 9 alternatives were the same product by the same company in different sizes and quantity counts. How kind of them to hallucinate so many glowing reviews for me after they hallucinated a problem into existence first.

At least the search engine can summarize all the slop for me. It even cites sources! The sources directly contradict the summary almost every time, but why would you click through?

Usually the Anubis anti-bot things only take a second. But I stared at one for more than 30 seconds the other day when I tried to access one of the Linux kernel websites. Literally just a progress bar with a hash counter. I was on a modern iPhone, I don’t know why it took so long. maybe because my phone had low battery? But it’s infuriating that this is what the web has become.

The web is becoming more and more unusable every day. If your data is easy to access, it gets stolen and scraped, your site effectively DDOSed. If your site is hard to access nobody will visit.

The people I follow on mastodon come from a wide variety of instances. While mastodon.social is the largest instance, most of the accounts I follow are elsewhere.

Granted, all the smaller instances are likely easier to DOS as they are small instances. But mastodon is actually decentralized. If any one instance goes down, everything else keeps working. Unlike Bluesky and ATProto which is more of a theoretical “could be” decentralized.

It has been resolved.

https://sourceforge.net/p/veracrypt/discussion/general/threa...

I’m surprised that such scanning isn’t built into windows defender, the enabled-by-default tool already designed to scan all your files.

But yeah, they also just super aggressively try to trick you into sending all your files to onedrive.

I think windows has a feature built in on some adaptive refresh rate displays to dynamically shift the frame rate down (to 30, on my screen) or up to the cap, depending on what’s actually happening.

I remember playing with it a bit, and it would dynamically change to a high refresh rate as you moved the mouse, and then drop down as soon as the mouse cursor stopped moving.

I had issues with it sometimes being lower refresh rate even when there was motion on screen, so the frame rate swings were unfortunately noticeable. Motion would get smoother for all content whenever the mouse moved.

1hz is drastically fewer refreshes. I hope they have the “is this content static” measurement actually worked out to a degree where it’s not noticeable.

Every day users? Probably not many. It forcibly disables lots of nice-to-have features.

But users who need a highly secure phone? It’s entirely possible to use the phone without media embeds in iMessage, or shared photo albums, or websites loading in 900 fonts. It’s a trade off likely worth making in some situations.

Update: It looks like the accounts have all been deleted by github, including their repos. They are 404 pages now. Their repos + recent malicious commits are all just 404 pages now.

I'm curious what the policy is there if the accounts were compromised. Can the original users "restore" their accounts somehow? For now it appears the accounts are gone. Maybe they were entirely bot accounts but a few looked like compromised "real" accounts to me.

The same thing occurred on the trivy repo a few days ago. A GitHub discussion about the hack was closed and 700+ spam comments were posted.

I scrolled through and clicked a few profiles. While many might be spam accounts or low-activity accounts, some appeared to be actual GitHub users with a history of contributions.

I’m curious how so many accounts got compromised. Are those past hacks, or is this credential steeling hack very widespread?

Are the trivy and litellm hacks just 2 high profile repos out of a much more widespread “infect as many devs as possible, someone might control a valuable GitHub repository” hack? I’m concerned that this is only the start of many supply chain issues.

Edit: Looking through and several of the accounts have a recent commit "Update workflow configuration" where they are placing a credential stealer into a CI workflow. The commits are all back in february.

I run NixOS and the number of times ive been able to install something 'normally' (not via nixpkgs/flake) is approximately zero. You cant go to a website and download a binary and just run it. Almost every program references a shared library and wont be able to find it.

Nixpkgs is very complete in my experience, and in the instances where its not, someone usually has made a flake. The only times ive had to custom-make a flake were extremely new programs, or extremely old ones. Often the newer programs had PRs waiting on nixpkgs anyway, and were only a few days away from building properly in nixos-unstable.

It doesn't help that there are two NixOS wikis. nixos.wiki and wiki.nixos.org.

wiki.nixos.org claims that nixos.wiki is outdated and unofficial. But both appear to receive updates, and which one wins the SEO game is a coinflip whenever i google a nixos question.

Ah, I think the HN post was merged. My original comment was in response to this related github discussion: https://github.com/aquasecurity/trivy/discussions/10420

There are hundreds of automated spam comments there from presumably compromised accounts. The new OP is much more clear regarding what has happened.

Are the spam comments all from compromised accounts, presumably compromised due to this hack?

I only clicked on a handful of accounts but several of them have plausibly real looking profiles.

This is a quite scary map. They are all over my local area. It may technically be possible to route a drive around them, but if you take the most convenient path between any two points at least one camera will spot you. I'd have to leave my neighborhood through back roads and enter local shopping areas through sidestreets.

This data shouldn't even be collected in the first place, let alone consolidated into a national network that any police officer can decide to spy on me through.

I like the concept of them, and I want them to work well purely so people stop using bad passwords. But nearly everywhere does it differently and weirdly and likely wrongly.

When I log into my Amazon account with a passkey, it then asks me for a 2FA code. The 2FA code is stored on the same device as a passkey, that step literally does nothing. After I do the 2FA code, it then prompts me to create a passkey. No! I have one. I signed in with one.

Some devices give me the option to use a QR code. I like that option usually, I can easily use my phone to authenticate. But sometimes i can’t get the QR code to appear. Support varies by OS, browser, and set of installed extensions. And there’s no easy way to control which of those three handles the passkey when something decides wrongly.

I had to troubleshoot something on someone else’s computer, and saw that they logged in to windows with a passkey and QR code. I’ve looked, and I can’t seem to set that up on my windows computer. There isn’t an option to and I have no idea why.

This does unfortunately actually work pretty well as a security measure. The new domains that are cheap and good for fun side projects, are also cheap for scammers.

For a while I noticed all the scam links my grandmother was getting were from ‘.top’ domains. I fully blocked it at the DNS level. Her DNS settings also block all newly registered sites for 90 days. She hasn’t ever had issues with it. But these have actively prevented her from clicking on scam links multiple times.

Facebook, google, and all the popular sites are all older than 90 days, on popular well known TLDs. My grandmother doesn’t seek out new trendy sites.

It was definitely something I considered when buying a new domain. I sorted by price, and then immediately ignored all the cheapest domains that were ~$1 because I’ve seen them being used for scams. They may be cheap but good luck using them.

The revocation mechanism is basically just a list of revoked certificates. Without expiration dates, those lists will grow infinitely.

I’m pretty sure YouTube’s built-in AI summary is also biased towards not “spoiling” the video.

Like if the title is a clickbait “this one simple trick to..” the ai summary right below will summarize all the things accomplished with the “trick” but they still want you to actully click on the video (and watch any ads) to find out more information. They won’t reveal the trick in the summary.

So annoying because it could be a useful time saving feature. But what actually saves time is if I click through and just skim the transcript myself.

The ai features are also limited by context length on extremely long form content. I tried using the “ask a question about this video” and it could answer questions about the first 2 hours in a very long podcast but not the last third hour. (It was also pretty obviously using only the transcript, and couldn’t reference on-screen content)

I don’t mean P2P in the same sense that BitTorrent or something is P2P. (Splitting one connection into many distributed ones) But more like how a game that does P2P multiplayer has the clients connect directly instead of through a centralized service.

They specifically avoid sending traffic through tailscale servers whenever possible. That’s how the free tier stays free. Most connections are direct, P2P.

The traffic that does go through their servers is encrypted, and bandwidth limited on the free plan. Any snooping on client behavior would have to be done client side, and the clients are all open source. To some extent the coordination server might be able to deduce some metadata about connections; but definitely not snoop all plaintext traffic.

I think they do have some “service detection” which can basically port-scan your devices to make services visible in the web UI. But that is easy to disable. And premium/enterprise tiers can intentionally log traffic statistics.

This is something I saw all the time. I’d look something up, knowing that there was probably an easy way to do <basic programming task> in modern c++ with one function call.

Find the stack overflow thread, answer from 10+ years ago. Not modern C++. New questions on the topic closed as duplicate. Occasionally the correct answer would be further down, not yet upvoted.

“Best practice” changes over time. I frequently saw wrong answers with install instructions that were outdated, commands that don’t function on newer OS version, etc etc.

It is not super easy to get around that tech. It used to be easier a long time ago. Apple patches the methods every time they can, and have made hardware adjustments in attempt to make it as hard as possible. A lot of these methods involve tricking the counter so it doesnt increment at all, or somehow rolling it back. If the phone isnt set to wipe after 10 attempts, tricking the timer that time has passed would be enough.

Im not sure if anyone other than Cellebrite knows the exact details of what they are doing. (If they can even unlock latest iPhones that are properly secured. I’m seeing a recent article that implies recently unlocked iPhones had biometrics enabled) I wouldn’t be surprised if their techniques involved disassembling the phone, and tampering with every connection of the chips involved, or depowering them in weird ways as they are counting attempts, or even desoldering and transferring the chips to other boards. I suspect that if apple knew and could patch the method, they would.

It’s impressive that it is so hard to get into iPhones imo. People use 6 digit passcodes to lock their entire digital life. That would be considered horrendously insecure for anything that isn’t an iPhone. You can (and should) increase it to a full password. But a lot of people don’t.