snailmailman

It’s not just the transmission over Bluetooth. It’s the entirety of what happens with the message. Apple fully controls and trusts the code that’s running on the apple watch. But they have no control over what third parties do with all the data they can collect in notifications.

Bluetooth devices on iOS that display notifications already are getting more information than normal by simply even reading all notifications. Normal apps on iOS can’t do that, they have no reason to. This api was added because smart watches kinda need that functionality to be useful. I think it’s still locked behind a “this device will see all your stuff” permissions box.

I do think they should add in more iMessage/sms/replying capabilities to smart watches though. I think they are extremely hesitant to make it even easier to automate iMessages. iMessage spam is definitely increasing, but it’s NOT as prevalent as normal sms spam for instance. The barriers are much higher, and Apple can basically blacklist devices/appleIDs that send out too much spam, partly because they’ve kept iMessage so locked down.

It’s a neat concept, but I think the microwaveable ones have a shorter longevity. They say it can only be microwaved around 5 times. I suspect they just work because when heated, the erasable ink becomes invisible.

On the normal pocketbooks, the ink actually washes off with just a bit of water. It’s very similar to a whiteboard in that regard. I know I’ve cleaned out my notebook more than five times, it’s still basically good as new. Except one page where I accidentally used a normal non-erasable pen.

Not allowing third party apps to adjust screen colors seems like a reasonable security boundary to me. For the most part when you close an app on iOS, it gets closed. It doesnt get to keep changing system settings in the background. Would be awful if in addition to notifications, apps also got to adjust your colors.

Screen tinting like that is exactly the kind of thing that should be an OS-feature, not an app feature.

They are similarly quite restrictive on MacOS, with some system-impacting features being locked behind “accessibility” permissions. So that arbitrary apps can’t interact with other apps unless they are actually doing something that needs it like “being a screen reader”.

iOS doesn’t have the same sort of permissions. Apps can’t take over interactions with other apps, or change display settings, etc. This is a security boundary. And changing that specifically for “changing screen colors” seems unnecessary to me.

I’m pretty sure this rule is only there to stop the hundreds of “flashlight” apps that used to exist. (Although, they appear to still exist) There isn’t tons of innovation or competition in “flashlight app” other than adding advertisements. There used to be a bunch of them that would only get popular out of necessity. The ones I’m seeing now in the App Store do seem to have non-default behaviors like “strobe light” at least, so they aren’t true clones of native functionality.

Apple isn’t using that rule to take down alternate weather apps, despite them having their own native weather app. There’s still plenty of QR code scanning apps, despite that being built into default camera app.

Different purpose than a whiteboard, because its much smaller and not really for sharing with a group. But I've used a Rocketbook 'reusable notebook' off and on for a while for any random notes at my desk. I used to just fill up a whiteboard by my desk with random notes instead of wasting paper, but now I scribble things in the Rocketbook instead. You write in it with an erasable pen, and can clean the pages off with a bit of water and a cloth.

I just flip to a blank page and write down anything i need. Then once in a while i go through and erase all the pages and start fresh again. I like that i can write very small and detailed - unlike with a whiteboard. But it also isn't a complete waste of paper. (and its still physical, unlike taking notes on an iPad)

A big place where this gets used is to make Kindle ebooks only able to be read on a kindle.

Any time they update and change the DRM there’s a brief period where newly-released amazon kindle books essentially cannot be read anywhere except kindle hardware and official kindle apps. People have pretty consistently found ways around the DRM (for now). But amazon is always trying to crack down on this.

They are constantly testing pushing other things into the subscription box.

What I want is it to only show me videos. Now, it also shows shorts, and also now “community posts” which are frequently just self-promotion and useless polls that drive engagement. I’ve started unsubscribing from anyone that uses those features too much. I want videos not “check out my twitch channel” and “want more merch? Check out my merch! Also this is a poll so that you will click it”

One channel I follow got some new “comments from the community” kind of feature, and suddenly posts from anyone on YouTube were showing up in my sub box because they also subscribed to the same creator. All of the posts were image posts that were blatantly rule breaking spam, or comments like “why is this a feature”. None of them were from anyone I intentionally followed. Literally just random internet comments as a huge section in my sub-box. I instantly unsubscribed.

YouTube REALLY wants to shove other content into the “subscription box” because as-is it lets you avoid all the algorithmic clickbait.

oh wow! yeah my clock sucks. checked again today - clock is incorrect by 5 entire seconds! its unclear why windows isn't resyncing and correcting it. had to manually click the button to sync time and its fixed again for now.

This is definitely a huge part of it. My grandmother is not tech savy, and ended up with the google app installed on her phone. Because if she types anything into any of the search bars, google puts a big banner for the google app in the results page. She doesn't use safari for searching - she now goes to the google app.

Notably - it doesn't advertise chrome there? or maybe she just didn't see those. Most of her internet experience is through either the facebook app or the google app now

Oh interesting. I didn’t realize certs get backdated a bit, but that makes a lot of sense. Interesting that the same isn’t done with SCTs.

I doubt my system time was off by 10 seconds, but I have seen it off by nearly a full second quite frequently. (I checked just now, 700ms behind?) I was checking it quite often via time.gov for a while, and I know the inaccuracy returns after each boot. Maybe my bios doesn’t keep milliseconds, leaving me at ~1s precision only. I suppose that’s probably fine most of the time, but I feel like it should be more precise. Depending on how much it drifts it could be drifting further...

In the case I saw this error, the cert did not exist until I requested the page. Caddy then handles cert creation on-demand and serves it immediately. It’s my own local server- so my latency to it is <1ms - there isn't much time for the cert to become-more-valid if its fresh. It seems likely that my PC fell behind the server enough that the cert wasn't valid for a second or more? I'm tempted to investigate, but right now I only have one cert that needs updating - and it seemed to reissue and load the page just now without issue. (But looking at the cert, I see what you mention - the cert got backdated but not the SCT.)

Firefox is currently rolling out the same thing. They will treat any non-publicly-logged certificate as insecure.

I’m surprised amazon offers the option to not log certificates. The whole idea is that every issued cert should get logged. That way, fraudulently-issued certs are either well documented in public logs- or at least not trusted by the browser.

Yeah this is a surprisingly little known fact- all certs being logged means all subdomain names get logged.

Wildcard certs can hide the subdomains, but then your cert works on all subdomains. This could be an issue if the certs get compromised.

Usually there isn’t sensitive information in subdomain names, but i suspect it often accidentally leaks information about infrastructure setups. "vaultwarden.example.com" existing tells you someone is probably running a vaultwarden instance, even if it’s not publicly accessible.

The same kind of info can leak via dns records too, I think?

I have had the flag to enable this setting enabled for quite some time. It’s never caused any issues. I have only seen it pop-up once- for a cert that I had just issued a second prior. The cert was logged properly and the page loaded another second later. Very quick.

I’ve had similar issues across multiple programming languages. The latest is a C++ program with almost no dependencies. While I’m making changes and frequently recompiling, windows defender will randomly pop-up and let me know that it deleted my freshly-compiled binary. The change will often be something simple, and simply making any change and compiling again will randomly not get flagged.

It’s extremely annoying. It’s my code, stop deleting it. It’s not malware.

90 days has always seemed unnecessarily long to me. I have definitely spun up short-lived pages on subdomains that end up getting a cert that outlives the site itself.

I am concerned at how the cert transparency logs will handle this. That’s going to be a lot of certs getting logged globally if everyone switches to shorter lifetimes.

Interesting. Maybe something in my configuration is affecting it. I’ll have to look into it

I guess I hadn’t considered that search engines could be reranking pages on the fly as I click them. I’ve been seeing my DuckDuckGo results shuffle around for a while now thinking it’s an awful bug.

Like I click one page, don’t find what I want, and go back thinking “no, I want that other result that was below” and it’s an entirely different page with shuffled results, missing the one that I think might have been good.

I believe this is already a thing? In JS at least

Firefox’s “resist fingerprinting” does a lot of things to stop fingerprinting. One of those things is that it fakes my time zone as being UTC. 99% of of the time I never notice this being an issue. But occasionally I’ll try to pull up the wordle late in the day and get tomorrows puzzle.

YouTube has been really cracking down on alt clients and YouTube downloaders lately I think.

I don’t even use one, and I see “you must log in to view this video” on videos shockingly frequently if I’m not logged in. Not even age restricted videos, they give that on any video at random now.

I wouldn’t be surprised if soon it will require an account to watch at all, and they will just get to ban any accounts that use Adblock or download anything.

The article is from December 4th? Crazy that the ads are still running. I saw the same type of ad just a few days ago.

I get that it’s a cat and mouse game, and the advertisers are going to keep tweaking the ad and re-uploading it. But surely YouTube can detect literally any of the keywords. The ad I saw the other day still uses the same general script as what’s in the article.

This! There are SO MANY borderline nsfw ads on YouTube now. All with AI voices and deepfaked faces. Often the same exact script, but a different face and slightly varied stock footage mixed in.

A simple word filter for “this one simple trick” or “get your _ rock hard” could catch all of these ads. But I guess YouTube makes money off of it, so they have no real incentive to fix the problem.

I even recently got a gun ad with an AI voiceover. Advertising features such as how you “don’t need a license” and it’s “easy to sneak through security”.

Reported that one to YouTube a week ago. Not sure if the ad is still running, but the unlisted video is still up a week later, and it has 2 million views! (Some (all?) ads are just an unlisted video you can grab the id to.) There are multiple comments on it asking how it’s allowed, or saying how they reported it. (As well as a terrifyingly many, possibly bot comments, asking how to buy the item)

It’s breaking TOS in so many ways. There’s a transcript of the video. Videos that contain too many swear words get automatically marked as adult content or demonetized, but they seemingly allow anything in advertisements.

Most ads are less than a minute! If any human at YouTube glanced at the ad for even a second they could remove it and ban the account. Something which should happen before showing the ad to millions.

This is unfortunately the case on other platforms like Spotify too. :(

Due to what I assume are music licensing oddities, one song in my Spotify now has an entirely different singer. It was taken down for a while, then later reuploaded as a new recording with new vocals. I’ve also seen copies of my songs changing to remix/cover versions, presumably due to metadata adjustments by the artists. Although usually I can re-search and find the original, adding it back to my library.

A few songs just have new outros/intros. One song in my library now has an additional several seconds of silence on the end. One has a new longer intro that I think is really from the music video version of the song.

As convenient as these music services are, I hate that my library changes beneath me without my control. There are dozens of songs just straight up missing from my Spotify library now. And a small handful that have changed audio. These are almost always in indie songs, and Spotify just hides deleted songs by default in the UI so most users don’t notice.

I routinely see >1hr skippable ads, whenever I make the mistake of attempting to watch on my iPhone instead of my PC (Where Adblock works). They are definitely intentional ads. I don’t know why. The products vary wildly, but are all scams or scam-adjacent at the very least.

Most of my experience with them is that if I ever fall asleep watching a YouTube video, I wake up halfway through an ad about how I can “improve my life with this one simple trick” or how “Jesus can help me if I donate now”

But they have gotten much more aggressive lately. I tried to watch a 30 minute podcast on YouTube from my phone, and gave up 15 minutes in after the fourth hour-long (skippable) ad. They don’t show the duration until you interact with the screen now, so if I’m doing something else and not able to touch my phone right away I get a good few minutes in before I think “is this ad going to end?”

I’m really glad they have a page on that IP. I use it decently often for “is the problem DNS?” troubleshooting.

Because if zero pages load, but that one does, the issue is DNS.

Ping is easy too of course, but I can ask people to type four ones with periods between into their search bar over the phone. No command line required.

I’ve also been using ZFS native encryption on my machine. I wouldn’t describe it as flawless- but that’s mainly due to how nixos-unstable works.

There have been several times where the latest “stable” ZFS doesn’t support any of the newest kernels, and the “latest working” kernel goes EOL, and so nixos completely drops it.

And my options every time seem to be

-roll all the way back to latest “LTS” kernel. This sometimes breaks things.

-skip ahead to a beta release of ZFS (this isn’t always an option, and do I really want an unstable file system?)

-just don’t update for like a month and wait for new ZFS to release, supporting a newer kernel.

And there really isn’t a good option here. Theoretically there’s another option where I maybe keep using the EOL kernel version, and update the rest of my system normally, but I haven’t figured out how to configure that. So I just pick whichever option breaks the least amount of things each time. It’s definitely more of a ZFS issue than something NixOS-specific, but it’s annoying when I’m suddenly greeted with “That kernel version is EOL now.” And the update fails. And there is no easy way to ignore that and accept the risk of a slightly-outdated kernel.

There are many types of ads that cannot be blocked by dns-based blockers. Just like there are ads that can’t be blocked by the new “ublock lite” that is allowed in manifest v3.

uBlock origin can do more complex ad detection and removal, and is the most thorough approach for anything in the browser.

I’ve had zero issues or ads lately using Firefox + uBlock origin. For a while I had to update the Adblock lists manually sometimes, but for months now it’s been flawless for me.

Im a different user- but I can say I’ve been frustrated with their refusal to support OIDC/oauth/literally any standard login system. There is a very long thread on their forums documenting the many attempts for people to contribute this feature.[0] The devs simply shut it down every time, with little to no explanation.

I run many self hosted applications on my local network. Homeassistant is the only one I’m running that has its own dedicated login. Everything else I’m using has OIDC support, or I can at least unobtrusively stick a reverse proxy in front to require OIDC login.

[0] https://community.home-assistant.io/t/open-letter-for-improv...

Edit: things like this [1] don’t help either. Where one of the HA devs threatens to relicense a dependency so that NixOS can’t use it, because… he doesn’t want them to? The license permits them to. Seemed very against the spirit of open source to me.

[1] https://news.ycombinator.com/item?id=27505277

I was tempted to set this up, as I’ve been using passkeys everywhere that I can. But yeah, I’m not going to use Microsoft Authenticator for this one single account. I even already have a passkey for my Microsoft account.

I still get multiple a day. Have had multiple a day for months (maybe years? My call log doesn’t go back far enough to know for sure).

I can’t block them because they are different numbers every time, so I have all unknown incoming calls set to go straight to voicemail.

I don’t even know what they are calling for. If I ever try to answer there is only silence on the line. But I haven’t even done that in months- hoping the calls would eventually stop. (They haven’t)

One infuriating thing is that there is some sort of “verified” checkmark in my call log for some numbers? Or maybe not verified, but “valid number?” Why are they even allowing non-verified calls through? It wouldn’t stop the problem, as 1/4 of my spam calls have the icon anyway. But it would help, surely.