sneak

I’m in the process of developing a WAF reverse proxy designed for the smallweb and selfhosters to address precisely this.

https://git.eeqj.de/sneak/smallwebwaf

It’s alpha but it should be ready for real-world testing in the next couple of days. I’m going to drop it in front of my Gitea and home-grown api servers.

I’m super tired of Anubis spamming me with furry fetish art on its pointless interstitials 20 times a day. As someone pointed out in another comment, LLM scraper bots are super easy to detect with basic heuristics. PoW and session cookies and an interstitial are massive overkill and annoying spam.

> AGPL does not require you to share your changes if you use it (like most people) internally.

The text of the AGP License does not support this claim.

Don’t believe the hype. AGPL violates free software freedoms 0 and 1. It was designed by people who think that receiving a free gift confers obligation to reciprocate.

https://en.wikipedia.org/wiki/The_Free_Software_Definition

https://sneak.berlin/20250720/the-agpl-is-nonfree/

“open source” but it’s the nonfree AGPL, and naturally RBAC and SSO are behind a paywall. I’m tired of fake open source projects that just want the street cred and free marketing.

That’s the thing, though. They aren’t blind, you just can’t prove it. They’re plausibly blind, strictly from a legal standpoint.

They know.

I’ve sent them high res well lit photo evidence of the fraud and they still left me to have to do a chargeback via my card issuer for receiving counterfeit merchandise. You know this has happened thousands of times.

Search for 4TB or 8TB USB sticks on amazon.com. You’ll find dozens or hundreds of $20-30 16GB or 32GB sticks with hacked firmware to report a multi-terabyte drive size, and dozens of one star reviews talking about how it lost their data. Those sizes, if real, would be $400+.

Of course they know. They have no civil or criminal consequences for engaging in a conspiracy to commit large scale wire fraud, so of course they just let it happen, because who wants to speak up and cause the metrics to go down?

First off, why would you snitch?

Secondly, why would you report the offense… to the offender? That’s like filing a citizen complaint form for police misconduct… to the police.

HR is not your friend.

“make” here either means legislation to enable civil liability that doesn’t exist today, or enforcing existing criminal laws against the wealthy ownership class.

Neither of these things will happen, for reasons which are obvious.

How do you suggest we implement your proposal? Anyone can say what they think should be. An implementation plan with actionable steps is the hard part.

eBay is also knowingly complicit in enabling completely fraudulent sellers, by policy, at scale.

It improves their bottom line, so everyone there is disincentivized to fix it.

Most people use one of 3 major email providers, on a domain they don’t own.

To be fair, the sandbox was really bad. It’s not that hard to effectively airgap these things. Doing research and development on “evil” versions without “lab leaks” is trivial provided you don’t underestimate its willingness to seep out through gaps under the door.

Huggingface happened precisely because of such an underestimation.

Spotify is chock full of payola. Every single playlist l they generate (and auto shuffle mode) has paid ads in it. It’s a terrible product.

I wonder how many people forking over $$$ for a degoogled phone simply go on to use it to log in to their gmail via imap with K9 mail they installed from f-droid.

I fail to see the logic in it being worth $1099 but not $2k.

If your max price point were $600 or something, sure, but once you’re above $1k what’s the difference? You already value it greatly.

It’s dumb and negligent to be missing “PasswordAuthentication no” in 2026. It’s been so for at least ten years. OpenSSH should have turned off password auth in the defaults years ago.

Any modern redesigned json library in 2026 should have at least a flag to serialize and unserialize json5. Sad that they had this opportunity here and blew it.

I have a NUC running LibreElec in my living room, on the input to my TV immediately adjacent to the input used by the Apple TV. I'm speaking from direct personal side-by-side experience.

CVE-2026-109618 is evidence that it is absolutely not "good now". To make a pro-PHP argument the week that PHP's shortcomings just cost half the internet millions of dollars of lost time panic-patching an RCE is... an interesting choice.

Widespread mass realtime facial recognition usage is allowing governments to target and repress subsets of the population with an unprecedented scale and efficiency. ICE are flying facial recognition drones over sidewalks in downtown LA. Dissdents are having their facial geometries entered into secret databases simply based on political opinions.

The AI formula is out of the bag. The Manhattan Project is over, trinity has happened.

If it weren’t OAI and Anthropic, it would be others.

If it weren’t US companies, it would be others.

It is far too useful now to stop large scale deployment, it isn’t a matter of specific people or countries not being cautious or prudent enough. The entirety of the Earth is at issue now and there will always be people who cause the tragedy of the commons (if indeed AI turns out to be harmful in the long run, which is not remotely certain).

Look at what happened with fossil fuels. Even if the entire global west totally ceased use, there are many countries that simply will not stop because of local utility. AI is the exact same way.

It might turn out we were better off without nuclear weapons, but so far I’m happy we haven’t had another world war (in the traditional “total war” sense).

No way to tell until after, though. So far, mutually assured destruction is working. It works until it doesn’t.

Same with AI. Thus far we’re better off with it than without it. That may change.

I mean, look what we did with fossil fuels. Some people are even still willingly burning them, even though the data is clear that our use of them has already started the total destruction of our civilization.

Is there a name for this, a technology that is so insanely useful that there is no way we won’t exploit it, but where the worst case scenario is total collapse, and impossible to determine well in advance?

(Fossil fuels I suppose don’t count as even the energy companies knew unambiguously decades ago that large scale use would eventually bake the entire agricultural system out of existence.)

Oh, my mistake! I always assumed it was f/oss that slowly boiled the frog. Turns out it wouldn’t have been in the running for consideration in my daily use stack anyway.

The article addresses that. In the very beginning.

> But still, why laptops? Isn’t it a major waste of screen pixels and keyboard buttons and battery ions? Well yes, Mac Mini would be a better choice for a datacenter. Sure, it has very rudimentary remote management, no redundant power, and a beautiful case that ensures that cooling will be difficult regardless of which side you lay it on. But these are all known challenges that we have learned to manage.

> But have you actually tried to order a couple hundred Minis? We have. Ordered in January, delivered in July. Welcome to the world of 2026 when the supply chains are in disarray. Never mind that Apple doesn’t release updated CPU models to all devices at once. So Mac Mini didn’t get M5 cores for 10 months (and then suddenly got M6 before any other device model!). We promise the best and the newest to our customers so we had to be inventive. That’s how the MacBook-in-Datacenter project was born.

Today you can run macOS and current Xcode in kvm/qemu on any modern amd64 server. Next macOS will be arm only and likely DRM’d up the wazoo.

https://github.com/kholia/OSX-KVM

This is why the right to fork exists in open source licenses. It’s easier than ever now, too, thanks to LLMs. You might even be able to oneshot forking and removing the malware and rebranding and rebuilding f/oss crapware these days.

I’ve been considering setting up a nonprofit solely to do this and to republish things like Mattermost, Stats, Bitwarden, etc with the corporate antifeatures ripped out.

No, qweqwe and I were discussing the same topic.

Some people think it’s ok to waste their life configuring Linux PCs to do standard non-custom appliance stuff, and some people just buy appliances. The appliance people in this case get to easily use Bluetooth speakers and HDR and the Linux PC people get to spend hours they won’t get back configuring their PCs to do the same thing that the appliance people get out of the box.

Still an open question: How does S3 Glacier Deep Archive do it? Tape has been theorized but I’ve also heard arguments for very slow flash…

The fact that Linux is a huge inconvenient waste of time to use for normal tasks has nothing to do with brainrot. You’re moving the goalposts.

You must realize there are things like 3blue1brown, Veritasium, and Numberphile on YouTube, right?

I have a Tesla 3. There’s no good way to get a lot of power out of the car as an end user except via the wheels. You can get like ~1kW of 12VDC via the dc-to-dc computer/accessory system but even that is pushing it.

I am saddened by this. I’d like to be able to access the large amount of power in it in a pinch.

There is also no good way to charge it as an end user from a DC source like my large 48VDC solar battery system. I end up having to invert the DC to 220VAC which then charges it normally (involving rectifying it back to DC for the onboard batteries) - an unnecessary and inefficient double conversion.

You don’t have HDR and can’t pair and then send audio to bluetooth speakers via only the remote in 100 seconds. These basic things are table stakes. It does not “just work”.