• 4 Posts
  • 115 Comments
Joined 2 years ago
cake
Cake day: July 19th, 2023

help-circle
  • I could see it being an issue for more privacy-oriented sites. I imagine some Lemmy and Mastodon users might be less inclined to have to login to Apple, Google or Microsoft to be able to interact with others even if the vast majority of users are fine with it. Would be nice for somebody to come up with an open-source service that handles some more basic age verification so other services can just self-host it instead of each platform implementing their own logins. By basic age verification I mean things like matching user behaviour to users with a known age and maybe some face scanning. Nowhere near perfect and it’s a constant cat and mouse game, but maybe enough to be compliant with the law.

    If age verification wasn’t being made mandatory in Australia for social media sites I think it could be a great idea for some services especially if the verification is done by the government with the same level as photo ID. Think dating apps, finance and marketplace sites where having a higher level of confidence that the person you are talking to is who they say they really matters, especially if law enforcement need to be involved down the line. Even if you the user can’t verify the identity of the other person, law enforcement could, and the site might be able to block alt accounts. The credential theft problem still exists of course so it’s no silver bullet, but it’s a lot better than what we have now.



  • Could be a money maker for them. Let the AI slop through, make some money off it for a bit, ban the creator for a violation then delete the video. Far more space efficient than having to deal with real channels that have hundreds of GBs of legacy videos you need to keep around forever and fans who actually care about said creator and legacy. I’m fully expecting the jump where they start producing the slop themselves instead of having to share a percentage with the creators.

    It’s not morally good of course. That slop is cancer.


  • You can work around it in both cases. SecureBoot will only prevent you from running non-signed boot loaders. If that breaks then you just turn off SecureBoot while you work on the issue (assuming SecureBoot failing isn’t due to a compromised boot loader) and the machine will boot normally minus any data stored in the TPM such as the encryption key. For the encryption key, this is something you are supposed to keep a copy of outside the TPM for scenarios like this. On Windows consumer PCs, this is stored in your Microsoft account or the place you specify when enabling it. For Azure or AD-joined PC’s this can be stored in Azure or AD.

    The only ways SecureBoot and encryption will burn you are if there is data stored in the TPM that you don’t have a backup of or way of re-creating, or if the encryption headers on the drive are lost. That said, if you aren’t using a TPM some Windows features will break regardless and if the drive is so messed up that the encryption headers are lost then you’re probably back to backups anyway.


  • As somebody who often ends up using Reddit like Stackoverflow and in some cases needing the Internet Archive (IA) to find the original post after it’s been deleted or garbled, I think this is a wakeup call for those go to Reddit both to get technical help and to post it. More than ever, Reddit is becoming an unreliable place to find answers for old obscure issues and if they are going to lockout places like the IA then I think it’s time people stopped contributing their solutions to Reddit.


  • For the vast majority of users Linux is just a worse deal. Only thing that really comes to mind that Linux does that users care about is that it will support that hardware that Windows 11 will leave behind, and even those users will happily just run Windows 10 without updates and if that bites them in the ass then maybe they’ll upgrade or just ask their IT friend to use a bypass to make Windows 11 at least work on their old hardware.

    Otherwise, of the things users actually care about, Linux has worse app support to the point that even pro-Linux users would rather dual-boot that lose access to their games and worse hardware support. Linux also has a problem of not being well understood by a lot of tech folk so if you bring somebody onboard you better be ready to be their only point of support.

    ChromeOS is probably the best example against this since it is basically just a browser, the laptops it sells on are substantially better value than their budget counterparts and realistically a lot of the people buying them are parents for their kids so the user’s preference is substantially pushed aside in favour of cost. The SteamDeck is another good counter-example since it essentially refuses to compete with the PC gaming market by calling itself a handheld.

    Linux is stuck in the crappy position of needing more users to get more software and hardware support but users need better software and hardware support for Linux to make sense compared to Windows. It’s getting better and Valve’s efforts have steadily brought the Linux gaming percentage up but it’s still the enthusiast OS.

    By all means encourage it’s usage though. Linux is a far more open and privacy-respecting option and the more tech folk and basic-usage users that adopt it the better!






  • This seems a bit convoluted as an explanation if I’ve understood it correctly. If Telegram as using a compromised hosting provider then you could have the strongest crypto in the world to prevent a man-in-the-middle from seeing the unique identifier for each device and it wouldn’t matter since they already who which user is which IP from the servers they control. They don’t stand to gain anything by exposing the unique string to MiTM attacks when they already control Telegram’s servers unless their goal is also to allow other countries to see which user has which IP too. It just seems like an incompetent implementation.



  • Same is true for any tech thing. Sure, you can buy a perpetual licence for something but if you’re running it on anything but an isolated device then you will at minimum need security updates or the source code to fix it yourself. Same is true for things like console games where eventually the hardware will just die and it may become too expensive to replace it. Even emulation is case-by-case since some games use obscure calls which have no adequate emulation. Software doesn’t exist in isolation. For that, you have to revert to pen, paper and some analog tech.



  • The idea of having them send an e-mail to an address containing their IP is clever, however you need to authenticate that the person who sent the e-mail is either somebody who queried your site, or somebody that got the address from somebody who queried your site or else you could just figure out how to generate that base64 yourself and impersonate somebody else’s IP address which could have catastrophic results if you then fed these IPs into something like a block list and suddenly you’ve blocked Microsoft/Office 365. To be fair, I doubt anybody is going to try and reverse engineer one person’s code to then figure out how to impersonate who sent spam, but if this became a widely distributed program you could just pull off Github then it would be more concerning.

    A couple ways to solve this:

    1. Sign the information before encoding it in Base64 so you can verify it came from your site and wasn’t just spoofed. This has the upside of being stateless since you don’t need to keep a record of every e-mail you’ve generated but comes with the disadvantage of spending CPU time signing the text which could be exploited as a DDoS.
    2. Spit out a random e-mail address and record which e-mail address was given to each IP. Presumably you wouldn’t hold on to this list forever since IPs change owners frequently and so an IP that was malicious 1 month ago could be used by a completely different person now and so you can trim this list down once a month to avoid wasting disk space. You’d probably also want to keep some amount of these requests in memory (maybe 10Mb or so) to avoid ruining your IOPS.

    All this said, I think your time is better spent with the using unique e-mail aliases as the author suggested but with 2 changes: 1) use aliases which are not guessable to prevent somebody from making it look like somebody else was hacked (e.g. me+googlecom@ gets compromised, but the spammer catches on and sends from me+microsoftcom@ instead to throw off the scent) and 2) don’t use me+chickenjockey@, use chickenjockey@ or else the spammer can just strip “+chickenjockey” from the address to get the real e-mail address.


  • Eh it depends. I’m fortunate enough to be in a good IP block so I don’t get my e-mails dropped purely on that. It’s been a good learning experience and I’ve leaned on my own server a number of times for troubleshooting at work since I can see the whole mail flow. The only problem I have is the free Outlook/Hotmail will not accept my e-mails. Everybody else seems fine. All that said, I don’t host anybody else’s e-mail so I haven’t had any spam come out of my IP, and I would never in a million years host e-mail for a customer.