• 0 Posts
  • 250 Comments
Joined 1 year ago
cake
Cake day: July 23rd, 2023

help-circle

  • Did we read the same article? DNS-01 challenges require updates to DNS. This means you need an API for your DNS. This means you now have to worry about DNS permissions in your application cert workflow. We’ve just massively increased blast radius! Or you could do it manually but that’s already failed.

    All of this is straightforward with infrastructure-as-code. While I don’t struggle with that, I’ve watched devs and sysadmins both stare blankly at this kind of thing for days at a time.


  • If you’re using any work-related anything to post “anonymously” or talk to journalists, don’t. That Blind redirection is chilling yet it’s well within the capabilities of employers. The right way to talk to journalists like 404 is to find their anonymous contact details eg Signal using your own internet connection and your own device. Work computers can be monitored. Traffic on work computers or work VPNs can be monitored. Company email usage can be monitored. Company phone usage can be monitored. You don’t need to be incredibly private with a VPN over tor and anonymous services; you just need to not use company resources. Whether or not this should be legal is a different story; you just gotta know you have fuck all for privacy on company resources.

    I’ve only heard of Blind in passing; that corp email makes it too close to Glassdoor for comfort and it’s very clearly not private with that requirement.



  • AWS makes this impossible in a few places such as a fair number of ACM use-cases.

    I think your cert-per-session idea is interesting. We’d need significant throughput and processing boosts to make that happen, probably at least on the order of 10X computing speeds and 10X transmission speeds across the board minimum. These operations are computationally intense and add data to the wire so, for example, a simple Lemmy server with hundreds of users slows to a crawl and a larger site eg Mastodon goes to dialup speeds or worse. You can test at home by trying to generate an x509 self-signed cert before connecting to a website every time.


  • I read the Wires article for the first time just now to try and understand this article. I don’t really think it attacks SimpleX at all. I think it states the fact that nazis have moved to the platform, the fact that SimpleX is a very private platform, the fact that SimpleX claims to prevent extremist content and growth, the fact that extremist content is being spread and growing, and the fact that SimpleX is unaware of claims. As someone who has been following this discourse for decades, this is the kind of thing that gets published. There is a balance between privacy and extremism. Privacy-focused individuals like myself will always focus on the privacy provided there are tools to combat the extremism (where applicable).

    I feel like SimpleX is being defensive because their claims are not panning out. Their response calls out all of the things I feel were said in support of them while ignoring the actual critiques of their system. Not adding a backdoor? Great! That’s law and smart! Supporting groups of over a thousand posting extremist content?

    We never designed groups to be usable for more than 50 users and we’ve been really surprised to see them growing to the current sizes despite limited usability and performance

    SimpleX will remove such content if it is discovered. Much of the content that these terrorist groups have shared on Telegram—and are already resharing on SimpleX—has been deemed illegal in the UK, Canada, and Europe.

    This is the stuff that needs response, not the privacy stuff Gilbert is arguably a fan of.


  • Oh, so we run mesh networks across the ocean? Very interesting. I’m sure we’ll be able to just use a metal with fake value that has nothing to do with fiat currency to buy all the equipment we’d need to power all that. Is there a big Monero group out there with the coins to pay all those local installers? They’d probably need to define some standards for what a network would look like and how they connect and how the local installers how and who gets paid what and how the networks interact. Standards? Regulations? I’m sure there’s a word for some sort of governing body that does all that.


  • Wait, you want to use a private currency pegged to the value of gold which is pegged to government currency? That kinda sounds like government currency with extra steps.

    So instead using something we sort of agree has some value we should instead reject the government while using utilities it controls and regulates to access the internet it controls and regulates to use a currency susceptible to a 51% attack that could easily be executed by not just one but many governments? That’s a really novel idea. Do you have plans to run fiber across the oceans paying for everything with Monero so we can break free of these oppressive regimes?



  • Anyone in tech who knowingly works for Google supports these things in the same way that anyone that works in tech who knowingly works for Meta support genocide and the erosion of the democratic process. I give the caveat “in tech” because there are some roles like content moderation or executive assistant where you really don’t have the luxury of a huge market working almost anywhere else that doesn’t support genocide and I don’t fault those faults for taking a job that has better benefits. My engineering peers? I judge them for it.





  • So only art in museums is culturally significant? Made by artists who are dead? What about buildings? Religious places? Graveyards? Note that these are things I called out in my first comment so I’m not trying to move the goalposts here. You highlighted the Taliban destroying cultural places so, by your definition, we must include those and since we can’t displace any new ones must be added.

    I completely disagree that the footprint of the world’s art museums is minuscule. Museums today already have problems with storage. In order to meet your definition for art, museums must continue to expand their collections. As the number of people grows, the number of artists grows, increasing the supply of art. How do you define “great artist” without proportionally increasing the number? As fields specialize, so too do the “great artists” that define mediums.

    What about books? Records? Movies? How do we decide what to keep here?


    • What defines “irreplaceable art” and why do we have a legal or moral obligation to protect it? Why does this allow for the private ownership of art?
    • How much of the earth’s resources are we willing to dedicate to “culturally significant, irreplaceable things” such as buildings, artwork, graveyards, and civilizations? Who gets to decide what from modern times needs to be available in ten thousand years?

    I come from a hoarding home where everything was important. My approach to preservation is colored through this lens. At some point we either exist solely to preserve artifacts created before us or we learn to let go. Not every Van Gogh or Picasso in a museum’s collection will be put on display and many museums struggle to maintain their hidden collections full of what curators would honestly call junk art of interest to only the most specialized of scholar. Assuming we only keep the “best” samples (that’s another debatable topic) there will be a point when we simply cannot collect any more art or culturally relevant things any more, similar to the eventual trade off between graves and arable land.

    Hoarding aside, why are you not arguing to prosecute oil as hard as these folks? The number of indigenous cultural sites across the world destroyed by drilling astronomically outweighs the number of paintings with soup on them. Sure, we can prosecute both, but I don’t see you saying that either.


  • The Security Online article only cites Margitelli’s post on the matter. My assumption has been the article used the post as its single source. On one hand, watching MS fuck shit up for years, I want to believe Margitelli. On the other hand, researchers using weird tools and uninterested in reality are why curl is now a CNA.

    I’m personally frustrated with Margitelli’s post because it’s all about abandoning responsible disclosure globally rather than naming and shaming (Canonical? Red Hat? Both? Others? If it affects all GNU/Linux I’d expect every single distro maintainer to be named and shamed). Responsible disclosure is our best solution to make sure innocent bystanders don’t get caught in the crossfire. When specific entities don’t abide by responsible disclosure we lambast those specific entities not the entire process built to keep users safe.



  • Give me concrete examples. You don’t seem to know what you’re talking about so I want to discuss something specific; the agency you’re talking about is actually there and is centered around the core of the script.

    In your hypothetical where you’ve now decided everyone is just following orders, I can still say the worker did a bad job. You gonna tell me the worker is gonna get fired for not following dumb instructions? Okay. Still did a bad job, orders or not.

    I do not understand why you’re so dead set on telling people critical analysis is bad. Is it morally wrong to like something more than something else? Kinda seems like that way if I can’t ever judge anything because there are constraints outside the control of the thing. I’m not going to attack a straw man here. You should expand on what we can and can’t analyze.


  • There’s a difference between a bad script and bad rewrites. Ending of GoT? Bad script, rewrites don’t matter. 2016 Suicide Squad? Arguably a good script with shitty rewrites. Galaxy of Terror? No comment on the scripts but the rewrites fucked it. Justice League? Horrible script and horrible rewrites. I don’t blame the writers of Galaxy of Terror for Corman’s worm rape scene; I do excoriate Whedon for the pile of shit Snyder used to make a worse pile of shit.

    You’re conflating moral standards with film standards. There are standards that people agree on that loosely dictate what we consider good and bad. They can change based on the viewer. The core of a script is what has the opportunity to be butchered and if it’s bad that’s not on the studio, that’s on the writer. Studios don’t hire someone and say “write us a piece of shit” they take something that exists and modify it (unless you’re Neil Breen in which case that’s your goal).

    In your example, I can get frustrated with a grocery worker pushing all of the things to back of the shelf where I can’t reach. That is a fair criticism of their contribution to the inane reshuffling. I’m not saying they’re a bad person because they’re doing the thing they need to do to survive poorly; I’m saying they’re doing a thing poorly. It has no bearing on them as a person. It’s not morally wrong of them to make it impossible for me to get the item I need; it is a shit job though.


  • You’re talking about two different things. In general, you should never be disrespectful of anyone because there’s no need to be mean. However, I can definitely criticize a writer for working on something terrible because they wrote it. I can also criticize a studio for releasing it. “Just following orders” doesn’t remove culpability especially when the writing is really fucking bad.

    Please note I’m not talking about this movie because it hasn’t been released yet. I’ve watched a plethora of movies over the last month that had really bad writing.