• 1 Post
  • 561 Comments
Joined 1 year ago
cake
Cake day: July 14th, 2023

help-circle

  • But being rude and abusive to support staff doesn’t help, encourage, or even compel the support staff do their jobs any better or faster. In fact, I’d wager it’s rather the opposite.

    I work in IT (not IT support, though) and I’m fortunate enough that none of my business partners are outright abusive. Even so, I still have some that I deprioritize compared to others because working with them is a pain (things like asking for project proposals to solve X problem and never having money to fund them). If someone was actively rude to me when I had fucked up, much less when I was doing a great job, I can guarantee I wouldn’t work any better or faster when it was for them.





  • Reverse proxies aren’t DNS servers.

    The DNS server will be configured to know that your domain, e.g., example.com or *.example.com, is a particular IP, and when someone navigates to that URL it tells them the IP, which they then send a request to.

    The reverse proxy runs on that IP; it intercepts and analyzes the request. This can be as simple as transparently forwarding jellyfin.example.com to the specific IP (could even be an internal IP address on the same machine - I use Traefik to expose Docker network IPs that aren’t exposed at the host level) and port, but they can also inspect and rewrite headers and other request properties and they can have different logic depending on the various values.

    Your router is likely handling the .local “domain” resolution and that’s what you’ll need to be concerned with when configuring AdGuard.


  • It isn’t, because their business practices violate the four FOSS essential freedoms:

    1. The freedom to run the program for any purpose
    2. The freedom to study and modify the program
    3. The freedom to redistribute copies of the original or modified program
    4. The freedom to distribute modified versions of the program

    Specifically, freedom 4 is violated, because you are not permitted to distribute a modified version of the program that connects to the Signal servers (even if all your modified version does is to remove Google Play Services or something similar).


  • This particular scenario involves the MacOS desktop app, not the phone app. The link is showing just an image for me - I think it’s supposed to be to https://stackdiary.com/signal-under-fire-for-storing-encryption-keys-in-plaintext/

    That said, let’s compare how it works on the phone to how it could work on MacOS and how it actually works on MacOS. In each scenario, we’ll suppose you installed an app that has hidden malware - we’ll call it X (just as a placeholder name) - and compare how much data that app has access to. Access to session data allows the app to spoof your client and send+receive messages

    On the phone, your data is sandboxed. X cannot access your Signal messages or session data. ✅ Signal may also encrypt the data and store an encryption key in the database, but this wouldn’t improve security except in very specific circumstances (basically it would mean that if exploits were being used to access your data, you’d need more exploits if the key were in the keychain). Downside: On iOS at least, you also don’t have access to this data.

    On MacOS, it could be implemented using sandboxed data. Then, X would not be able to access your Signal messages or spoof your session unless you explicitly allowed it to (it could request access to it and you would be shown a modal). ✅ Downside: the UX to upload attachments is worse.

    It could also be implemented by storing the encryption key in the keychain instead of in plaintext on disk. Then, X would not be able to access your Signal messages and session data. It might be able to request access - I’m not sure. As a user, you can access the keychain but you have to re-authenticate. ✅ Downside: None.

    It’s actually implemented by storing the encryption key in plaintext, collocated with the encrypted database file. X can access your messages and session data. ❌

    Is it foolproof? No, of course not. But it’s an easy step that would probably take an hour of dev time to refactor. They’re even already storing a key, just not one that’s used for this. And this has been a known issue that they’ve refused to fix for several years. Because of their hostile behavior towards forks, the FOSS community also cannot distribute a hardened version that fixes this issue.






  • the proof is in the pudding with this one

    It isn’t.

    as you must also ask yourself why E15 is banned during summer months in the first place.

    I did. And I shared that in my comment above.

    Your source doesn’t share any data on the topic, even just as a summary, but it links to summertime smog, which links to “smog-causing pollutants”, which says:

    Section 211(h)(1) of the Clean Air Act prohibits the sale of gasoline that has a Reid Vapor Pressure greater than 9.0 psi during the “high ozone season,” which runs from June 1 to September 15. (RVP is a measure of volatility; high-RVP gasolines release more volatile organic compounds into the troposphere where those VOCs contribute to ozone formation.) Gasoline-ethanol blends below E50 are more volatile than straight gasoline and cannot readily meet the 9.0 psi RVP requirement. Congress created a “one-pound waiver” at Section 211(h)(4) that increases the RVP limit from 9.0 psi to 10.0 psi, but—and here’s the catch—the waiver is only available to “fuel blends containing gasoline and 10 percent denatured anhydrous ethanol.” That is, only E10 can take advantage of the one-pound waiver. Although E15 is slightly less volatile than E10, its RVP still exceeds 9 psi. It needs a one-pound waiver to meet Section 211(h)’s RVP limit in the same way that E10 does, but it is not eligible for one under current law.

    The article’s justification for why E15 isn’t legally permitted is that there’s a law against it, which is circular logic. From the environmental protection perspective, it doesn’t sound like there is data suggesting that E15 on its own is worse for the environment than E10. If the only argument is a legal one, it’s not a good argument.

    If you can answer that question you’ll likely find the information you’re looking for.

    I did, and I shared that answer in my comment above, too - but it’s not the answer you seem to think it is.


  • Afaict from reading that (and one of the sources, and its source) it boils down to the fuels’ “RVP levels” (which have an impact on volatility and the amount of VOCs given off) being past a particular threshold. E10 is also past that threshold, but it has an exception that E15 doesn’t have. However, by that same measure, E15 is less volatile than E10.

    The author also expressed concern about expanding corn production as a result of expanded E15 and that there haven’t been sufficient studies on the impact of E15 on the environment (particularly in the summer months). But that’s also paired with a statement saying that “consumers don’t want E15,” which detracts from the previous arguments; if true it means their impacts, if any, would be minimal.

    I didn’t read every link from that page but none gave a better reason.

    My takeaway is that it sounds like we don’t have any data showing that E15 is worse than E10, so the obvious move is to actually start funding those studies.

    I also found https://foe.org/blog/2012-05-understanding-e15/ which is very anti-E15; however I wasn’t able to verify their claims because none of the linked articles loaded for me.







  • UBI doesn’t give any power to those who own the means of automation, nor does it take power away from laborers. Automation does that. Automation reduces the leverage of the laborer by reducing the capitalist’s reliance on labor.

    We have the same leverage regardless of whether we have UBI or not, but the leverage of employers is reduced with UBI. That said, if more people opt not to work thanks to UBI, then the people who choose to work will see their leverage increased.