Skip Navigation

User banner
Posts
4
Comments
185
Joined
2 yr. ago

  • Yeah, that'll most likely disable the car / limit it. They often have anti-tamper detection in critical ECUs as well.

  • In a "pure", transformed anarchistic society the large majority of people would subscribe to the idea of classless, stateless society where people act on their own responsibility or through voluntary associations and seek to reduce or even end violence and oppression. In such society only the minority would be willing to wield the big sticks of oppression.

    Also in such society, the majority would obviously rise up against such attempts at pure fascism. Even though the basic ideology of anarchism is rooted in pacifism and non-violence, it doesn't mean anarchistic societies would simply give up the their ideology, roll on their back and surrender when faced with violence.

    Also, I personally believe, that the way to the transformation from our current society to anarchism is only possible through means of revolution - and revolutions are very seldomly non-violent.

    I know you didn't want to read long manifestos, but this is probably worth a read: https://theanarchistlibrary.org/library/peter-gelderloos-how-nonviolence-protects-the-state

    The real answer is of course far more nuanced than this post, but I tried to keep it short and readable

  • LibreOffice will do just fine reading and writing the format as long as you don't care too much about small formatting/layout differences.

    It will also struggle if you've embedded other office components into your documents (like excel embedded in word).

  • My first computer was an old Sinclair ZX81. It was my friends dad's old computer, I got to borrow it over school summer break as they headed to India during the summer. Spent most of that summer learning the basics of BASIC, but you couldn't really do terribly much with it.

    I think this was 1982.

    Got my own ZX Spectrum 48 couple of years later. Glorious times gaming and programming.

  • Thou shalt not steal if there is a direct victim.
    Thou shalt not worship Pop Idols or follow Lostprophets.
    Thou shalt not take the names of Johnny Cash, Joe Strummer, Johnny Hartman, Desmond Dekker, Jim Morrison, Jimi Hendrix or Syd Barrett in vain.
    Thou shalt not think any male over the age of 30 that plays with a child that is not their own is a paedophile. Some people are just nice.
    Thou shalt not read NME.
    Thou shalt not stop liking a band just because they've become popular.
    Thou shalt not question Stephen Fry.
    Thou shalt not judge a book by its cover.
    Thou shalt not judge Lethal Weapon by Danny Glover.
    Thou shalt not buy Coca-Cola products.
    Thou shalt not buy Nestlé products.
    Thou shalt not go into the woods with your boyfriend's best friend, take drugs and cheat on him.
    Thou shalt not fall in love so easily.
    Thou shalt not use poetry, art or music to get into girls' pants. Use it to get into their heads.
    Thou shalt not watch Hollyoaks.
    Thou shalt not attend an open mic and leave as soon as you've done your shitty little poem or song you self-righteous prick.
    Thou shalt not return to the same club or bar week in, week out just 'cause you once saw a girl there that you fancied that you're never gonna fucking talk to.

    There's a second verse, but I think I'll leave it at that.

  • Look. FOSS project fundraisers are cool and everything.. nothing wrong with that, but you could have given a bit more context instead of going for the "shock value" link. The project you linked to is a LineageOS fork as far as I understand - and I don't really see how Android ROM would have any relation to Mozilla Corp CEO bonus - or even to Firefox, the community you posted this to?

  • Well that was a well paid hit piece. For the record, I am happy with Firefox and its functions, I've been using it since the start.

    I am rather worried about Mozilla's new laser focus on AI and the Corp CEO compensation bonuses are just bullshit.

    I'm hoping we won't be forced into a completely Google dominated web because I thinking at that point it's time to abandon it and burn everything to the ground

  • Just +1 to Tillitis, they're doing awesome stuff with FOSS hardware.

  • I regularly remote into in order to manage, usually logged into KDE Plasma as root. Usually they just have several command line windows and a file manager open (I personally just find it more convenient to use the command line from a remote desktop instead of directly SSH-ing into the system)

    I'm not going to judge you (too much), it's your system, but that's unnecessarily risky setup. You should never need to logon to root desktop like that, even for convenience reasons.

    I hope this is done over VPN and that you have 2FA configured on the VPN endpoint? Please don't tell me it's just portforward directly to a VNC running on the servers or something similar because then you have bigger problems than just random 'oops'.

    I do also remember using the browser in my main server to figure out how to set up the PiHole

    To be honest, you're most probably OK - malicious ad campaigns are normally not running 24/7 globally. Chances of you randomly tumbling into a malicious drive-by exploit are quite small (normally they redirect you to install fake addons/updates etc), but of course its hard to tell because you don't remember what sites you visited. Since most of this has gone through PiHole filters, I'd say there's even smaller chance to get insta-pwned.

    But have a look at browser history on the affected root accounts, the sites along with timestamps should be there. You can also examine your system logs and correlate events to your browser history, look for weird login events or anything that doesn't look like "normal usage". You can set up some network monitoring stuff (like SecurityOnion) on your routers SPAN, if you're really paranoid and try to see if there's any anomalous connections when you're not using the system. You could also consider setting up ClamAV and doing a scan.

    You're probably OK and that's just paranoia.

    But... having mentioned paranoia... now you'll always have that nagging lack of trust in your system that won't go away. I can't speak to how you deal with that, because it's all about your own risk appetite and threat model.

    Since these are home systems the potential monetary damage from downtime and re-install isn't huge, so personally I'd just take the hit and wipe/reinstall. I'd learn from my mistakes and build it all up again with better routines and hygiene. But that's what I'd do. You might choose to do something else and that might be OK too.

  • Huge respect for quality entertainment. 52 episodes a year for 10 years is just insane.

    I hope his break is long and relaxing, it is certainly well deserved.

    And I do hope he comes back some day. I would love to see episodic deep dives where he explores one topic in more detail (like let's say 5-10 episode series about one subject).

  • Thanks for the share.
    Obviously Perens is one of the FOSS OG figures and he makes a lot of good points. Lately the RHEL/IBM situation has shown a mere license text file isn't going to keep megacorps from finding ways to circumvent the ideology and the purpose behind it. They have simply too many resources both in development and in legal departments and too many ways to work around the legalese of its intended purpose .

    Also there's been an increasing trend where products (Elastic etc) start off with FOSS license and as soon as they gain critical mass, they split their product and switch to their own FOSS-light license and gimped "community edition" downloads. Again, all still legally above the board, but at the same time completely ignoring the intended purpose of the license in the first place.

    I think what Perens is proposing is too complicated. I understand that "contract" has far more binding legal fire power compared to a "license", but as he also points out in the article, it complicates things to the point where it's hard to adopt. The problem is of course far deeper than just licensing and has its roots deep somewhere in late-stage capitalism and deregulation of corporate entities and those are of course not problems that Perens or the free software community can easily solve. Unfortunately.

    It's clear that something new is needed and I appreciate the work he is doing. I'm not sure it's the right direction to take, but can't say I have any rabbits I can pull out of my hat either, so I'll follow this with interest.

  • Well, that article was a hot mess.

    I appreciate the authors effort and they are correct about lack of "what is VPN" articles that are not written by VPN-vendors in marketing purpose. But I'm not sure if this was it.

    Writing an article meant to "debunk" misconceptions and getting two core concepts, Security and Privacy mixed up right from the start wasn't very good.

    A lot of time was spent on explaining HTTPS and how it somehow magically makes you and your data secure on the Internet and it completely missed to mention who the potential threat actors thwarted by HTTPS are?

    Could have probably used a chapter on how actual threats (both security and privacy) work and how don't have much to do with the level of encryption your TCP/IP connection happens to encapsulate.

    The last chapter with the first 3 bullets was pretty good though. That could have just been the whole article and it would have been alright.

    Oh well. Attempt was made.

  • As a relatively new Beehaw user (I deliberately waited for the reddit exodus to subside before applying), I understand the reasoning. The "default" open nature of ActivityPub creates moderation challenges for a "well tended garden" - much more so than a more controlled space. I also understand the software (lemmy) itself is somewhat problematical, both politically and from technical/maintenance perspective.

    I wouldn't be against moving - and I'd follow. The Beehaw groups are active and contain lot of good quality discussions, I'd assume that wouldn't change outside fediverse.

    I'd be still free to access the fediverse through other kbin/lemmy instances if I wanted to participate and I wouldn't close my Mastodon account just because Beehaw decided to move somewhere else, so I wouldn't personally lose very much - and I would stand to gain a "safe haven" - a more closed discussion forum I could always turn to when the noise of the outside world gets to be too much.

    For the sake of everyone moderating Beehaw and our communities, I'd completely understand. Fediverse is a very rowdy bar and as volunteer bartenders, it must be somewhat tiresome for you.

    In the long term I'd worry about building a too small echo chamber without the required diversity for Quality Discussions and I'd also worry about "hiding" - it would be harder for fellow disenfranchised cretins to find us - and perhaps we'd lose good members. I know the Beehaw strategy priority is not centered around growth, but nevertheless, some kind of strategy would have to be devised to monitoring the long term health and diversity of the community.

  • Hmm… ProtonVPN team solved this in better way. They put the repo configuration stuff into DEB file, so it’s just a matter of double clicking it and clicking install

    I was wondering how they'd solve signature checking and key installation - and looking at their page they seem to recommend skipping checking package signatures which, to be honest, isn't a super good practice - especially if you're installing privacy software.

    Please don’t try to check the GPG signature of this release package (dpkg-sig –verify). Our internal release process is split into several part and the release package is signed with a GPG key, and the repo is signed with another GPG key. So the keys don’t match.

    I get it's more userfriendly - and they provide checksums, so not a huge deal, especially since these are not official Debian packages, but the package signing has been around since 2000, so it's pretty well established procedure at this point.

  • Maybe we'll climb to 4% marketshare!

  • As others have already pointed out, a lot of Linux software is installed from repositories in a standard way, and once you do that, it updates automatically.

    However, as you've already discovered, there's more than one way to install Linux software. Repositories are still the most common way, but installing single .deb's (Debian based distributions) or .rpms (RedHat packaging format) is still there and there are more like Snap, Flatpak and Appimage. You can also often just download the source and compile it yourself. It's a very diverse ecosystem, not like the controlled worlds of WIndows and Mac.

    In this case you can download the .deb file, and pretty sure you can even install it through the file manager, just like in Windows (I don't use Ubuntu, but I think it will just start GUI installation if you double-click on a .deb file).

    But lot of things in Linux are still done through the terminal, like changing configurations and, yes, installing things.

    Getting used to it takes a while, especially if you're not used to modern Windows administration through PowerShell.

    The important part is trying to figure out what each of the commands do and that the output actually means. Software that supports Linux normally has very clear instructions (like in this case), but it does require willingness to change habits, technical curiosity and some trial and error (patience). It's not quite as polished experience as the commercial OS's. There's still a lot of rough edges for the user.

    Good luck on your Linux journey!

  • I do security as my dayjob (more blue team stuff these days, but used to do pentesting in the past).

    Software development normally comes down to a holy trinity of Speed/Cost/Quality. You can only pick two.

    Commercial software has time/cost constraints so they often pick speed and cost over quality initially. FOSS software doesn't need to "get to the market", but also doesn't have any money, so you often get cost/quality over speed.

    However - in larger enterprises there's so much more, you get the whole SDL maturity thing going - money is invested into raising the quality of the whole development lifecycle and you get things like code reviews, architects, product planning, external security testing etc. Things that cost time, money and resources.

    FOSS software is generally going to be missing this, unless the project gets popular and picked up by some big megacorp that bankrolls the development (Google, IBM etc). Look at mission critical projects like OpenSSL that was (until Heartbleed) more or less one man project.

    Commercial software also needs to invest in licensing, support, documentation, certifications, training and potentially integration partners. It's a whole different playing field. FOSS has easier time, because it's generally just pointing at the code and saying "well send a PR".

    Then you have the whole devops thing, where you might take FOSS software and build a whole commercial service around it.

    And all of this is just generalizing of course, because unless we're just comparing small programs, there's really no way to do objective comparisons between "commercial" and "free" without writing a full 50 page thesis.