lemmyvore @ lemmyvore @feddit.nl

Posts

15

Comments

2,750

Joined

2 yr. ago

https://www.youtube.com/watch?v=Eb_7ZCbuBbc

Yes! They actually made a pretty good replica of the original intro. Not identical but same style and clearly a homage.

Anime:

• 2m30 opening song
• 2m recap
• 2m last scenes from previous episode but not considered "recap" for some reason
• 10m actual episode content
• 2m30 ending song
• 1m funny "outtakes" or banter
• 30s spoilers for next episode

Who were they talking to.

I blame whoever had their chat open at 1am.

Seems to be working nicely. It's indeed a drop-in replacement for Mozilla NLP plugin, just with the added ability to customize the endpoint.

If anybody else needs to check their NLP plugins, the My Location app can show location fixes individually per location source.

I'll start using the NeoStumbler app to contribute back to the API – hopefully it's well optimized and won't be eating too much battery.

Maybe you meet the conditions for it? It hasn't been possible to access their API without meeting the conditions for at least a year now.

You don't pay directly for the API, the latest conditions AFAIR are 20+ domains and $50+ on account balance and $50+ spent in the last 2 years.

They also want you to whitelist the IPs that access the DNS which makes it unusable for DynDNS, but at least they have a separate URL for that.

How do you use it with microG? Is there a NLP location plugin that uses it?

I'm really surprised they made two seasons.

The fact they couldn't even make it as good as Red vs Blue is amazing. And that's not a high bar.

Seriously, we probably need to dig into some parts of the human senses that can't be well defined. Like when you look at an image and it seems to be spinning.

Because there are people who got put there to try to push that stuff.

A lot of us were running Debian when Ubuntu came out. It was polished and integrated to a degree that Debian wasn't. It became popular for very good reasons.

If I ever changed my email domains I'd have to go change a lot of online accounts.

Or people who use it for email and basically have their online identity tied to them.

Namecheap has extra rules if you want to use an API (minimum money spent with them, minimum of domains managed with them etc.) — GoDaddy style.

Keep that in mind, if you need an API (for DDNS or for obtaining wildcard TLS certificates) you'll have to use a separate service for DNS.

Which part do you think it's FUD, and why?

PGP is not particularly related to email. It's also used to encrypt files, partitions etc.

You can use public key cryptography with any system, because you simply encrypt the content and then send it through the normal unencrypted system.

But PGP does nothing for the headers and nothing for the fact messages are still waiting around on various servers. Also PGP on its own is very impractical due to the need to get keys for every recipient – but even if there were a generalized system of public key autodiscovery (over DNS) it still wouldn't fix the problems with IMAP/POP3/SMTP.

Each of these things holds a piece of the puzzle – including what Proton & Tuta are doing – but these pieces on their own are useless. We need all of them to come together.

1. The email stored on T/P is not end-to-end encrypted. T/P have access to it without going through you. Why? Because that's how email works. When receiving mail, their server is contacted by another (non-encrypted) server who says "I have a message for you, accept it and store it". And they have to be able to do that 24/7 without involving you. Same for sending, they have to take your message and store it for several days until they can send it out in clear and another (non-encrypted) server has confirmed it has accepted it. Any pretense that any of this is secure is just security theater.
2. You cannot have multiple clients on multiple devices, because they've replaced standard protocols (IMAP and SMTP) with their proprietary wrappers to maintain the pretense. So you can only use their apps (insofar as they're available for your devices), or their webmail, that know how to speak the proprietary protocols. This locks you into their service.

You can't do secure email. You really can't, sorry. Point (1) above is a game-ending design flaw that makes it impossible, and (2) is just lock-in and hoops to jump through without really adding anything of value.

You could do remote encrypted storage of your email archive but only if you give up the notion that you can also allow that storage server to send and receive messages for you. If they have access then it can be subverted and the whole proposition is worthless.

The way to achieve such storage is by using a remote file storage service reflected locally as a virtual filesystem, preferably with the encryption layer controlled by your device not their service, and use it to store messages managed by your local email client. Your local email client would then use IMAP and SMTP connections to unrelated email servers to send/receive messages. But you'd have to replicate this stack on every device, which is impractical.

The better approach is to self-host your mail archive, with a webmail client on top connected to a SMTP service, and have a local tool on the server that pulls emails from a POP3 server and deletes them afterward. And you can encrypt the disk there if you want, and use whatever you want to access your archive (regular email clients or webmail).

Jumping to a new major version takes more effort than releasing incremental updates for a version they already have in production (presumably for several models).

Frankly, I can't really wrap my head around what services like Proton and Tuta are trying to do, so in turn I can't get a clear idea of the threat model.

They're basically running encrypted file storage servers that are used to store email messages, forcing their users to use proprietary protocols to access them. But sending and receiving email messages implies messages passing through other, non-encrypted servers.

The only scenario where they'd approach anything resembling security is if both the recipient and sender are on the same service. Not even passing messages between two such services (Tuta & Proton) is really secure. And since the vast majority of the average user's messages are exchanged with other servers it means that the vast majority of their messages have a copy in clear on at least one other server out there, and have passed through clear relays that are also not encrypted at rest, making more potential copies available.

So what exactly is solved by having one copy encrypted if there are non-encrypted copies readily available?

If they are 10 (11?) months old on major systems version jumps, the fuck are they doing for monthly security patches?!

Wait, what does one have to do with the other? When a new Android version comes out it doesn't mean that the previous one stops getting security fixes. You can stay on a previous version and still be up to date on security.