arcanicanis

Just a profusely verbose fediverse interloper

Public Key

npub1pmt6lj9sff80t4fvzn75d3j7g5kk9jjs537keafg0mfgykndymms5wd4ts

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsqa4a0ezcy5nh465kpfl2xce0y2ttzefg2gltv7558a55ztfkjdacpz4mhxue69uhhyetvv9ujumt0wd68ytnsw43qd6kxg6

Publishing to

relay.mostr.pub

Author Public Key

npub1pmt6lj9sff80t4fvzn75d3j7g5kk9jjs537keafg0mfgykndymms5wd4ts

Show more details

Last Notes

2024-07-08 05:36:27

- reply

There's one animation skit where the protagonist gets mistakenly flagged as an impersonation attempt on themselves, from a facial recognition unlock feature on their phone, and automatically prompted to defend themself against identity fraud charges: https://www.youtube.com/watch?v=UbXaiqA4ins

2024-06-11 23:26:22

- reply

Are all the ports for STUN/TURN open, including the entire ranges for TURN relay (ALL ports from UDP port 49152, to UDP port 65535, as is the default for eturnal and coturn), or if you're using a custom port range, is it enough ports (e.g. at least like ~100 ports or so)?

2024-06-11 20:54:06

- reply

Is it with calls only between people on the same XMPP server, or is it with calls to users on other servers? To my understanding, each server (for each participant in a call) needs to provide STUN/TURN services.

2024-05-25 19:27:47

- reply

and what about the servers I've had running for several years, with a very immaculate uptime, and warning you against starting a community on a mega-instance?

2024-04-21 06:53:14

- reply

or the result when people complain to social media instead of putting the effort into carefully reporting installer issues.

2024-04-15 07:37:29

- reply

I think it probably got removed from the UI after the last UI revamp of Gajim. Meanwhile Pidgin does (or did) support it as well: https://pidgin.im/help/protocols/xmpp/supportedxep/ (apparently Pidgin is still being developed, as I guess there's a v3.0.0-alpha1 being worked on)

2024-04-13 06:47:58

- reply

I'm pretty much available for tech support whenever needed for XMPP servers and alike (and there is of course also the respective support MUCs, for each server software). I can also set up cert/uptime monitoring with notifications, from my Icinga2 instance, if desired. I was intending at some later point to deploy a self-serve system for that.

2024-03-31 04:26:32

- reply

Weird. I really don't have much issue with deciphering CAPTCHAs still, maybe I am just an AGI after all or something.

2024-03-27 19:03:07

- reply

I assume you're referring to GabPay: https://www.gabpay.info/

2024-03-24 01:03:14

- reply

Much of it's explained later in one of the replies at: https://were.social/notice/Ag9m39s4aWr45TmKdE
Generally trying to build within the capabilities present in PHP 8.0, making use of common first-party binary extensions to PHP first (hence OpenSSL for secp256k1, or else libsodium when I deal with ed25519)
Hadn't known about the IETF publication, I actually had to dig in various forum threads and StackOverflow to find the math on how to accomplish it, as well as work off of other people's notes. The mentioned publication probably would have helped out much more, I'll probably highlight in on any future summary on that.
I do however need to dig deeper on the specifics about low-s with signature creation.
Much of the stuff with Multibase, Multikey, etc I've already read into plenty before when experimenting with Object Integrity Proofs in ActivityPub, just with ed25519 instead.

2024-03-23 19:56:16

- reply

Sounds like it doesn’t necessarily ease the burden of implementing did:[something] for ActivityPub though. Do you consider it a dead end as far as practical utility goes?
Oh, it absolutely could be used today in FEP-ef61, and the laziest implementations could just lean on querying https://plc.directory/ for every did:plc. A person could just skip all of the above prerequisites, and at minimum [only] be a consumer of that DID method by just grabbing the JSON (or JSON-LD: https://plc.directory/did:plc:s2m7kbq2unki7rager5aw6sw ), and having blind faith that the directory validated it (except it'd only be a one-way relationship).
I did accomplish this with no dependencies (other than OpenSSL and a BigInt math library) in ~400 lines of code from scratch.
The significant issue is long-term trust in that DID platform, as there's no idea how they'll moderate it, if they'll force incompatible breaking changes, lock it down later on (for submitting did:plc identities, or resolving them), or if it'll be shut down some amount of years from now. But at least there's nothing that mandates the use of their resolver, as I'm sure others could launch their own, maybe.

2024-03-23 09:12:34

I guess I successfully created a did:plc and have it published to (sorta) Bluesky's backend did:plc registry: https://plc.directory/did:plc:b3iyjhbvpeiygj35orqatuqb/log
Instead of endorsing any sort of a ATProto PDS or anything, I instead have it pointing to my ActivityPub (and other) identifiers in varying forms.
I'm probably the only [non-employee] user (or at least: one of very few) on Bluesky's infrastructure that has full custody and control over their own private keys for their did:plc identity, and yet I don't even have a Bluesky account. Unless I'm just uninformed of something buried somewhere allowing you to export at least one of your rotationKeys (not the signingKey, which is just for signing posts, etc). Because without that, you don't really control your identity at all, only Bluesky exclusively does.
Meanwhile, in this endeavor, I "only" had to:
Write a DAG-CBOR and CIDv1 encoder
Write a Multibase and Multikey encoder and decoder
Write a base58btc encoder/decoder
Write a base32 encoder
Write functions to compress and decompress a secp256k1 public key (involves crypto maths, for decompression)
Write some very adhoc ASN.1 DER encoding/decoding functions (just to encode a raw secp256k1 public key into PEM encoding, to feed to OpenSSL; and then extract the r and s values from the outputted signature from OpenSSL)
Write a function to generate a did:plc identifier, from the genesis operation
Write a lot of test code
With how scarcely some topics are documented, and how scattered many tidbits of info is: I swear some of this is almost intentionally a trap to sell consultancy.

2024-03-22 22:23:05

The volcano beacons for human sacrifice in the form of: superfluous tech consultants.
Or alternately: people who write specs and never bother to even completely implement their own spec.

2024-03-08 21:46:56

- reply

If you do rotate the keys to have all users be the same public key, make sure you list both the new and old key in the Update (new key first, which gets stored; old key 2nd/last, which gets discarded), as that's very specifically how the key rotation with Mastodon works (as I also noticed per: https://arcanican.is/excerpts/cve-2024-23832/ )

2024-03-08 21:24:18

https://seirdy.one/posts/2021/02/23/keeping-platforms-open/

2024-03-08 20:52:10

- reply

It's all I routinely bitch about:
https://were.social/notice/AfHlGgRYClScNnQFiy
https://were.social/notice/AfYn3Wcauj4nkflBkO
I assume it was originally under an ambitious idea to allow users to have control over their identity by cryptography, but implemented in such a half-baked way that was conceptually flawed, to the point where users cannot export their keys for risk of the entire server: https://github.com/mastodon/mastodon/discussions/22315#discussioncomment-4423581

2024-03-06 02:48:47

...Why do we have this ridiculous joke of assigning a keypair to every ActivityPub actor (that the user themself can never have) for HTTP Signatures when all remote resources are fetched under the internal actor's key only (and anonymity of who's querying the resource), and therefore be unable to enforce access control on a non-public resource?

2024-02-26 23:18:15

- reply

There's already been the support in Pleroma for years of presenting an auth script for ejabberd (and derivatives), then on the frontend you just tie in converse.js or other XMPP web clients: https://docs-develop.pleroma.social/backend/configuration/howto_ejabberd/
There's already OMEMO support in conversejs, amongst others.

2024-02-24 05:40:54

- reply

Firefish is unusual in that it can import posts exported from Mastodon.
You can export/import posts under the Pleroma lineage of server implementations too, I believe even from an export from Mastodon.
A DID is securely associated with a document describing the subject (similar to a user or actor) identified by the DID, but without requiring a single, centralised authority.
I guess I view the DID specification as more of an extensible URL-like format, whereas the DID method dictates the general meaning of the remainder of the identifier. There are some very unusual DID methods listed in the registry that sound very centralized, just like Mastercard's did:id method: https://github.com/Mastercard/did-methods/blob/master/id.md#retrieve
Just like how HTTP is used/abused as an application protocol far beyond the scope it was intended for (hypertext media) just because of the versatility of URLs, I assume DIDs are intended to be a more broadly versatile/extensible format of URI-like identifiers, which could be for anything from identity, down to individual resources associated under that identity.
for example if the instance is offline or the user has been banned. This feature was cited as one of the main reasons Bluesky did not adopt ActivityPub.
I honestly would argue it's just an excuse on their part. I still can't find anywhere in ActivityPub spaces where they even tried talking to developers in the community. Also, you could actually Move your account to another service, while your original server is down, if you had 'your' private key that's used in HTTP Signatures. But because of the present state of how HTTP Signatures are sometimes implemented, servers actually keep you from exporting your key: https://github.com/mastodon/mastodon/discussions/22315
suggested a proposal to implement ActivityPub on top of the AT Protocol
Last I remember reading of that proposal, it felt like an insane idea of just stacking things, and not thinking carefully. I believe much of the same can be achieved far more simply with portable object signatures, and a duality of cryptographic identifiers that can be resolved by from conventional mechanisms (WebFinger-resolved acct: IDs, URLs, DNS, etc that point to a cryptographic ID) rather than one type of identifier only (only cryptographic or only conventional).

2024-02-23 21:37:09

- reply

I think that's the point to Nostr though: there's not meant to be a lot to it.
Public key is the identity, sign messages to publish under that identity, relays are your inbox/outbox, require proof-of-work as one way to keep spam from overtaking the network, etc (if I understand correctly)

2024-02-23 21:14:53

Would it be worth anything for me to spend my day writing a light dissertation between ATProto, ActivityPub, Nostr (very lightly, I still need to dig more), DIDs, etc? (and having to re-read much of the specs again)
If so, expect that it'd be at least as long as (if not more) than: https://arcanican.is/primer/ap-decentralization.php
and just to declare: I've only written a full ActivityPub server implementation, meanwhile I have not written an ATProto server nor anything Nostr yet. I believe I have a fairly complete understanding how it ATProto comes together in it's components, compared to a lot of other people that seem to be commenting on it.

2024-02-23 20:36:46

- reply

One thing I assume will be a sizable annoyance: is that E2EE won't be possible, unless both sides adopt a mutual protocol. Thus it might be the first case to see a push for experimental implementation of MLS (from MIMI), or otherwise bring some Olm/Megaolm compatibility to XMPP, or OMEMO compatibility to Matrix, as I don't know if those can be 1:1 translated back-and-forth. Or just less-sophisticated things like PGP over instant messaging (like PGP over XMPP as transparently facilitated by plugins).
They're both key ratcheting systems, I just don't know how much Olm/MegaOlm differs from OMEMO.
But at least it bridges the communication gap to be able to start reaching people on another sizable federated instant messaging network.

2024-02-23 20:14:31

- reply

Interesting, there's two different behaviors for bridging account identifiers available:
matrix_id_as_jid: false: Matrix user ID is treated as a JID (e.g. [email protected]); if it can't delivered as an XMPP recipient (if no XMPP service exists as matrix.org, in this example), it then tries via Matrix protocol (as @example:matrix.org)
matrix_id_as_jid: true: a separate XMPP component is used as the identifier for all bridged Matrix users (e.g. Matrix users appear as example%[email protected]).
https://github.com/processone/ejabberd/commit/2b7b92edeef6e413570cafacc392720a2baab23b

2024-02-20 03:28:47

Ooo, I see the Matrix gateway for ejabberd starting to get mainlined in the Community edition, since about a week ago: https://github.com/processone/ejabberd/commit/f44e23b8cc2c3ab7d1c36f702f00a6b5b947c5d0
According to the file headers, it seems to have been started back in late April 2022.

2024-02-19 00:09:16

Just tossing this out here, to see if anyone has other feedback on the effectiveness of SocialHub, the FEP process, etc: https://socialhub.activitypub.rocks/t/the-process-platform-isnt-working/3923

2024-02-17 08:53:46

- reply

I swear it wasn't me this time.

2024-02-17 08:19:28

I present to all of you the pinnacle in CAPTCHA technologies, to solve the issue of spambots abusing open registration:
All you have to do is require any applicants to complete The Impossible Quiz, easy: https://www.newgrounds.com/portal/view/365143

2024-02-17 02:47:07

- reply

I guess it’s even worse that I thought, because from what’s been deduced by others that reached out to me, it allows any user to make impersonated posts (and probably more) of users on the same instance.
From the info I have, I tested if other projects were affected, and found other projects it applies to as well.
For the projects that I found affected (by what’s assumed to be the details of GHSA-jhrq-qvrm-qr36), I haven’t found anyone yet that got any heads-up or private message from the Mastodon team before (or even after) this abrupt security release; they just shoved it out without notice, or only told a few closely-knit projects.
This specific vulnerability was even warned about by one project, years ago, that has even had mitigations since 3-4 years ago. But evidently those warnings were buried to history.
I’ll keep quiet for a days at least on the details.

2024-02-16 21:44:19

- reply

v4.2.5 was released to fix CVE-2024-23832 (the one I reported) v4.2.6 was released to fix CVE-2024-25618 (External OpenID Connect Account Takeover by E-Mail Change, credit to @npub16u3…tnqn ) v4.2.7 was released to add a not-yet-public Github security report: https://github.com/mastodon/mastodon/security/advisories/GHSA-jhrq-qvrm-qr36
The update of v4.2.5 addressed the specific payloads I had put together, as it was confirmed fixed in my test lab. But I wouldn’t be surprised if there was more, such as if it was something to do with attributedTo or other properties that I could have overlooked.
I was already blown away by the point that I could do the first attack (of impersonated posts) so trivially, and then tumbling down the rabbit hole of noticing I could alter profiles too, and then even hijacking traffic outbound, and rejecting genuine traffic on the inbound—that there was probably even more yet to be discovered still, that someone else caught instead.
I can probably poke around with v4.2.5 more in a moment, to see if there was other trivial vulnerabilities overlooked.

2024-02-16 03:47:46

- reply

I’ll just reiterate an important footnote about the federation issue that was encountered with mastodon.social, as I’ve added inline, specifically:
[1] The issue was later identified as a combination of: some behavior that’s common to anyone using Fastly (as mastodon.social uses), TLSv1.3 support, and a bug specific to a version Erlang OTP regarding TLSv1.3 middlebox compatibility mode.

2024-02-16 00:42:26

- reply

Thank you for the offer, it’s greatly appreciated; I don’t quite have anything set up right now, as I’m leery of a lot of conventional payment mediums, given a lot of them just reveal PII (e.g. PayPal, real name policies, etc). I can set up some XMR, BTC, or ETH wallets, but I also understand there being a portion of people that want to avoid exchanges, or just the broad crypto ecosystem in general (esp. all the horror stories, frauds, scams that are over-reported) despite that it can have positive utility.
It’s also mentionable that I didn’t write any patches for any of the affected software, each development team handled that on their own, I just merely privately reported it and retained confidentiality on it until now.
I appreciate the positive comments about the writing, although I’m a little surprised, because I don’t consider myself that significant of a writer. Either way, I’m sure at least the characterization of the “in the moment” aspects probably saved it a little. I hope I could make it a little less-technical.

2024-02-15 23:37:24

- reply

I’m sure the deep details can be overlooked, if hastily skimmed over; the point of my announcement post was to be a subtle joke: there is nothing crafty whatsoever in the presented payload, it’s just a standard Note object. “(…) one of the payloads (…)”
If I presented the meat of it right away, like some "inbox": "https://eliteh4x0rs.example/lol", "publicKey": { "id": "https://mastodon.social/victim#attacker-key", (...) }, then I’m sure some would write it off as “ah well, there’s some deeper sophistication to it, that’s above my paygrade of understanding”.

2024-02-15 23:24:13

- reply

Well, it’s really close in severity: when you can take over the deliverability of their posts to any followers (on any software) that aren’t on the same server, when you can take over where Direct Messages across servers end up, when you can change the public key cached for any remote user and start impersonating S2S traffic, and much more.

2024-02-15 22:57:16

- reply

Here's the 'more info':
https://were.social/notice/AeuTOL78x560sfdeFc
https://arcanican.is/excerpts/cve-2024-23832/
https://arcanican.is/excerpts/cve-2024-23832/discovery.htm

2024-02-15 22:24:37

- reply

I think part of it just comes down to developers of each project having direct communication channels with each other, whether it’s poking each other over email, instant messaging, or direct messages; meanwhile kicking around topics in microblogging format (as something that can get buried to the timeline with everything else), sometimes makes it difficult. I do agree that SocialHub for whatever reason feels difficult to keep up with.
Essentially with FEPs, it feels almost like something that should be treated like trying to get a bill through Congress. “Hey, I’ve got this new proposal, I’ve talked to X and Y project, and they seem onboard, can I count on your support too? Is there any feedback you have on this idea?”
As for Mastodon: fuck it. Everyone else can continue advancing on together, and probably craft things in a “progressive enhancement” manner to augment new things, while Mastodon can act like the “Internet Explorer of the fedi” in it’s own little aimless corner. While the rest of us get to have: custom emote reactions, animation markup, search, post quoting, (now recently) post tipping, and whatever else comes next.
e.g. some “strict mode” could be advertised in nodeinfo, like in similar nature to HSTS with web browsers regarding strict HTTPS use; or if an actor has keys listed for Object Integrity Proofs, to trust that mechanism only for proving something authentic as originating from that user, and skipping whatever insanity of HTTP Signatures, same-origin, or other mechanisms, etc.

2024-02-15 21:35:21

- reply

What is the recommended mitigation here, is it as simple as a domain match check?
For flexibility, I think a fair option would be to just try checking if the object really exists at the differing domain (at the alleged object ID), and if so, just use the content of that newly resolved object, as long as things match up (domain of object ID matches up to domain of actor and/or attributedTo).
I’m sure there’s some edge-cases yet that I could be overlooking, but I assume that’s a fair start.
Nonetheless, in the opposite extreme, what I also don’t want to happen is: for the protocol design to be overly locked down that it screws up the minimalistic “IndieWeb” aspirations of the protocol, or restrict the the flexibility of it, or to be prevented from splitting up roles to different subdomains. e.g. where I could have public ActivityPub content be on one subdomain, on a server that’s essentially a static website of HTML and ActivityPub content, and then have the inbox/outbox be on a beefier server on a different subdomain; therefore: even if the server running active code for handling federation traffic goes down, the public content is still online and accessible, versus all of it collapsing down together.

2024-02-15 20:20:43

- reply

I am aware of those numbers, although alternatively I wouldn’t be surprised if running mastodon.social burns up like >$17k/mo of it, leaving <$8k/mo to be divvied up between a couple devs.
But at the same time, even then, I think a financially-responsible person could budget something into a fund for handling security bounties.

2024-02-15 16:00:00

So here’s an example of one of the maliciously-crafted payloads that resulted in a 9.8 severity CVE (CVE-2024-23832) against Mastodon:
{
"@context": ["https://www.w3.org/ns/activitystreams"],
"id": "https://mastodon.social/users/Gargron/posts/123456",
"type": "Note",
"actor": "https://mastodon.social/users/Gargron",
"attributedTo": "https://mastodon.social/users/Gargron",
"content": "Well, this is an extremely concerning vulnerability I should have accounted for.",
"to": [ "https://www.w3.org/ns/activitystreams#Public" ],
"cc": [ "https://mastodon.social/users/Gargron/followers" ],
"published": "2024-01-28T22:00:00Z"
}
I have previously double-checked with one of the Mastodon developers (while CC’ing the Mastodon Security email) to confirm that I’m free to release the details at this scheduled time (Feb 15th 15:00 UTC). According to the current observed metrics on FediDB, >73.6% of Mastodon instances are patched against CVE-2024-23832, as manually tabulated.
For more details on the vulnerability, the original security report as it was submitted on Github is available at: https://arcanican.is/excerpts/cve-2024-23832/
My recount of events (as well as unsolicited commentary and criticisms on the vulnerability, ecosystem, etc; when I get around to finishing it): https://arcanican.is/excerpts/cve-2024-23832/discovery.htm
https://were.social/media/6ff54bdc52e5011feb9b11a715a0e4206060a10b523d864814345a3fc7f9734c.png
https://were.social/media/c0bf24a97dec84fbbc9c22244334160c7b056d29b03ab180bae6d2bb57455441.png

2024-02-15 00:54:00

Man, it’s been 7 years already.
Context: there were minor syntax errors in the examples, and ActivityPub was about to become a W3C Recommendation in a month or two, so I made a small commit, and mentioned it on the respective SocialWG IRC channel, but generally got a “sorry, we can’t really accept outside contributions…” response.
There still was a handful of other typos to be corrected, but since that was the policy—I didn’t bother poking at that further. At least there was a minor acknowledgment.
https://were.social/media/b8e7940eb2738ba6ba26a6a3d058f1edda00ec1b91a92b376937ae8f2bfebeee.png

2024-02-14 07:29:04

- reply

Is it current lack of widespread Ed25519 support?
Or is it lack of secp256k1 support (which I doubt would ever come) probably for Nostr?

2024-02-14 03:54:37

Well that’s one way to wake up: logging into a production system, and peeking into the database to troubleshoot a problem, and then noticing: nearly all the database records are just completely gone, and there’s no rational reason why—but then after some amount of time, you realize you’re just looking at a testing pre-launch copy of the database, not the actual production database, and nothing was missing at all.

2024-02-14 01:42:13

- reply

I’m by no means any authority on the Matrix protocol, I’ve just been casually watching the project all the way back since they used to have the vector.im instance (that was my first account), but nonetheless I keep finding more things like: https://were.social/notice/Aa6Cy89IEgkINeko6K
Meanwhile there’s a reason that XMPP tries to be as stateless as reasonably possible, while it feels like Matrix was just some VC startup coming in that assumed it just knew better than all the protocols before it, and probably making plenty of short-sighted design decisions.

2024-02-13 23:45:12

- reply

That’s the part that annoys me with Matrix, “noooooo, you can’t just implement it yourself, here, just use our first-party library instead; don’t dare look behind the curtain and see the over-architected highly-state-dependent mess”

2024-02-13 22:17:11

- reply

https://www.w3.org/TR/activitypub/#block-activity-outbox
The Block activity is used to indicate that the posting actor does not want another actor (defined in the object property) to be able to interact with objects posted by the actor posting the Block activity.
In the ActivityPub spec itself, it bears no meaning of access control; it’s purely just to ignore notifications and objects (such as replies) from that actor, as there is no rational way to accomplish limiting access to public posts from specific actors.
Anything sensitive that requires access control should not be posted publicly on social media to begin with. This isn’t a software design issue, it’s a human behavioral issue.
I routinely [privately] warn people about oversharing, such as when I stumble across someone posting a photo that gives away the exact location of where they live, or where they work, and most of the time it’s shrugged off as a non-issue, because they assume they have tangible threats in the present, but never consider the future.
Then of course, they could always end up in some controversy much later on, over something completely innocuous, and face some tangible threats/risk, but yet put the blame on everyone else for their reckless posting behaviors (“omg doxxing!”). Blocking people they perceive as a threat solves nothing.

2024-02-12 07:18:16

- reply

I still have to get around to digging into Nostr yet, but I assume it involves self-authenticated identities and signed messages, and using relays as temporary inbox/outbox storage.
I don’t know if received posts gradually expire after a time, otherwise if so, then it’s probably only practical for strictly social interaction and not as much for content publishing.
Nonetheless, I assume with the concept of Nostr relays, that it’s probably a fairer balance between “everything is the same type of node”-decentralized and conventional federated software.

2024-02-12 06:23:32

- reply

The reality that disgusts me the most, is with the cargo culted mentality of:
Software is now (rightfully) considered so dangerous that we tell everyone not to run it themselves. Instead, you are supposed to leave that to an “X as a service” provider, or perhaps just to “the cloud.” (…)
The assumption is then that the cloud is somehow able to make insecure software trustworthy. (…)
Specifically where you have retards that made the mistake of running their company IT almost exclusively on Microsoft products, especially with Exchange, SharePoint, and such; that they figure it’s “safer” if you just have Microsoft host all of it instead. Instead of: just using something else, with a better security history.
It even blows my mind further with teleconferencing software; like paying an O365 subscription for Teams, as if WebRTC is a finite resource you can only get from Microsoft and can’t run yourself.
So now a lot of it’s just a capture of so much internal company data and infra all onto Azure/O365, making all these customers as Microsoft’s most favorite little captive victims.
Hell, even the f’ing military (when I was in my last few months of doing ActiveDirectory/Exchange admin stuff in the Marine Corps, to the end of my contract) was in the transition of dumping all their internal servers for Exchange Online and O365, whereas all of that’s outside of the intranet perimeter now.

2024-02-12 06:01:41

https://spectrum.ieee.org/lean-software-development

2024-02-11 10:04:13

- reply

I guess I notice one typo in the proposed FEP: it’s (created) not (created-at), I hope that typo doesn’t stick.

2024-02-11 05:35:33

- reply

I mean, HTTP Signatures wasn’t very hard to implement and get working fine and interoperable with other fedi software, and I’ve read portions of the [draft] spec, it’s just not useful as a portable format of data that can be relayed between servers. You just also have to check with implementations of what headers they expect to be signed, which is part of the unwritten rules in fedi that you’re not going to find in the HTTP Signatures spec itself.
But if you want to find endless rabbit holes of practically “protocol mills” (if that’s an appropriate moniker?), just dig into some of the distant depths of the Verifiable Credentials suite of standards, or for insane extremes, go through the labyrinth of specs for Solid: https://solidproject.org/TR/
Apparently they even define their own system of HTTP Signatures: https://solid.github.io/httpsig/
depend on the N3 language for manipulating data: https://solidproject.org/TR/protocol#n3-patch-example
https://w3c.github.io/N3/spec/
But outside of the topic of Solid, and as mentioned earlier: at least some parts of Verifiable Credentials can be borrowed into fedi, and narrowly implemented for a specific opinionated use, such as object signatures, as I’ve described in: https://arcanican.is/primer/ap-decentralization.php
But yes, there’s just insane degrees and extents in which people just keep dreaming up new standards, and making things unfathomably more complex than needed, likely just to sell consultancy and to pitch more VC startups.

2024-02-11 05:14:50

- reply

It’s probably not even so much the standard itself, but more to do with all the aimless and shallow-efforted implementations, especially when people are writing libraries dealing with cryptography that can’t even get the basics right, and everyone just blindly pulls it in without question.
Although, yes, sometimes weird stuff pops up, just as last night when I was adding support for polls, that I notice the Question type is apparently classified as an activity, not really a persistent content type, but treated like a post (as it maybe should be?). Generally I’ve had the mental model that non-activity types are usually a side-effect of an activity, or describe a momentary relationship between non-activity types (Person arrived at Event, Person created a Note, Person updated a Note, Person followed a Person, etc).
Nonetheless, ActivityStreams was ambiguously vague until a more opinionated and narrowed use of it was conceived—ActivityPub. I don’t see what value ActivityStreams had before ActivityPub, other than practically just being a schema for describing social activity data.
Meanwhile, JSON-LD continues to bring more surprises, as I believe there were some unforeseen surprises and confusion in JSON-LD regarding canonicalization of @context that’s delayed standardization of some of the Data Integrity cryptosuites (not really currently an AP thing, but just more W3C disarray).

2024-02-11 04:50:38

- reply

This is with an implementation of HTTP Signatures in fedi. Just as I was looking into someone asking help on implementing HTTP Signatures, I notice the library they pull in doesn’t even validate the digest, just if the signature is valid and nothing else.
This is also why I hate the mentality of “well, surely other people out there are more responsible and educated than me on this domain-specific knowledge, so I’ll just import this random library that seems popular enough”.

2024-02-11 04:43:31

Did you know: when you verify the signature on a digest, you should probably verify that the presented content (that the digest is supposedly of) actually hashes to same value as the signed digest?
I’m just increasingly disgusted that it seems like the majority of developers are just collectively drugged, high, intoxicated, or some combination thereof, because I don’t understand how I keep stumbling into these things when I’m not even trying to pentest anything. Worse is that this is in a library that people are just blindly importing and trusting.

2024-02-10 23:39:43

- reply

The reason I think ‘federated’ has much more practicality, is because it’s far easier to conceptualize, establish responsibility of who pays the bills for running the servers, easier to locate a resource (if it uses some conventional identifier, like a URL), etc.
Whereas with “truly decentralized mesh, everything is a node, no distinction of client/server”: usually some entity still has to pick up the slack and host high-bandwidth/high-uptime nodes, or seed a sizable portion of the network (if storage focused), or centrally run some ‘jumpstart’ servers (to be a new node’s first peer, to discover the rest of the network to peer with) for the network, entirely as some cash-furnace charity.
As it is with Tor, I have no idea where it’d be if it was without a few of it’s top exit node providers, since there’s virtually no incentive to ever host an exit node: https://metrics.torproject.org/bubbles.html#as-exits-only
The only model that I think anything ‘truly decentralized’ would be self-sustaining is if it involves some autonomous cryptocurrency-based concept, but that also adds more cost and overhead (including blockchain, consensus, etc), and I assume also difficult to design a system that provably measures resource costs (such as rewarding someone for hosting a resource, providing bandwidth, etc).
It feels like everyone always tiers the concepts strictly into (from worst to inherently best): centralized, federated, decentralized mesh; always striving decentralized mesh as ‘the Holy Grail’, always better above-all. It’s seldom viewed instead where there’s tradeoffs between federated and decentralized.
Also instead of having to combine decentralization all into one application protocol, sometimes it’s better just being left as an external responsibility of an underlying network; in other words, just take what we already have, and combine them together: host a single-user fedi instance on Tor, I2P, or some other overlay encrypted meshnet, and you get some of the bonuses without having to invent a whole new protocol and whole new suite of cross-platform client/node software (which can take YEARS to iron out).

2024-02-09 03:05:43

Why do we have both context (not to be confused with @context) and conversation? Is that another Mastodonism or Pleromaism? context is defined in the ActivityStreams vocabulary specification, while conversation is not. In production implementations, they seem to just reference the same value.
It would have been nice to just have either of those resolve to a Collection of some sort, such as containing all the objects within that context, and instead of needing another property—replies to almost be a little redundant.

2024-02-08 00:28:48

- reply

I finally got around to digging into it further today:
There’s changes in Erlang OTP 24.3.4.3 that cause a bug with ‘middlebox compatibility mode’ in TLSv1.3, whereas with ‘compatibility mode’ it’s supposed to act as if it’s using TLSv1.2 even if it intends to use actually use TLSv1.3 (by doing a “Change Cipher Spec” after server/client hello), if I understand correctly. Nonetheless, there’s some internal logic in Erlang that screws up in that specific release pertaining to this.
The issue was fixed in 24.3.4.5
Meanwhile the OTP releases of Rebased seems to come with Erlang OTP 24.3.4.4 (affected by bug), and while the latest source releases pull in 24.3.4.2 (before the bug).
So I’m stuck with this until there’s another OTP build of Rebased pushed out, or have to switch to a source install.

2024-02-07 07:57:29

- reply

There is a chance it could be screwy things on my side with the Erlang OTP version and it’s TLS implementation or with Hackney and other middleware, nonetheless I stumbled across:
https://www.erlang.org/doc/man/ssl.html#type-middlebox_comp_mode
https://github.com/erlang/otp/issues/6241
and just tried limiting it to TLSv1.2 and it seems to be operational now. I don’t know if there’s something in the path to mastodon.social’s servers that has a hiccup with TLSv1.3. Either way, it’s something that changed late last year where I suddenly couldn’t get anything from mastodon.social anymore, while I hadn’t made any changes to my instance.

2024-02-07 07:48:58

Apparently the federation issue I’ve had with mastodon.social seems to presumably be with their CDN (Fastly) and TLSv1.3 use. After limiting this instance to TLSv1.2 for outbound connections, it’s now able to query content from mastodon.social

2024-02-06 08:42:00

- reply

Yes, something else than colons may have been preferable, however hexadecimal absolutely was a practical choice: you could split subnet allocations by each digit (4-bits), which you can’t do with base-10 dotted-decimal in IPv4. I’d argue it’s easier to teach subnetting with IPv6 than with IPv4.

2024-02-05 01:44:18

- reply

https://docs.python.org/3/library/ensurepip.html
I agree, the Python ecosystem just keeps getting more absurd.

2024-01-20 01:52:16

- reply

I’m probably the wrong person to pose the hypothetical question to, because I genuinely didn’t know they died, and barely even who they were.

2024-01-20 01:41:35

Now I'm randomly curious: does phenomena of Dunbar's number indirectly include parasocial connections and brand names too? Do the people that worship brands and celebrities therefore have much less 'mental space' for remembering actual people in their lives?

2024-01-17 01:15:52

“Enshittification” aka “I’m a moron that took the ‘always free’ bait of a VC startup, and act surprised every time when a service has to stop being a firepit of money, after startup funding runs out, and tries to squeeze money out of users that were expecting a perpetually free service; and instead of learning anything, I use a word to characterize platforms as being on an agenda of wanting to cripple/alienate users, and deflect responsibility for falling for the bait every time”

2024-01-16 22:38:54

- reply

Even after a rule change, I assume there’s not much hope for high-speed data transfer over HF beyond just short transmissions of text, since things have to use such narrow bandwidth. And then I assume with D-STAR/SystemFusion products in the 2m/440 bands, that much of it’s constrained by trying to fit data in like 8kHz or so (although I assume things could operate wider or so, but then it’s probably pissing people off for using up more of the band for one transmission), while people are used to the luxury of 20-40MHz wide data on 802.11 in the 2.4/5GHz ISM bands. Comparatively, I have no idea what the average smartphone uses in radio bandwidth for typical 4G LTE networks.

2024-01-16 21:54:11

- reply

I think we can get 128k over HAM radio.
There’s like hardly ever any hobbyist advancement of high-bandwidth data communication in the field of amateur radio equipment. A lot of it’s Disgustingly Proprietary(TM) protocols/software arbitrarily made up by each manufacturer usually going in their own opposite direction, and I think the most I’ve heard of (outside of people modding consumer equipment to operate in ham bands, such as with WRT54GLs long ago) is probably no more than 9600 baud for 2m/440 bands.
D-STAR is marketed as up to 128kbps, but that seems exclusive to just 1.2GHz (‘DD mode’?) band and likely point-to-point with yagis, while 3480 baud is the marketed D-STAR max data bitrate for a Kenwood TH-D74A (~$600, and no longer for sale?).
For perspective of transfer speed, I have an attached JPG of the mentioned radio (29,188 bytes, or 233,504 bits), as well as a smaller AVIF encode at 50% quality (13,560 bytes, or 108,480 bits).
At 3480 baud (bits/sec), that’s half a minute to send the AVIF image (108480/3480=31.17 seconds), or over a minute (233504/3480=67 seconds) for the original JPG.
Digital in amateur radio is pretty much just “buy this Kenwood product, buy this Icom product, buy this Motorola product”. I don’t think I’ve ever heard of folks actually building their own hardware in the past decade to do any high-bandwidth data, it’s all just lazy consumerism.
The sole utility it’s ever going to have is strictly text communication, but at least 3480 baud is a great luxury over acoustic coupling with fldigi (where we’re talking rates like 20 baud for MT63).
https://were.social/media/0934fb425304fa1dff25913362ae03ce56a861420d662a6ad440af9ed62c144e.jpg
https://were.social/media/0952e333c1d5381cde30a1633ceb97d7b9c33824c40c260882a563dba131a082.avif

2024-01-16 20:28:55

- reply

There seems to be a trend of people registering to PO boxes for quite some years, allegedly without any trouble, supposedly.

2024-01-15 01:18:38

- reply

and the humoring irony is that just by working as an independent contractor, you skip all of that. I’ve done work for colleges, universities, banks without any degrees or certifications (at the time), because just being a contractor skips HR entirely.

2024-01-13 02:10:06

- reply

Wait, secp256k1 (as in Koblitz curve, as used in Bitcoin/Ethereum, only meant for a specific narrow use and supposedly has much more ways to be easily misused, making key compromise easier) versus P-256 (secp256r1) or the much simpler/performant Curve25519? Was there a reason for adopting specifically secp256k1 in Nostr above all others?

2024-01-06 05:55:02

- reply

Works on My Machine™
Could just be a botched load of some important stylesheets that ended up getting cached, or some CDN hiccup. For some reason this seems to happen with just about any website now and then.
Edit: For context, this is from a Private browsing session, and I haven’t touched Gitlab for quite some days/weeks.
https://were.social/media/d2e1aecde937c91852b3b8242877978234d1dbbdc7bd384c56d3adc282a5828e.png

2024-01-05 04:39:06

That’s just unusually amusing: https://wordpress.org/playground/
Essentially building an in-browser equivalent of a LAMP stack, providing a full self-contained development environment of WordPress, with SQLite backend, Wasm build of PHP, and an internal JavaScript-based webserver, all entirely client-side.
It obviously doesn’t have any sense for production use, nor anything to do with self-hosting, but an amusing “just because we can” demo.

2023-12-22 00:42:44

- reply

I’ve no idea what the ‘correct’ one was; because the way it explains which ones were ‘failed’ are just vague categorical descriptions, like you see in @npub1f8l…7frq ‘s photo above. Edit: In fact, I don’t think I even given a summary of which ones were failed, in my results. Just the score, the score requirement, and PASS or FAIL.

2023-12-22 00:33:31

- reply

It may as well just be called “Windows+”. But nonetheless, in Security+ there is a handful of Linux CLI questions at least; though I just generally hate the nature of CompTIA questions in general. e.g. there was one question was like:
Which of the following is a valid iptables command?
iptables-A INPUT -p tcp --dport 22 -j ACCEPT
iptables --add INPUT -p tcp --dport 22 -j ACCEPT
Oh, but just “choose the answer that’s ‘more right’”!

2023-12-20 22:37:25

- reply

I honestly wish someone could just completely remake SQL syntax in a better way, or standardize some cross-vendor binary intermediate representation (that’d be natively supported server-side), or whatever else. It just all feels like a kludge, and I’m pretty sure we’re decades past the RDBMS wars now. It feels like a joke having to write code to generate a human-friendly representation of a query, that then has to be parsed back into something machine-friendly again; and more steps involved when it’s a prepared query (if I understand correctly). SQL itself honestly feels cursed.

2023-12-07 01:58:48

- reply

Obligatory video
https://were.social/media/818e7fde7f9bbe5d82221cf01c586a45cccbedc2eab12fca09a5116e28dc1c84.webm

2023-12-07 01:50:56

- reply

I call bullshit–no sane person natively from the midwest would say “casserole”, the correct word is “hotdish”.

2023-12-02 04:19:03

- reply

It’s honestly humoring in a way that this entire conversation is hidden from them due to The Great Fediblock Wall, while nobody inside their Great Fediblock Wall has figured this out these same points yet. Nor that any of us could even privately message them either.

2023-11-29 23:45:46

- reply

Just download everything worthwhile you find, because YouTube (and the internet at large) is now more amnesiac than some dementia-crippled geriatric. Even a few years ago I’ve found that at least 1/4th of my bookmarks would be dead links in just 2-3 years time.

2023-11-26 23:46:20

I guess I’m probably a masochist then for enjoying game titles that apparently offend game journalists/reviewers. I already have 13.6 hours into it, having bought it 3 days ago (on sale for $10 right now, instead of $25 MSRP). And typically I don’t care about games for the sake of challenge, but the environment design (especially later in the game), discovery, and ecology of all of it’s mechanics is something that’s an interesting experience.
https://were.social/media/24c405dff07ee4cfdc0e4dac752466185966ab5efb4b9b114d4959478e48b695.png

2023-11-19 05:49:17

- reply

Perhaps a property that contains an associative array that serves as a substitution table for any referenced object IDs or it’s children (if I’m not making a grossly bloated proposition)?
{
"type": "Note",
"id": "https://alice.example/objects/123",
"content": "This is a AP/DID polyglot post",
"inReplyTo": "https://bob.example/objects/567",
"didMap": {
"https://alice.example/objects/123": "did:key:zAbc123xyzBaSe64zyx/post/123",
"https://bob.example/objects/567": "did:key:z6ZxyBl0bofMu1tih4sh3tc/post/567"
}
}

2023-11-18 22:17:22

- reply

Or sorry, I should have read first: you did explain server-independent IDs in FEP-ae97 (I may have overlooked it in the past). I guess I’m cautionary in using DIDs directly as JSON-LD IDs, for the concern of breaking compatibility. I think a separate property could be used instead, despite it adding more cruft (although I don’t know a comparable solution for endpoints in an actor object). Or alternately there having to be alternate representations of objects (DID and legacy), which however would inherently be it’s own separate fediverse entirely.

2023-11-18 21:22:32

- reply

For server-independent IDs, would that be stored under another property name other than id, or something fully replacing the id or being appended to it and parsed?
If a server is receiving an activity, then it should inherently have some implied discoverability about where the activity is stored, if it wasn’t sent through a relay. I don’t know if there’s some supplemental identifier that could be associated to an instance that’s decoupled from DNS. Maybe a public key-based identifier for a ‘activity/actor storage server’?
For encrypting private data: perhaps start on a simple PGP-ish model, where payload is encrypted directly for the actor’s keypair. People may whine that it doesn’t fill every checkbox of their “demands” for privacy, but it would be trivial to implement, and some later “true E2EE with full forward secrecy” solution can come later as an optional upgrade. Perhaps there’d need to be a new object type (or something borrowed from vocabulary of other JSON-LD-based crypto specs) such as ‘EncryptedActivity’, maybe with an optional type-hint of what the payload activity/object type is (if it’s not anything somehow sensitive).
Ultimately, I do strongly believe FEP-c390 and FEP-ae97 is the inherent future for ActivityPub, or some light variation of it, and I really hope to see the current hack of HTTP Signatures (and especially the current one-key-only per actor representation, for a key that’s just an entirely server-held always-unencrypted private key in a database) to be gradually phased out soon (or at least a shift towards a ‘server key’ for HTTP Signature-based delivery, of something that can be locked down, versus the lie of a private key for each actor, that the actor doesn’t even control, in the current use of HTTP Signatures).

2023-11-17 20:47:00

- reply

Yes, that's a more direct and succinct explanation.
I hate the state of modern web applications, where it's now the "standard" for end users to do the developer's work for them, in the absence of something being properly packaged.

2023-11-17 20:35:53

- reply

So we already have software where: you just extract an archive on any standard hosting provider, load a webpage in a web browser for the web installer counterpart, put in basic info (first admin account, SQL login, etc) and have a fully ready fedi server? And you don’t mistakenly mean: order a VPS/dedi from a provider, setup Linux, install a specific Erlang runtime (or Ruby env), checkout a git repo, run a build tool to pull in dependencies, run some install shell scripts, edit config files in YAML or plain Elixir, feed an SQL file to PostgreSQL to create the needed database tables, add a systemd/sysv service and activate it, configure a reverse proxy from Apache/nginx to the newly spawned daemon, and a few more steps, and then you have a mostly functional fedi server?
At least there are some simpler alternatives to Pleroma/Rebased and Mastodon/derivs, but I’m sure I can go even further yet.

2023-11-17 05:36:42

- reply

Alright, which argument are you contesting now? The ability to coreboot recent hardware, or changing the argument to installing Linux/etc on a laptop shipped with Windows vs ChromeOS?

2023-11-17 05:29:25

- reply

Continuing: the topic was about Chromebooks displacing Windows’ marketshare, not anything implied of that trend being on any merit, just that it was displacing it and Microsoft continuing to self-sabotage their own product. There was the remark that ironically it’s an easier chance to turn an Intel Chromebook into a system with coreboot than any other Intel ISA hardware (versus digging for like +8 year-old motherboards, etc), and not even regarding anything to do with ChromeOS. But then you shove a non-sequiter of ARM Chromebooks about “why” people prefer Thinkpads, when I don’t think there’s people out there vying for ARM Thinkpads (if they even exist), and while it contests nothing about the Intel ISA Chromebooks, that’s all.

2023-11-17 05:22:01

- reply

Yet nobody was saying "how great they are", but yet you jump to fedi to find comfort and validation for repeating your side of the argument without context of what you were actually even arguing against.

2023-11-10 23:29:34

Here’s some predictions I have with soon (<2 months?) releasing a trivially deployable fediverse software, of what’ll happen later down the road after it’s released:
Instance admins will stereotype it as being “nothing more than a tool for abuse”
There’ll be instances that will try to auto-block anything that runs it
I’ll be shit on for “wrecking the fediverse” by letting people be more sovereign and independent from mentally-ill/abusive admins of mega-instances, and for rendering fediblock more useless. More instances might go whitelist-only.
Instance admins will try to dissuade users from emigrating to it, preaching that “but you need to be on my instance, you won’t ‘have wider visibility’ by being on the alternative, besides: you’ll most likely be auto-blocked” or “you’ll be ‘vulnerable’ to all the Nazis out there, you NEED my ‘protection’”.
None of this would be anything by-design nor intentional, it’d just be by mere nature of something that’s easier to deploy on standard hosting, compared to many of the over-architected/arcane predecessors.

2023-10-27 21:11:13

- reply

Especially moreso when you're on the other side of the Great Wall of Fediblock, when the exceptionally-miserable types wall themselves in with their server blocklists.

2023-10-24 23:31:02

It’s so grating how the lesson of #fediblock and such still hasn’t been learned/intuited by a majority of furry fandom yet. Everyone’s so quick to jump on the soapbox and complain about ineffectiveness of applying broad-sweeping blocklists when they’re negatively impacted by it, and try to speak in a noble manner of morals and principles. Yet, typically in barely a few posts/days later, are still defending much of it as a necessity to ‘solve the Nazi problem’, when it does absolutely nothing of the sort. Blocking “Nazis” (whereas that term is used in such a broad spectrum from: actual non-sockpuppet neo-Nazis, to ‘people I disagree with’, that it makes it meaningless) does not make them disappear, it’s no more than the logic of a child hiding under their bedsheets hoping for the imagined monster to go away.
If you look back into history of the fediverse, even back before ActivityPub became a thing (back in OStatus days): it’s a pattern where a lot of the heavily blocked instances ended up continuing to live on, while the over-moderated instances killed themselves off by crippling their user’s ability to intercommunicate per overprotective moderation. In fact, in the present day it’s where a lot of the ‘most active’ fediverse instances are the most blocked, and yet fediblock puts very little of any dent in it. You know what happens when you list an instance in a fediblock list? You irrevocably start to put them in the “banned” side of the fediverse, the space where people don’t have to walk on eggshells nor try to soften their words to appease the sensitivities of the more overmoderated instances.
On the “banned” side, there’s no point to try to cater to the fediblock crowd anymore, because that’s already been irrevocably severed. If you’re listed once, it’s just blindly recirculated to other lists, and never resolvable. So instead of “keeping the Nazis out”, whereas the practices of fediblock–you’re actually pushing more people to ‘that side’ of the internet, and causing the opposite of whatever ‘social justice’ endeavor you’re on. I’ve actually made far more genuine and authentic friends from fedi than I have from Discord and Telegram by far, majority of friends which are on the ‘banned’ side, versus being around the people that’ll ditch out from you at the moment of getting any ‘cancel culture’ labeling.
I almost feel bad for these people that wrap themselves so deep into such fleeting, fickle online associations (usually also chasing after parasocial relationships too). Always so quick to startle, offend, or whatever. The ever-moving ‘chase’ of jumping from Twitter, to fedi, to Bluesky just to ‘not literally be in a Nazi bar’, like some neverending Scooby-Doo monster chase scene. What is so staggering and harmful in witnessing word choices you disagree with? You can just shrug it off, ignore, and move about your day. It’s no surprise that anxiety disorders are so profoundly ubiquitous in the present, if people can’t de-condition themselves from going panic mode in stumbling across something they weren’t expecting. But yet people believe it’s a responsibility to hide any level of provoking content, as if it’s “protecting” them, instead of realizing it grows their phobias.
A fediverse server is not a private Discord guild, it is not a Telegram group, it’s to be handled as internet infrastructure like an email server, a backbone router, etc–you don’t interfere with legitimate traffic just because you disagree with differing viewpoints or lexicon, otherwise you greatly reduce the effectiveness of the network and just push people back to centralized services. If you want a moderated community then start a centralized forum, a chat server, or any other variety of closed-space communities.
If you routinely have problems being a center of negative attention, then: stop virtue signaling, stop acting as ‘internet tough guy’, stop doing ‘callout’ posts to provoke drama, stop openly virtuing every block you make, stop trying to make anything mundane to be political, and you will start to be virtually invisible to these people. This isn’t even just exclusive to posting online, some of it applies to in-person interaction as well. Generally only the miserable prefer to be around the miserable, and usually it’s the most miserable people that exhibit most of the aforementioned behaviors. Stop trying to act as some different personality online, and instead talk how you genuinely would in-person.
Self-reflect. Sometimes you may have character flaws that you can improve on; don’t fall into the bait of “feel good” content, or the narcissistic “you’re absolutely perfect the way you are, don’t change a thing”, else you stunt yourself from self-improvement.

2023-10-24 19:33:36

- reply

I might have a somewhat unpopular opinion, but: perhaps the slower nature of the network isn't so much of a problem. I think it's people's obsession of "I want it now, and I want it as fast as possible" is more the problem. Just queue up like 30GB of torrents on I2P before going to bed, and it's pretty much complete by the next day. Much better than having to pay for a VPN proxy service on clearnet, that probably still won't actually provide any protection (such as false 'no logging' claims, sidechannel weaknesses, etc).

2023-10-24 19:27:26

- reply

Oh neat, I think this makes using alternate I2P router implementations more practical as a result as well, given there's so much bundled in the Java implementation that makes it hard to replace.

2023-10-21 04:04:15

- reply

Or adding with the more important detail: LFCS and LFCE are actual proctored performance-based certifications, requiring a person to actually execute the requested tasks on several server VMs, rather than a multiple-choice test (like with CompTIA certs).
There's usually like +50-80% off discounts on Black Friday or Cyber Monday for LF certs.

2023-10-15 02:45:37

- reply

Yes, it's just the issue of a lot of the pro-AI community seeming over-reliant on things in a mantra of "oh, stop making it difficult for yourself, just use Google Colab", or other hosted options, seeing zero risk in any of it, expecting it all to always be free, and only writing guides reliant on said hosted services, instead of guides of doing things completely standalone, such as training LoRAs, etc.

2023-10-11 17:00:47

- reply

No no no: I think what you mean is you hate Google (or any meta search engines atop it, like DDG, StartPage, etc). It's Google's mistake to give up on PageRank, site age, and other things to be the key important factors, and to instead recently be focusing on "content freshness". They prioritize more on floods of new content now, rather than well-established high-reputable (by PageRank) webpages/websites now. It also makes searching documentation for legacy systems almost impossible now.

2023-10-09 18:41:47

- reply

DRM and anticheat has been like the lead cause of all problems, even on the targeted platform of Windows itself. There’s plenty of the older games I have from younger years that were a task just to get working on Windows again, such as with ‘Safedisk’ DRM with Sim Theme Park, where you can’t even get past the first loading screen, without several patches or third-party edits just to get it launchable, in Windows.
I agree that Wine/Proton shouldn’t be the end-all solution, meanwhile as Proton came about, it seems like developers just stopped bothering to care about native builds, and too much of the community has grown complacent with Proton. But there’s also the flipside that: ironically older Windows APIs are long-term supported (also just because it’s a clearly distinguished target; a la Win7 or something), and thus it just ends up being ‘easier’ supporting something Windows-only, unless you practically ship a Docker-ish container of userspace libraries your game needs to run on, which Steam on Linux honestly somewhat is: each of the Steam Linux Runtimes (scout, soldier, sniper, etc) are just specific version-froze distro userspace libs, which a developer can target and have assurance is going to be long-term supported.
Compare with plenty of the early Humble Indie Bundle games with DRM-free Linux native builds, where plenty of them are incredibly difficult to natively install now (including having to pull in all the 32-bit libraries, and more), or not at all (because of dependency issues on a no-longer provided version of a library). Thus Linux gaming is primarily down to Valve; there could just be similar community efforts of having an alike container environment (of the same distro targets as the Steam Linux Runtimes) perhaps, to just become the norm for shipping games on Linux, otherwise I don’t know what else there is for options. Flatpak already can do some/all of that, there’s just no specific options decreed as ‘the standard options’, otherwise you’ll end up with probably like 13 different Linux userspace environments installed for like 20 games or something.

2023-10-09 07:04:27

- reply

So, because you installed VRC on non-Flatpak Steam and had trouble, that inherently nearly every game on Linux is a clockwork to install? Very literally every game I've bought in the past 2-3 years is a "click Install on Steam, and it Just Works" experience. The only hiccup I've had is some issue with Super Animal Royale which just entailed using a newer Proton version.
Maybe ask for help, rather than fuming in silence, and then doing the typical tech-boomer blow-up when you reach your breaking point.

2023-10-09 06:34:25

- reply

Either way, it is helpful that Valve managed to work things out for EAC and BattlEye to make a lot more of the 'popular normie titles' playable on Linux, even plenty of recent titles. Although I don't know if Epic's acquisition of EAC is going gradually to turn the situation to crap again.
Nonetheless, anticheat systems have grown to practically being malware for the over-invasive degree that most of them operate. There's already been vulnerabilities with an anticheat system barely years ago, and yet normies are totally fine with all of this:
https://search.brave.com/search?q=genshin+impact+anti+cheat+vulnerability

2023-10-09 06:18:08

- reply

Or use Flatpak Steam, which specifically has the EAC-enabled Proton build, if I’m not mistaken.

2023-10-09 06:17:04

- reply

Maybe have patience, instead of darting right to social media to whine and complain upon any stumble.

2023-09-28 20:02:15

- reply

Oh boy, that’s definitely a confusing surprise (screenshot as attached, with “Counter-Strike 2” selected, apparently in the place that CS:GO was, but still showing the CS:GO banner)
https://were.social/media/e4867282827dd75318347976ee950803136514db24639432d733c33a80092af6.png

2023-09-24 19:00:16

- reply

I think algorithmic prioritization/hiding of content is the actual culprit (likewise affecting Facebook, YouTube, etc whenever they also opened Pandora's Box), that's when online social discourse universally went downhill.