Dr. Hax

Signet maintainer. Self-custody your passwords... in hardware! https://hax0rbana.org/signet

Cypherpunk. Infosec veteran of about 15 years (vulnerability research, exploit development and cryptography). Cypherpunks write code.

Bitcoin user since 2012. Want to see wider adoption so Bitcoin can be used as digital cash and not just an investment vehicle.

XMR: 44RDkTFmTeSetwAprJXnfpRBNEJWKvA5dBH5ZVXA4DofgoZ9AgjyZdSa2fo7pMD3Qe3pdKga8X22y3Lyn1xYde5kPQPzVUu

Public Key

npub16v82nr4xt62nlydtj0mtxr49r6enc5r0sl2f7cq2zwdw7q92j5gs8meqha

NIP-05 Address

[email protected]

NIP-57 Address

[email protected]

Profile Code

nprofile1qqsdxr4f36n9a9fljx4e8a4np6j3aveu2phc04ylvq9p8xh0qz4f2yg2hwmn8

Publishing to

nos.lol

relay.damus.io

Author Public Key

npub16v82nr4xt62nlydtj0mtxr49r6enc5r0sl2f7cq2zwdw7q92j5gs8meqha

Show more details

Last Notes

2024-06-26 02:33:30

- reply

I've set up an OpenVPN client in a Qube and that went well, but I haven't tried anything coprorate.
In the past I've had multiple qubes going through a single VPN, but when I tried to set that up recently, the qube that should have been behind the VPN box didn't have a network connection.
I didn't have time to investigate what was going on, but I plan on coming back to that soon. That VPN is increasingly becoming a nice-to-have for me.

2024-06-24 19:31:03

Wouldn't it be cool if every link you clicked in your email opened in a VM that was automatically created just to look at that one link and automatically deleted when you were done? And this process didn't take much longer than opening a new browser? if the link is malicious and the browser is exploited, there's no data in that VM to steal. No cross-site cookies left over from previous browsing sessions, no inadvertently being logged into the wrong account, and no tedious management to get these features.
It already exists and I've been using it for years. It's the Disposable Virtual Machines (DVM) feature of #Qubes. You don't have to use it, but its there if you do. Spread the good word, my fellow #privacy advocates. And if you want help with setting up or using Qubes, there are people here on #nostr that are willing to help. I'm at least one of them. 😆

2024-06-24 02:32:04

- reply

Remember that everything is public except DMs and everything is undeletable in practice.
Block/mute early and often
Follow people if there's even a chance they might post something interesting, you can always unfollow later, but finding them again is non-trivial
You can use privacy software like Tor here, and some clients even make it very easy.

2024-06-22 06:45:50

Is Alin Armstrong on nostr?
https://www.amazon.com/Bible-Bitcoin-Theological-Exploration-Energy/dp/B0CGTWL38H

2024-06-21 05:44:27

A Rusty Nail is one of those drinks that should last a while, being 2.5 fl oz of hard liquor and all, but it's so delicious they seem to disappear very quickly.
For those playing along at home:
2 fl oz bourbon
0.5 fl oz drambuie
On the rocks

2024-06-20 03:57:55

- reply

Huh, seems early for garlic harvesting, no? I thought that was like an August or September crop.
Or do you just have so many that you just pick 'em whenever you feel like it? Because if so, 😍

2024-06-19 09:57:19

- reply

Are you in the Southern hemisphere?

2024-06-19 02:06:24

- reply

Yes, I believe so, but only relays operating out of the EU.
If the relays were to block DMs, I think they should be in the clear as that's the only thing that is end to end encrypted.
The node operator **could** make the argument that the **clients** are doing the encryption and that they have no control over which clients people use, but that'd be a pretty risky legal argument, especially if there's no client in existence that could possibly comply with this law.

2024-06-17 22:50:38

Today I released a new version of the #Signet client for #Linux, #Windows and #macOS. The biggest change is compatibility with #ScreenReaders, but there's also improvements in search and a few others small things. The search is vital for me since I have over 350 passwords in my own personal device!
Full release notes are here:
https://gitlab.hax0rbana.org/signet/signet-client/-/blob/trunk/release-notes/signet-release-0.9.20.md?ref_type=heads
And if you are wondering "what's a Signet", read about it here https://hax0rbana.org/signet/ or check out the 2 minute explanation video: https://odysee.com/@Signet:8/signet-password-manager-introduction:c
#a11y #accessibility #OpenSource #FOSS #OpenHardware

2024-06-17 08:50:56

#ChatControl (the proposed EU regulation which would require backdoors to encryption if it can send a video, picture or link) is set to be voted on June 19th.
They've been trying to pass this for the last two years and it looks like it might happen this month.
If passed, it will affect people around the world.
More info and suggested actions for how to resist available here: https://blog.cryptpad.org/2022/05/19/against-chatcontrol/
The only good news I have for you here is that the law currently targets "service providers", not "software developers" or "end users" (directly). Developers who also run a service, or get income from service providers will be affected indirectly.
The tactic being used here by the lawmakers is to starve developers of funds so they have to stop working on open source projects and get a so-called "real job". There are not many options for directly stopping developers from writing and sharing code, but this is a pretty effective way to slow down development and try to burn out open source developers.
Source: https://social.cryptography.dog/@ansuz/112630461011248734

2024-06-17 04:40:58

Got the #Signet Windows and MacOS builds done, signed and uploaded.
Linux and Windows releases are well tested.
I did some testing on my development machine for the Mac version, but still need to go test it on a separate Mac to be sure. I've seen problems in the past where it worked on the build box but not on another Mac.
Once testing is complete, I'll update all the links on the website. If you want it now, just change the 0.9.19 to 0.9.20 in the download URLs.

2024-06-16 21:39:36

- reply

It is better to share your key fingerpint, and @npub1ajd…dt20 is spot on about having to publish your public key.
Message + public key = cipertext
Ciphertext + private key = message
So we need the public key to encrypt (and you need the private key to decrypt).
Sharing your fingerprint is how we search for your public key on PGP key servers.
We can also search for keys by email address, but since anyone can upload any key and claim that it belongs to your email address, we want to get the fingerprint directly from you to make sure we have the correct one.
Handing over your fingerprint used to be done in person, but I guess those days are largely behind us now. 🫤

2024-06-16 00:33:41

Just fixed opening a #backup file in the #Signet client without any #hardware connected (e.g. if your device is lost/destroyed and you need your #passwords so you can order a replacement).
That, plus:
- #accessibility improvements to be compatible with a screen reader
- fixed device detection without having to restart the client on #Debian 12 (the only place it broke)
- #developer #documentation
- and some odds & ends
Version 0.9.20 release in progress now! 🤓
#FOSS #OpenSource #OpenHardware #value4value

2024-06-15 19:22:08

If you've ever been to #Berlin and not had Döner kebab, you are missing out, my friend. It's the best street food in town.

2024-06-12 22:26:54

As someone who grew up when only doctors and drug dealers had pagers (and later, cellular telephones), some things still strike me as being bizarre.
For example, buying things from someone used to be that you gave the person money (which we now call "cash") and they're give you the object.
Now, people need a big tech/finance company who decide whether these people can do business, or even make a donation! Sexy photos? PayPal says no. A hunting rife for your daughter? Nope. Wikileaks. LOL, no.
For legal purchases, it seems very strange that a private company would decide what is allowed. It's stranger yet that most people think this is just normal and acceptable.
I've been enjoying buying things from local establishments whenever I can and paying in cash. It's not that I'm trying to hide the quantity of shredded cheese I buy from the grocery store, which local artists I support, or how much I donate to non-profits. It's just a return to a simpler time and a way to stick it to big corporations and data collectors.

2024-06-12 20:09:19

- reply

I have used both #OpenSCAD and #FreeCAD and I use FreeCAD for things I design from scratch. I can brush up on my OpenSCSD skills to modify an existing part though.
They are very different programs and they have distinct learning curves!
Different workbenches in FreeCAD will be better or worse depending on what you are modeling. Generally speaking, I'd suggest starting with the Part Design workbench. Once you get the hang of the basics with one workbench, it's easier to make sense of the other workbenches as you branch out.
I'm glad to see othe #CAD modelers on here. Giving you both a follow now. 🙂

2024-06-12 02:10:13

- reply

I take it that it is the set screw whose hex derive that is stripped?
I'd suggest screw extractors.
https://www.mcmaster.com/products/easy-out-extractors/
In case you are not familiar with them, they are reverse threaded and tapered. As you push in and turn them with a hand tap wrench the threads dig into the inside of the hole that you drilled into the head (or in this case, possibly directly into the hex hole). Once it grips, it'll be easier for the threads to move than for the screw extractor to dig in further.
Might want to hit it with some lubricant (deep creep, WD-40, etc.) before you start.

2024-06-11 00:33:27

I made a bunch of small improvements in the #Signet client today:
- Detect when devices are plugged in on Debian 12 (they changed something in version 12 and I had to make changes in the Signet client as a result)
- Search looks in group names in addition to account names
- When selecting the firmware file, only show files with a valid firmware extension
- Fixed the default filename when making a backup

2024-06-10 19:35:28

This was a great decision. I feel refreshed, both mentally and physically.
I hope I remember this in the future and actually make this a habit.
#nevent1q…2axj

2024-06-10 06:49:12

- reply

I'm glad I follow you and see these reminders from time to time. 🫂

2024-06-10 05:42:25

I took the day off today (mostly) and it felt good. Did some weeding, string strimming and cleaning, but mainly I just hung out on the back patio, in the shade, on an 80°F breezy day, chatting with friends and neighbors who stopped by.
Low effort, chillaxin'. And I didn't even feel guilty about not being very productive because hanging out was what was on the schedule.
Yup. Today was a good day.

2024-06-09 17:19:39

Changing the tab index order was trickier than expected, but I got it done yesterday. The #accessibility changes have been merged into the default branch, and improved documentation too.
I'll have to go through the open tickets to see if there are any more that I want to get in before a release is cut.
https://image.nostr.build/b87896d6eca0f277b5d2e6f75ff8f47eb2155a2216a5b8c32aee59abd119e3f8.jpg
#nevent1q…fsv6

2024-06-08 19:19:20

Ah yeah, time for another #signet #saturday! Hope to be able to get #ScreenReader #compatibility done and ready to merge today.
Then after that, it'll be merging in all the #documentation that was created while getting familiar with the code base.
Followed by cutting a release and then creating additional documentation
More docs will make it easier for developers to join in, security experts to assess the design & implementation, and users to feel confident in the system
#a11y #accessibility

2024-06-08 19:06:12

- reply

Yeah, I'm very curious to see how it is implemented and enforced if/when it passes.
#Signal said they'd pull out of anywhere that passes a law like this. But even with just this one example where a single company is doing the #development and running the centralized server, it's unclear what that would look like.
Sure, tell Apple & Google to disallow IP addresses in #EU from downloading the app.
Will Signal also feel compelled to block IPs from the EU from accessing their servers? Will they be required to block all VPN users, worldwide as well since there's some possibility the end user might be in the EU?
Will #Microsoft #GitHub ban people in the EU from seeing the source code or downloading releases of every app that has #e2ee and no content scanning code?
What does this mean for #Nostr #software, which has e2ee DMs? For relays inside or outside the EU?
And to be clear, I'm asking how it would work for people who want to attempt to comply with the #law. The answers are easy for those people taking the civil disobedience route.
I am also not asking whether people should comply with the law. We all have our own opinions on that and that's fine. I simply want to understand who would be legally required to make what changes.

2024-06-07 23:53:49

- reply

I can't remember which article I was looking at yesterday, but here's a summary from the EFF.
https://www.eff.org/deeplinks/2024/06/eu-council-presidents-last-ditch-effort-mass-scanning-must-be-rejected

2024-06-07 03:59:37

Whenever browsing sketchy websites, be sure to use a #DVM
Also use a DVM when installing questionable software on your computer.
There are tons of uses for Disposable Virtual Machines, and #QubesOS makes it extremely fast and easy.

2024-06-07 03:51:34

If you thought #MassSurveillance was bad in #America, you're right, but Europe is trying to catch up!
They're considering this #ChatControl that blocks you from sending video, pictures or links unless you consent to having all your messages scanned.
Shit kinda sucks everywhere right now.

2024-06-06 23:41:43

I started by wanting to subscribe to Daniel Batton's newsletter and here's how it's going.
His website (batcoinz dot com) hard blocked me because I use privacy software (in this case, Tor). No captcha, just can't connect to the site. Oof.
After circumventing this network control, I found I could not pay in Bitcoin. Credit cards only.
So then I go buy a prepaid credit card from bitrefill. Some of the links in their order email didn't work right but eventually I got the card. I subscribe to Daniel's newsletter and on the 4th attempt an trying to log into/sign up for substack, it finally works.
What do I see then? An option to pay in bitcoin to subscribe to the newsletter. 🤦‍♂️🤷 Whatever, I was successful at giving him my money, despite it being very difficult. That's the real point here.
And as a bonus, I now have that prepaid card in a Google Android phone (apparently tap to pay doesn't work with any version of Android except Google's, which is 🤮). We'll see if ot works...

2024-06-06 05:47:51

- reply

I have followed many of the same people as you and I follow various hashtags, but for at least the past few weeks it's been very sparse.
Maybe it's just that it is planting season now and a lot of gardeners are too busy to hop on social media. Plus few people are harvesting crop this early in the season, so not as much to snap a picture of fof another month.

2024-06-06 05:34:57

- reply

I enjoy people posting about their gardens, mesh networking projects (be they 802.11 based, LoRa based or something else), novel infosec research or developments (e.g. exploits & defenses), people trying to replace all their coprorate technology with open source systems (GMail, Nest, YouTube, Windows, AWS, and the like).
I see this from time to time on here, but I crave more. 🤓

2024-06-06 05:30:23

- reply

I mean, you're not wrong... 😅

2024-06-06 05:30:00

- reply

I know, some people post pictures of their dinner, or their garden, but most of the posts in English are those three categories in the global feed as well as my own.
I try to #GrowNostr to help get more interesting things to peruse.

2024-06-06 05:26:23

Imagine building a censorship resistent decentralizded network and then it's almost exclusively used for:
1. Talking about the network itself
2. Bitcoin
3. Bots, most of which are basically just an RSS feed

2024-06-04 05:41:05

- reply

Why are 3,6 and 5,6 the same picture?

2024-06-04 05:36:43

Fixes today:
1. Valve stem light on my bicycle
2. Picture frame
#repair doesn't have to be some complicated thing. Just fixing simple objects is respectable.

2024-06-03 04:29:58

- reply

Seems like just blocking the bot would suffice, no? You can't censor the bot, but that doesn't mean it ever has to show up in your feed.
The bot seems pretty pointless to be honest. Even for people who think the idea of content labeling is wonderful, unless clients have a way to filter out content that the bot replied to, then the only point seems like it'd be to supposedly appease Apple and Google, I guess.
And I'm not trying to defend this bot, I'm just trying to understand their argument, and it just doesn't make much sense to me. 🤷

2024-06-03 04:21:29

- reply

Hate to break it to you, but someone replying to your post to say something you don't like is not censorship. It might be a jerk move, discourse, a debate, enlightening, harassment... but it's not stopping you from posting anything.
Feel free to call anything you don't like "censorship" though. Like I said, nobody can stop you. 🤣

2024-06-03 03:53:25

- reply

I think that bot is just a troll who is dying for attention, because neither NIP seems to be about content warnings or language...
NIP-068 Blinded Nostr Assets
and
NIP-69: Bringing BNS Names to Nostr
https://github.com/nostr-protocol/nips/pull/250
https://forum.stacks.org/t/nip-69-bringing-bns-names-to-nostr/14293

2024-06-03 03:44:20

Run your own mail server
https://www.kickstarter.com/projects/mwlucas/run-your-own-mail-server

2024-06-03 02:54:49

- reply

Yes. If you don't need direct network access to your IoT things this is a great option (e.g. if they are all controlled by some server on the internet). Then they can be completely isolated from your local network. That way when they get compromised, the damage is contained.
I do not like that type of IoT device myself. I prefer something where I can be confident it's not going to be connecting to random servers out on the internet. So for the things I run, I want to be able to access them from the local network.
So which network setup is preferable will depend on your situation.

2024-06-03 02:45:36

- reply

I've started building an OPNsense box to replace my enterprise router on similar hardware. I needed more ethernet ports for more zones, but otherwise very similar.
I have lots of complicated rules in my existing router that need to be ported over and testing is going to take a while, but it'll be worth it in the end.
And as soon as it's set up and working properly, Im going to wipe it and restore from a backup. Because I'm the type of hacker who tests my backups! 🤓

2024-06-03 02:37:47

- reply

Like, people would have to select their CW from a list instead of just typing in whatever they wanted?

2024-06-02 23:02:46

- reply

If I am ever in the PNW, I want to stop by your shop. It looks beautiful

2024-06-02 23:00:23

I think #nostr is to social media what #EFnet is to #IRC.
But I'm not sure anyone will even know what that means nowadays. 🤣

2024-06-01 20:00:01

https://image.nostr.build/72e2c3dbd95b819a54313d7f9d0a80074ed982b8ac4c3eed1e7c3417687147ef.jpg
What have we here? Is this a #LoRa #radio stacked onto a #RaspberryPi pico? I think it is. 😁
Will it soon become a #meshtastic node? I think it will. 🤘

2024-06-01 19:53:41

- reply

OMG, DVMs are not Disposable Virtual Machines?! All this time on Nostr people have been talking about a Data Vending Machine (whatever TF that is)?

2024-06-01 19:51:46

Wow, this it's amazing to see people taking such a huge risk to make the #bitcoin #CircularEconomy work!
#nevent1q…w8uv

2024-05-30 20:38:11

Today's music: Gravity Kills
More specifically, their self titled album

2024-05-28 00:23:06

- reply

Yeah, nostrastic is the onky bridge that I know of for LoRa, however I do have in my notes that there's nostrmesh, which uses an 802.11 based mesh running on ESP-32 boards.
https://github.com/lnbits/nostrmesh
Shorter range, but higher bandwidth.

2024-05-26 00:38:42

- reply

Oh thank goodness, the economy is saved!

2024-05-25 23:26:10

- reply

I know, it's not all abiut tracking, but also about the distractions, disruptions, an so on. Still, I couldn't resist. 😈

2024-05-25 23:25:01

- reply

Yes, the rest of us who do this need some cover. 🤣
Cop #1: OMG, that person doesn't have any RF signature!
Cop #2: oh, that's probably just Dr Hax, if we get any calls about him, his address is on the dash
Reference: https://xkcd.com/1105/

2024-05-25 19:08:32

#Signet #Saturday will be starting late today.
My plan is to make the little demo app more like the Signet client until screen reader compatibility breaks. Then I will know what part of the code I need to change in the client.
My first guess is going to be the event handler that is handling keystrokes. That's currently being overridden in the client to allow typing to search for password entries when the focus is not in the search field. I like that functionality, so I'm going to try to make sure to preserve that. My best guess is that I just need to send a signal to something to tell it that the selected item has changed and it'd be appropriate for the screen reader to read the new text.

2024-05-25 03:37:31

- reply

You do realize that the only reason Signal added usernames in the first place was because of privacy advocates like myself calling them out on it, right?
It took many years before they finally added usernames, and their system is better because of it. Now the same privacy advocates are calling for them to finish the job and removing phone numbers entirely.
Many of us also feel like Signal should move away from centralization, allow the 100% open source version of their app to be published in the official F-droid repos, and a number of other improvements.

2024-05-25 03:21:24

- reply

Wow, you're just doubling down with the personal attacks instead of simply proving me wrong.
All you have to do is explain how Signal sends an SMS to allow users to recover from a lost phone when Signal supposedly doesn't have access to anyone's phone number.
Feel free to reference the code if you'd like. I've did security audits on the library, Android and desktop apps years ago. But if the Signal developers added code to send an SMS to an encrypted phone number, I'm sure the crytographers of the world would love to see it.

2024-05-24 19:41:49

- reply

Haha, I described the functionality of the system and you get big mad, call it a wild accusation, and say it's nonsense.
It seems like it's you who needs to get a clue or STFU.

2024-05-23 07:00:28

- reply

Just in case this isn't purely comedic, I just want to mention that an aluminum foil hat is basically a satellite dish that focuses any transmissions.
Gotta be totally encased to get the desired effect.
But aluminum foil really does work incredibly well. It's better than a microwave.
Feel free to try it out at home. You can do something as simple as streaming audio over the network and covering up the phone until it stops. It could be fun for the entire family!

2024-05-23 06:53:02

- reply

I'm highly skeptical of that paint being as effectivr as it claims, but the moral of the story here is: whatever you do, make sure you test it to verify it works as expected.

2024-05-23 06:46:13

- reply

It was good, but to be honest, I liked District 13 (aka Banlieue 13) better. 🤘

2024-05-23 03:13:30

- reply

Someone responded saying my report has been passed along to the online store team.
While I think this was a colossal oversight, I'm holding out hope that they'll acknowledge these terms are absurd and that they're going to work towards changing their store so this information is no longer requested from their customers.
We shall see.

2024-05-21 07:23:14

Okay, Microsoft unironically suggesting the telescreen is something people want is where I draw the line. I'm calling it a night.
For those who don't know what this is about or why it's bad news, check this post out:
https://emacs.ch/@ramin_hal9001/112476449580840572
#1984

2024-05-21 06:04:04

I see North Carolina is about to ban wearing masks in public. I bet the facial recognition companies are thrilled, along with the police that use such technology at #protests.
https://www.nbcnews.com/politics/politics-news/proposed-north-carolina-law-make-illegal-wear-masks-public-rcna152671
Glad I don't live there. #freedom

2024-05-21 02:51:00

Did you know...
https://4d2.org/ gives out free Matrix accounts? They'll also hook you up with an email address, webhosting or shell. Don't abuse it. Honor the cypherpunk code.

2024-05-21 02:25:01

- reply

Not with that attitude! 🤣

2024-05-21 01:19:24

I can't imagine what it must be like to be a #Facebook user who is pro-human rights right now.
https://www.middleeastmonitor.com/20240418-israel-using-metas-whatsapp-to-kill-palestinians-in-gaza-through-ai-system/
To know that they are contributing to Meta's bottom line, even if they give a fake name, it has to weigh on their conscience.
If they haven't left by now, it's probably because they feel like they are locked in.
I hope they find #social #media platforms like this one so they know they have a choice to drop #Meta and still be socially connected. 🫂 #GrowNostr

2024-05-20 08:29:03

- reply

This is literally what they are trying to force people to agree to:
"you must grant Onfido Inc. and its affiliates (together, Onfido), the service providers listed below (Providers), and the owner of this website/app (Company)
consent to collect, capture, obtain, possess, store, use, process, disclose and re-disclose (Process) your Biometric Data (defined below) and other personal data, including sensitive personal data (Personal Data), for the purpose described below."
I did not think an organization like 2600 would even agree to do business with a company like this. 🤮

2024-05-20 08:22:56

WTF? 2600 mag lets you pay with cryptocurrencies like Bitcoin, but you have to upload photos of yourself to do so...
Nope. Hard pass.

2024-05-20 02:30:15

- reply

Nice. I was thinking of pulling out rebar from the ground. Similar concept. All about the leverage.
Thanks for sharing!

2024-05-20 01:33:07

- reply

The video isn't playing for me. Is it vise grips and a lever?

2024-05-19 07:54:40

- reply

Damn, you're stacked now. Now I kinda want to sell some coin and follow suit.

2024-05-19 07:39:05

- reply

Just a heads up that the site gave me a 403 error just now.
https://image.nostr.build/fb6548a89c4d7ce2259941cfceedf7f564a8a76a90803a90e364c24cfa629f9a.jpg

2024-05-19 07:28:37

- reply

Another tiny step in the right direction: I'm seeing requests to my code come through with the Role AccessibleText, but only when I have the screen reader turned on. And this is being requested of the items in the tree, not the tree itself.
This is good news. The punchline is that it was not returning the correct value for AccessibleText previously and now it is.
The screen reader still isn't reading off the entries of the selected item, but I know I fixed one problem with the code.

2024-05-18 22:35:10

- reply

Derp. Turns out the company trying to get my personal info was just going to let me download an open source program with some of their extras bundled with it. Haha, fuck no.
I got the #FOSS version and it compiled the demo just fine and it works acceptably well with a #ScreenReader.
Now to figure out how their code works and determine how it's different from mine. I feel like I have a chance at being able to complete this task someday!
#motivation #programming #GrowNostr

2024-05-18 22:10:23

- reply

Well, I emailed the author. They have not touched the repo in 5 years, but hopefully they still have access to that email address and will be willing to respond.
In the meantime... once more into the fray

2024-05-18 21:48:20

- reply

Crap. The demo app uses some propritary IDE which defines the UI in an XML file. 🤮
I can't even get a demo with a privacy email address like sharklasers.com
I guess I can just manually dig through the code to try to match up XML elements with CPP classes, but I have a feeling this is going nowhere fast!

2024-05-18 21:19:10

Is privacy worth it?
https://blog.thenewoil.org/is-privacy-worth-it

2024-05-18 20:24:41

- reply

I found a QT tree demo app, but I'm not sure if it is compatible with screen readers. Still, it might be a reasonable code base to start tinkering with to better understand how things fit together. Plus, I might be able to ask the author questions.
I'll probably spend at least a little time exploring this to see if it might help.
Hopefully they don't force me to use some weird IDE and build toolchain. It's really nice to be able to just use vim and Make.

2024-05-18 20:21:34

It's #saturday, so I'm back at it again, working on this last critical bit of #accessibility for #signet.
Today I started by using my screen reader with the file manager. It has a tree view. What does it say as you navigate throughout the tree or expand/collapse items? Now I know.
Of course my file manager is #OpenSource but unfortunately it uses GTK, not QT. So the code probably won't be very useful to peruse.
If anyone knows anyone who has done QT accessibility work, please connect us. 🙏

2024-05-17 23:54:25

I don't know who needs to hear this, but if you are storing the backups in the same location as the originals, you should probably think about that for a moment.
#nevent1q…tksc

2024-05-17 23:25:51

Risks of hosting in someone else's #cloud:
The provider deletes your entire account and all your backups for no reason.
https://arstechnica.com/gadgets/2024/05/google-cloud-accidentally-nukes-customer-account-causes-two-weeks-of-downtime/
If it can happen to a $135 billion dollar pension fund, it can most certainly happen to you.
#cyber #CyberSecurity #CyberRisk #infosec

2024-05-17 05:23:37

Pasta is only an easy meal if someone already made the pasta and you're just cooking it.
Rolling out your own dough, flattening it, slicing it and hanging it to dry. That is a real home cooked meal there!
I don't think it is worth the time & effort, but I did make some a few years ago mainly to see if I thought it tasted beter, but also so I knew how to do it. I feel like spaghetti is unlikely to be affected by supply chain issues, but you never know.
Also, I did find hand made pasta to be slightly better tasting, but not so much that it was worth the extra effort.
#cooking #food #foodstr

2024-05-16 09:02:38

A pleasant side effect of dehydrating fruit is that the entire house smells AMAZING.
#nevent1q…s7rt

2024-05-16 08:44:09

- reply

I have a lot of reapect for Dan Goodwin. He interviewed me in 2012 when we destroyed reCaptcha with a 99% success rate, understood the research, and wrote an accurate article.
I've also seen bits and pieces in his articles over the years that reaffirm this perspective.

2024-05-16 08:23:26

- reply

The baseband does not have access to the microphone. It's just the chip that handles connecion to the cell network, similar to how the wifi handles connecgions to access points.
However, the baseband can see any traffic that is unencrypted, just like the telco can. This means if you're talking over a plain old telephone service (POTS) line, the baseband can hear what is being said. However, a call to the same person over Jitsi, Matrix or a similar service would be encrypted and the contents would not be accessible to the baseband.
Your solution of using a hotspot has the advantage of separating out your telephone service from your internet connection. This means the phone number you give out to people could be a VoIP line that is not associated with your cellular service provider.

2024-05-16 08:05:23

- reply

A freezer would be unlikely to work. https://yewtu.be/watch?v=PlB4LGLtRQM
But wrappen in aluminum foil, in a galvanized trash can with foil tape holding the lid on... now you're talkin'!

2024-05-16 02:08:08

- reply

#StrawMan

2024-05-16 02:07:19

- reply

I think it was aluminum. I can at least say it was non-ferris.
Dish soap was just grocery store dish soap, like ajax.
It made quite the mess

2024-05-16 02:05:14

https://i.imgflip.com/8q7cfv.jpg
#Signal #Privacy

2024-05-15 21:12:18

Do you have SSH enabled on the machine that runs your bitcoin node? Know the risks.
https://arstechnica.com/security/2024/05/ssh-backdoor-has-infected-400000-linux-servers-over-15-years-and-keeps-on-spreading/
This malware:
- Profited off of compromised bitcoin nodes
- Also stole credit card numbers
- Was able to bypass egress firewalls
- Exploited weak passwords (among other things)

2024-05-13 23:27:05

It's been a while since I posted about food preservation. Fortunately there was a sale on strawberries a couple days ago.
https://image.nostr.build/71acae8e9624f7bf69052e19f2084a649764cf583c69d6a78cfa5d0778a9f691.jpg
That was about 2 lbs of strawberries ($3.29/lb, on sale for $1/lb) and a fair amount of labor in washing, coring, slicing and dehydrating them.
https://image.nostr.build/3d64cd2d5eafe57ac9eb307d16da99148ff7c9baa98a8943448ab80cef41ac84.jpg
I expect these would last for months or years if they weren't so delicious. They taste every bit as good as they look.

2024-05-13 22:24:22

I took a short break from #accessibility work to make some changes to a new case design that I've been working on for the next #hardware revision. It's going to be a ways out before I get it done, but it'll be hot.
#a11y #3dprinting #signet

2024-05-13 21:59:00

"This is counter-culture from the underground
Eternal revolution this is our sound
KMFDM better than the best
Megalomaniacal and harder than the rest"
--KMFDM, Megalomaniac

2024-05-12 17:19:03

- reply

I'm always amazed when I see hundreds of millions being spent on a simple app. I feel like 50M/year could pay for SO MUCH dev time, like how could you even spend that much money that fast? Hire 200 developers and 50 managers, all full time?

2024-05-11 06:20:22

- reply

Here's a video from 2018 by a ham operator about the impact of solar flares and EMPs: https://yewtu.be/watch?v=PlB4LGLtRQM
He clearly draws the line about what is publicly known and documented and what is extrapolated from first principles, which I very much appreciate!

2024-05-11 06:13:24

Pro tips for if you're going to call for a #strike.
1. Don't set the date for tomorrow
2. Get press articles about the upcoming strike
3. Get people taking about how they're preparing (moving meetings, making sure their co-workers and clients/customer are aware of the strike)
4. Have leverage. The strike should most impact the people who have the ability to meet the demands.
Failing to do these things will cause your actions to backfire.
The public will think not many people care about the issue, regardless of how just the cause may be. The people you're intending to influence will get the message that there will not be consequences for their actions (or inaction).
I hope the author of the following post has learned these lessons.
https://www.opendemocracy.net/en/gaza-rafah-global-strike/
"Thousands of people" posting online that they're participating for a global, general strike is not impressive. We need millions.
I hope people who deeply care about #Gaza, #ClimateChange, #inflation, or any other big social issues are preparing for a general strike, and not just a single day either.
That may mean planting victory #gardens, stocking up on rice and beans, coordinating with your local communities to build #solidarity #networks, or other efforts.
It's likely going to take months of a general strike before we see real change.

2024-05-11 06:12:36

- reply

Ugh, looks like my nostr client mangled the link. Trying again in 3, 2, 1...
https://www.opendemocracy.net/en/gaza-rafah-global-strike/

2024-05-11 06:05:28

Pro tips for if you're going to call for a #strike.
1. Don't set the date for tomorrow
2. Get press articles about the upcoming strike
3. Get people taking about how they're preparing (moving meetings, making sure their co-workers and clients/customer are aware of the strike)
4. Have leverage. The strike should most impact the people who have the ability to meet the demands.
Failing to do these things will cause your actions to backfire.
The public will think not many people care about the issue, regardless of how just the cause may be. The people you're intending to influence will get the message that there will not be consequences for their actions (or inaction).
I hope the author of the following post has learned these lessons.
https://www.opendemocracy.net/…
"Thousands of people" posting online that they're participating for a global, general strike is not impressive. We need millions.
I hope people who deeply care about #Gaza, #ClimateChange, #inflation, or any other big social issues are preparing for a general strike, and not just a single day either.
That may mean planting victory #gardens, stocking up on rice and beans, coordinating with your local communities to build #solidarity #networks, or other efforts.
It's likely going to take months of a general strike before we see real change.

2024-05-10 07:02:48

- reply

*intro video
The https://joinmatrix.org/guide/ is good for people who prefer written form.

2024-05-10 06:02:43

Does anyone know of a simple, short intro to Element or Matrix that explains it to potential new users, some of whom are non-technical?
I can only find 15-60 minute videos contrasting it to other chat platforms like WhatsApp, bickering about what the best client is, and videos that are basically clickbait. These are not what I want.
#AskNostr

2024-05-10 05:52:53

OK, I get that some people are pro gun and others are pro gun contol, but can we agree that mass surveillance of 3D printers and other parts purchased online is inappropriate?
https://social.scriptjunkie.us/@sj/112414718092449617