ww 🩶

> namespaces/schema
json-ld?
yeah i don't think matrix or activitypub are great, but both have fewer issues like that, partly cause they're younger
afaict the attack works roughly like this:
secret token is xxx
attacker sends yyy, server returns xxxyyy, compressed it's 3x3y, length = 4, can predict that there's no match
attacker sends xyy, server returns xxxxyy = 4x2y, attacker sees that length is still 4 and not 6 as expected = partial match
attacker sends xxx, server returns 6x = length unchanged = full match
if i'm not mistaken, active interference is required, and in this case it would look like a ton of spam

2026-02-26 05:29:41 GMT

- reply

oh and iirc matrix has better push? it has to be a core feature of the protocol, not an optional extension imo.

2026-02-26 05:28:52 GMT

- reply

idk i hate matrix with passion and wouldn't use it for anything. i don't think i'd trust the server to be secure, even if isolated from federation. xmpp is certainly better, but then you have to deal with bosh and xml and all that. one thing matrix got right is that json over https is the way.

2026-02-23 20:30:00 GMT

i wonder if all this matrix drama with security and spam is gonna affect their relationship with the eu

2026-02-04 00:19:47 GMT

- reply

i sleep with wife and, depending on cat's mood, cat, so i don't think that would fit the space requirements.. but i also can't imagine it being very comfortable?

2026-02-03 09:29:15 GMT

i usually sleep on my stomach and put my arms under the pillow cause it's cozy and idk what else to do with them. but that very often cuts off blood flow to my hands and i wake up from not being able to feel them. i guess the solution is probably to stop sleeping on my stomach..

2025-12-27 08:14:39 GMT

- reply

i mean, surely it can make their drones better at spotting african refugees headed towards the border, so they can be stopped before they get the chance to make a legally binding request for asylum :/ except they can't just say that on fedi, cause hopefully no one here wants that.

2025-12-27 08:02:44 GMT

- reply

yes here on fedi we're so happy to hear you list AI, Quantum, drones, and space in the same sentence

2025-12-22 00:17:40 GMT

- reply

that ram won't go in regular computers :(

2025-12-11 13:46:07 GMT

i don't understand why people region-lock their app store apps

2025-12-01 10:06:56 GMT

omfg why does the python ecosystem (if you can even call it that) have to be.. like this 😭
i wish i never had to see a single line of python or pip/poetry/uv/conda/pixi command ever again

2025-12-01 09:02:27 GMT

@npub1m96…ag4y wow you literally just put ai, green tech, deregulation and fighting disinformation all in the same post
#note1w39…plsh

2025-11-30 23:07:54 GMT

> A lost generation of news consumers? Survey shows how teenagers dislike the news media
yeah i didn't like the news when i was a teenager either. tbh i'm having a hard time trying to imagine a teenager who's just stocked to read a newspaper.

2025-11-13 01:53:31 GMT

- reply

well i'm timing it from inside js which happens after semantic analysis, but that's a one-time thing and not very interesting anyway
if i disable jit in chrome, js is fairly consistently 3 times slower than my wasm module. i don't wanna try to disable jit in firefox cause i'm worried it would break things.

2025-11-13 01:43:57 GMT

- reply

i think it compiles? wdym by fewer execution steps?

2025-11-13 01:23:13 GMT

- reply

i wrote a simple wasm program to calculate something. i really like the text representation (wat), it's so much better than real assembly languages!! but my program takes twice as much time to run as the same algorithm implemented in js 😭 and that's just the actual webassembly run time, cause i also have to encode strings into its memory using a uint8array and a textencoder, and then decode them from memory using a dataview and a textdecoder.

2025-11-13 01:16:37 GMT

i changed my mind. the webassembly text representation is the best lisp :KuromiLove:

2025-11-11 22:39:23 GMT

not all political opinions are equally valid! for example, some people believe that javascript is a bad programming language. in a perfect world, such people would be shunned and excluded from every group, and die sad and alone. unfortunately, we do not live in a perfect world.

2025-10-06 06:02:33 GMT

- reply

i usually get americanos when i want a bigger drink, cause i always feel like pour-over orders are probably very annoying and i don't like batch brew. would you rather take an order for an americano or a pour-over? is it less annoying than i think?
many cafes around also have good americano, but very bitter espresso. it feels like it's made to be mixed with either milk or water.. they also often ask me twice, like, "are you sure you know what an espresso is?"

2025-10-05 11:08:14 GMT

- reply

apple is a gatekeeper let's gatekeep them back. they should be banned from bundling safari with ios and macos. it should be paid software $50 per one-device license so that if my website doesn't work in safari i don't have to care. it would be its users' own fault!!

2025-10-05 11:05:06 GMT

safari is the worst fucking browser ever i hate safari it really is the new explorer. @npub1m96…ag4y can we please just ban safari completely and ensure the chrome monopoly please 🥺

2025-08-30 08:55:57 GMT

- reply

are you saying there's a backdoor that allows apple to cause your phone to report its location to them even if the relevant settings are disabled? based on what?

2025-08-30 08:52:33 GMT

- reply

they also don't share your location with anyone unless you explicitly enable location sharing

2025-08-30 08:47:16 GMT

- reply

the absolute majority of smartphone buyers don't care about those things. if anything they care more about being able to run their bank app and get push notifications (and on midrange to flagship phones, google/apple pay), which is often incompatible with degoogling. iphones come degoogled out of the box and have e2e encrypted backups and sync for those who care.

2025-08-30 08:23:42 GMT

- reply

what can modern android phones do that neither your first android nor a modern iphone could??

2025-08-30 08:13:35 GMT

- reply

that doesn't change the fact that there's demand for them as a phone and not just a status symbol

2025-08-30 08:02:46 GMT

- reply

well, yeah, there's a whole world outside the united states

2025-08-30 07:55:32 GMT

- reply

how do you know? fwiw most iphone users i know don't use imessage or twitter. and if you want to show off, having the latest flagship matters more than the brand.

2025-08-30 07:41:39 GMT

- reply

what kinda status symbol is a two years old phone

2025-08-30 07:30:25 GMT

- reply

fwiw they're priced more or less the same as android flagships

2025-08-30 05:17:02 GMT

i don't think people on the english-speaking internet understand that not everyone chooses their devices (like android/ios or windows/mac) solely based on their merits. for most, price is a big concern. if you only have $200 you can spend on a device, you aren't getting apple hardware. it's not a question of preference.

2025-08-26 19:52:19 GMT

"digital identities create brittle societies"
https://newdesigncongress.org/en/note/2025/the-mask-off-moment-for-digital-identity/

2025-08-18 23:05:25 GMT

cursed
https://s3.us-east-2.wasabisys.com/xyzzylink-media/50cb5d54e0d189f2add83dd23b9467b3394a172044b418ab286409fbd68d58c1.png

2025-08-14 21:45:39 GMT

- reply

nooo why would you say that. now the eu will never pass my legislation :(
yeah but what's the alternative? hosting it at home? that dramatically raises the stakes for breaking any other law whatsoever.

2025-08-14 21:30:41 GMT

- reply

i want to get @npub16c7…y433 funding to put every fedi instance in a centralized registry and have their admins install an intel sgx chip running the age verification program with remote hardware attestation. those instances that refuse will be defederated instantly and the police would be dispatched to their detected location.
speaking of which, @npub1t35…p885 i have a question. hetzner collaborates with the fbi and others to find onion services hosted on hetzner, which as i understand involves something like scanning all hetzner VMs and then looking inside those that run tor and seeing what's in memory? not exactly sure, but i was wondering if upcloud would ever do something like that?
cause if so, together we could put an end to those pesky children posting on our glorious federated universe

2025-08-14 21:20:49 GMT

- reply

the user will never be secure against the state in any meaningful way, best they can do is leave, have powerful connections, or avoid attracting attention. security and privacy are one, but not the only way to achieve the latter.

2025-08-14 21:09:50 GMT

- reply

physical security against unlawful detention is separate from computer security
yes and it's usually still better than whatever you can get otherwise

2025-08-14 21:01:42 GMT

good evening @npub16c7…y433!! i think there's a huge discrepancy!! the development of mastodon is paid for using eu funds, but there's no system for age verification built into this software!! it isn't compatible with the eu miniwallet, nor the uk selfie age checks!! and it doesn't accept credit cards either! are you going to do something about this? is there a plan? i would honestly hate to see minors on this platform. please do something asap!!

2025-08-14 20:56:15 GMT

- reply

secure from anything, unless you just don't trust people in general. like, if you had a personal whitehat team monitoring all your online and offline communications, chances are it would increase the security, at least if they're competent. but your privacy goes out of the window.
but in a more practical sense, the incentives for tech companies implementing security features and privacy-violating features are often somewhat aligned. for example, drm is generally built on the same foundation that physical hardware security is. or like, cloudflare.

2025-08-14 14:54:24 GMT

- reply

privacy often depends on security, but you can pretty much always sacrifice some privacy to improve your security too

2025-08-14 03:15:39 GMT

privacy ≠ security, they're actually often orthogonal

2025-08-12 08:46:36 GMT

- reply

i haven't been able to view age restricted videos through invidious, i think youtube requires an account and invidious proxies through a normal non-signed-in connection
so i think it's also unlikely a scraper would be able to bypass it? but i might be wrong..

2025-08-10 04:19:43 GMT

- reply

okay apparently their intelligence agencies are legally allowed to install malware (bundestrojaner) with somewhat limited capabilities (uhh..) or force a service to proxy all their traffic through the agency. there's mandatory data retention for some types of services.
if the amendments pass, then any vpn, chat apps, social networks etc will have to identify their users and follow the 6 months data retention rule. i don't understand what identify means, and apparently neither does tutanota (lol). i think it remains to be seen whether they decide to require government-issued id or only phone number verification?

2025-08-10 03:34:54 GMT

wait is it true that switzerland has some of the worst privacy laws in europe? whenever i look into it, i find very conflicting information. and now they want to force vpns to identify their users too, but that law hasn't passed yet.

2025-08-09 08:30:40 GMT

- reply

don't worry, our minds are already made up! of microplastics :Kuromi:

2025-08-09 06:42:08 GMT

- reply

oh cool, i've heard of shellcheck, but didn't know it could test for posix compliance!

2025-08-09 06:19:23 GMT

- reply

i don't write c so dunno how it works there, but with shell scripts it's kinda hard if your /bin/sh is an alias to bash and all your commands are gnu. you'd need like a chroot/lxc/docker or a vm?

2025-08-09 05:50:20 GMT

- reply

whoah someone should make that for shell scripts! maybe even with an automated scanner that detects gnu or other custom extensions in your commands and suggests posix-compatible fixes..

2025-08-08 10:17:04 GMT

> You do not have to create accounts with passwords with different actors, and can instead use the same secure solution for everyone. Like showing your ID, but digitally.
that doesn't sound very appealing tbh

2025-08-08 08:33:02 GMT

- reply

i think you can do a lot of the same things with generators?
i meant static structural typing, with generics and everything

2025-08-08 08:14:43 GMT

- reply

> though afaik Javascript doesn't even support those
mm generators? that's how async/await works..
structural typing? macros?
also jsx is homoiconic? i think? at least if you implement your own pragma for it. it's like an xml-based lisp!!

2025-08-08 07:48:40 GMT

- reply

i don't know much about self, but, there's more to it than prototypal inheritance. like continuation passing and widely used functional primitives. writing software functional style is very common, especially with jsx where you can't use control flow statements (you generally don't have to use them outside of assignment, though ternaries are sorta awkward). there's an ecosystem of libraries focused on improving that experience. obvi first class functions that you can also call and bind as pseudo currying. though you can also `const volume = x => y => z => x * y * z;`. also typescript is structural typing. ~~also there's an extensive ecosystem of macros.~~ /hj

2025-08-08 07:29:16 GMT

user was assassinated for this post

2025-08-08 07:24:41 GMT

- reply

i hate java and love lisp (javascript is the best lisp

2025-08-08 07:23:40 GMT

- reply

oh sorry i misread her post

2025-08-08 07:21:53 GMT

- reply

the opposite of kill is give birth to

2025-08-08 02:01:26 GMT

- reply

hi sodi
you won't be able to register a domain name without providing an email address, as registrars are required to collect it by §6.1.16 of the icann registration data policy (https://www.icann.org/en/contracted-parties/consensus-policies/registration-data-policy). your only option is to use a middleperson organization, such as njalla (though they require email or xmpp as well); but then the domain name wouldn't actually belong to you.
in practice, you probably don't want to do that anyway, since that email is used for notifications in case something happens to your domain. for example, if your account gets suspended, and requires immediate action to restore access to, you wouldn't be able to find out what exactly is the issue.

2025-08-05 23:47:07 GMT

- reply

which means that no large website can do it, cause anonymously hosting a clearnet site is hard and risky. so those that do exist are usually lower effort projects. also if you aren't afraid of enforcement, why block uk IPs in the first place? i'd imagine adding a banner with instructions on how to access other websites would be more effective, cause there's few sites important enough that someone would install 3rd party software to visit it, while also not having an identifiable person or entity behind it.
yeah i do hope that it gets better after it gets worse

2025-08-05 23:08:57 GMT

- reply

but it's such a good opportunity to get rid of the british in public internet spaces altogether, why would you wanna ruin the fun /j
yeah, too bad blocking british IPs and providing instructions to access the website through tor is pointless (the liability is the same as if you hadn't changed anything whatsoever)
and now that they're talking about vpns interfering with the state's ability to enforce its laws, i wonder how long till they criminalize tor use x.x

2025-08-05 22:23:57 GMT

the uk law is a good excuse for the anti-british xenophobes to really ramp up their exclusion of the british 🙃

2025-08-05 21:22:56 GMT

https://eur-lex.europa.eu/eli/reg/2024/1183/oj/eng#045.001
45.1. Qualified certificates for website authentication shall meet the requirements laid down in Annex IV. [...]
45.1a. Qualified certificates for website authentication issued in accordance with paragraph 1 of this Article shall be recognised by providers of web-browsers. Providers of web-browsers shall ensure that the identity data attested in the certificate and additional attested attributes are displayed in a user-friendly manner. [...]
45.1b. Qualified certificates for website authentication shall not be subject to any mandatory requirements other than the requirements laid down in paragraph 1.
this is the law that's been passed and should be in power now? the eu wants to force web browsers to:
- trust eidas certificate authorities
- revert to prominently displaying extended validation data
- *not* require certificate transparency on european certificates!!!!
the practical implications:
- any eu state can issue a valid certificate for any website
- it is illegal for a browser vendor to reject it
- without certificate transparency, it would be undetectable; even if there's an eu-wide registry (is there?), nothing stops them from not adding the cert to it (whereas ct is enforced)
- this enables mitm at the isp level across the eu; basically eu countries can view any of their residents' browser traffic if they want
please tell me i misunderstood the law?

2025-08-05 10:06:32 GMT

- reply

they use the title attribute for the jokes (that's what appears on hover), alt is set to the title of the comic (completely useless, probably meant to suppress warnings)

2025-08-05 10:02:35 GMT

who up winning they rar

2025-08-05 09:54:24 GMT

til that the eu wanted to force web browsers to trust the root authorities for their "qualified" ev tls certificates? and afaict the requirement is still there? does anyone know what happened to that?
https://www.eff.org/deeplinks/2022/12/eidas-20-sets-dangerous-precedent-web-security
https://eur-lex.europa.eu/eli/reg/2024/1183/oj/eng#045.001

2025-08-04 10:43:31 GMT

- reply

in that case there should be no issues with implementing webrtc or plain http for clearnet web clients and whatever else for those who have tor/i2p, cause they have to install an app anyway and probably enough of them can relay stuff to web users
websockets would be better but i just realized they might require https?

2025-08-04 10:33:00 GMT

- reply

like, i don't think relay-capable users should have to hide their relay identity, it can be completely separate from the name they post under

2025-08-04 10:32:12 GMT

- reply

as much as i agree about tor/i2p, i wouldn't join a social network that heavily relies on those. so far in my experience those tend not to attract the kinda people i'd want to interact with.
you could implement privacy mechanisms over clearnet, but it would probably be kinda painful..

2025-08-04 10:23:38 GMT

- reply

ohh
i don't think that can be solved as long as the server identity is tied to its domain huh

2025-08-04 10:06:15 GMT

- reply

mechanisms?
fwiw the ap spec is very barebones, iirc it only suggests using http signatures, but doesn't include any security by itself?

2025-08-04 10:04:46 GMT

- reply

i think they need to have public IPs and open ports
eh i don't think it's inherently a js issue, and i'd prefer a network that uses webrtc or websockets and works in the browser. those peers that run native apps can relay messages for those that don't, but most people aren't gonna install an app. if there even is one for their platform.
my issue with ssb was that their npm was hosted on ssb itself, which is pretty cool in theory, but needing a well-synced client before you can download the client you like is a bit of a chicken and egg problem (aside from being extremely user-unfriendly)

2025-08-04 09:54:32 GMT

- reply

akkoma has built in backup?

2025-08-04 09:42:34 GMT

- reply

wdym a sane stack?
idk i guess i think pure p2p social media is doomed, cause smartphones can't handle it well

2025-08-04 09:11:23 GMT

i keep forgetting that when fedi talks about cnc it has nothing to do with machining 💀

2025-08-04 08:47:44 GMT

- reply

oh, like nostr? imo it's the best social network design that exists, but unfortunately it has a very wack community. and there's also scuttlebutt, but it's dead and didn't work well on smartphones to begin with..

2025-08-04 08:29:16 GMT

- reply

whoah, wanna elaborate?

2025-08-04 08:25:51 GMT

- reply

i mean if suing fedi admins for not protecting minors becomes a thing, it might just be time to leave this network and switch to something actually censorship-resistant

2025-08-04 08:24:03 GMT

- reply

they'd have to store id photos for compliance too, cause looking at the picture and deleting it after doesn't protect them (a minor could use a stolen photo and then sue; having the chatlog would protect from that)

2025-08-04 08:20:19 GMT

if fedi admins start verifying their users' age, especially by hand, that dramatically raises the stakes of any fedi meta

2025-08-04 01:10:18 GMT

- reply

but that implies that consuming caffeine would make me less sleepy, at least for a little bit! that doesn't happen 😭

2025-08-03 22:32:34 GMT

why am i so sleepy

2025-08-03 08:32:09 GMT

- reply

i found a bunch of tiny bedroom fridges that use the peltier effect and have the space for like 4 energy drinks inside on amazon, and wow i want that now! i wonder how well those work..

2025-08-03 08:28:48 GMT

- reply

whoah that's interesting, i didn't know those existed! i looked it up, still doesn't seem very economically achievable—it seems like there's always a huge tank (space requirement) and it starts from ~$2k? idk how many of the people using tankless gas heaters, which can cost less than $100, can come up with that much money upfront. and i imagine if they somehow did, the local grid would maybe have to get upgraded with that in mind? but yeah it would be nice!

2025-08-03 08:20:10 GMT

- reply

okay that makes a lot of sense
this is the article i read that talks about thermoelectric cooling used in computers, but it doesn't have any specifics: https://www.electricity-magnetism.org/thermoelectric-cooling-devices-peltier/

2025-08-03 08:14:28 GMT

- reply

oh okay nvm i should've read your next reply, i didn't know that about heat pumps. i think it still applies to water though?

2025-08-03 08:13:16 GMT

- reply

agree!!
i also think that we should generally avoid burning pretty much anything indoors, for both carbon monoxide and fire safety. like, it's very rare that you need an actual open fire and don't have any alternatives.
that's not always 100% achievable economically rn, like, in lots of places electricity is too expensive for water/space heating and i don't think heat pumps work too well to heat the indoors when it's below zero outside? but i think it should kind of be a goal for the society to get to a point where we don't have natural gas pipelines literally built into our housing infrastructure, and don't casually start (contained) fires indoors.

2025-08-01 07:04:02 GMT

- reply

yeah! once you realize that all you have to do is boil a liquid or decompress a gas to take heat out of an environment.. all that remains is the logistics of achieving that!
(and also all you have to do to take humidity out of the air is cool it? which is obvious in retrospect, since that's how dew works, but i didn't realize it before reading about dehumidifiers ^^;)
whoah, come to think about it i don't know anything about liquid cooling, is the liquid just a medium of heat transfer to help it dissipate? so not a heat pump?
i was gonna read about thermoelectric cooling that's i guess used for computers? i always thought cpu coolers were just fans to help the heat dissipate, but i guess not? but i have to sleep now..

2025-08-01 06:42:01 GMT

i find always-on gas-powered home appliances very scary. like heating, refrigeration or stove ignition. also those where you don't interact with the fire directly, like dryers. i think the stove is the only appliance that should use gas, and ideally not even.

2025-08-01 06:35:30 GMT

- reply

yeah!! and i just learned today how butane fridges work, which sounds ridiculous, you can burn gas to cool things??

2025-08-01 06:23:40 GMT

wait so if you run your a/c in heating mode, it doesn't just use resistance to create heat from electricity, but instead reverses the cycle and brings the heat from the outside indoors? making the outside a little bit colder????

2025-07-09 20:52:14 GMT

- reply

data that includes instructions executed in a virtual machine? then javascript is just data as well.

2025-07-09 20:40:43 GMT

- reply

i think pretty much every font file is a program, but like why does that even matter?

2025-07-09 20:35:25 GMT

- reply

they're free not to run my program, but it's their personal choice. they shouldn't tell me what to do or claim it as some kinda universal truth.
and it's not like markup and styling are all that different. css is turing complete, though it can't loop without user interactions. i believe truetype fonts are turing complete as well. i don't think it being a program is a useful distinction. though i do like being able to easily try random people's programs in a sandbox instead of installing them on my computer.

2025-07-09 00:28:45 GMT

> personal websites don't need [technology]
did you miss the part where personal websites are personal and it's up to the author to decide what theirs needs?

2025-06-18 06:55:55 GMT

noo why does it keep setting post language to es

2025-06-18 06:18:20 GMT

- reply

hostile fork time!! :KuromiExclamation: /j

2025-06-18 06:15:02 GMT

- reply

well there's no such thing as a content warning in the protocol, the field is called summary?
anyways look
https://codeberg.org/grunfink/snac2/src/commit/0155c794087875ad8da73b194a2d719b379ac0d9/html.c#L2177
and a few lines below it shows the h3 render. obviously this is unacceptable tho lol, cause i don't think there's a single fedi software that does actually treat the summary field as like an email subject and not a cw.

2025-06-18 06:07:14 GMT

- reply

oh i meant sensitive is true on the picture, i think akkoma only sets it on those. like once you add images and a cw, there's a checkbox "mark images as sensitive". but there's no checkbox like that for text contents. i think that's a difference in expectations between different softwares, activitypub is kinda understandardized.

2025-06-18 05:59:36 GMT

- reply

yeah this one has sensitive: true, does it get hidden?