moonpiedumplings

joined 1 year ago
[–] moonpiedumplings@programming.dev 1 points 1 hour ago* (last edited 1 hour ago)

I'd recommend looking at Twitch streams in the software and game development category. Many of them develop in Unity, which is almost entirely C#.

I really like mercernarymage*. He mostly does gamedev in unity, but he occasionally explains stuff and answers questions. In addition to that, his code is very clean and easy to read, easy enough for me (a non C# dev) to understand it.

*note the spelling. NOT "mercenary".

Sorry. I meant if you wanted to use only packages from one set of repositories/one distro, for if you were looking for lower level packages like the kernel or desktop environment to be updated.

 

https://security-tracker.debian.org/tracker/CVE-2024-47176, archive

As of 10/1/24 3:52 UTC time, Trixie/Debian testing does not have a fix for the severe cupsd security vulnerability that was recently announced, despite Debian Stable and Unstable having a fix.

Debian Testing is intended for testing, and not really for production usage.

https://tracker.debian.org/pkg/cups-filters, archive

So the way Debian Unstable/Testing works is that packages go into unstable/ for a bit, and then are migrated into testing/trixie.

Issues preventing migration: ∙ ∙ Too young, only 3 of 5 days old

Basically, security vulnerabilities are not really a priority in testing, and everything waits for a bit before it updates.

I recently saw some people recommending Trixie for a "debian but not as unstable as sid and newer packages than stable", which is a pretty bad idea. Trixie/testing is not really intended for production use.

If you want newer, but still stable packages from the same repositories, then I recommend (not an exhaustive list, of course).:

  • Opensuse Leap (Tumbleweed works too but secure boot was borked when I used it)
  • Fedora

If you are willing to mix and match sources for packages:

  • Flatpaks
  • distrobox — run other distros in docker/podman containers and use apps through those
  • Nix

Can get you newer packages on a more stable distros safely.

I cannot find anything related to that in their documentation, their about page, or their whitepaper.

They talk a lot about decentralized computing, but any form of secure enclave or code verification isn't mentioned.

Compare that to this project, which is similar, but incomplete. However, quilibrium uses it's own language instead of python or javascript, like golem does. The docs for golem do not explain how I am supposed to verify a remote server is actually running my python/javascript code.

[–] moonpiedumplings@programming.dev 1 points 4 days ago (3 children)

No, I think if you're using the nextcloud all in one image, then the management image connects to the docker socket and deploys nextcloud using that. The you could be able to update nextcloud via the web ui.

https://github.com/nextcloud/all-in-one?tab=readme-ov-file#how-to-update-the-containers

[–] moonpiedumplings@programming.dev 1 points 4 days ago (2 children)

I read through the docs. I'm not sure how this enables trusted computing.

[–] moonpiedumplings@programming.dev 1 points 5 days ago* (last edited 5 days ago) (4 children)

There is concern amongst critics that it will not always be possible to examine the hardware components on which Trusted Computing relies, the Trusted Platform Module, which is the ultimate hardware system where the core 'root' of trust in the platform has to reside.[10] If not implemented correctly, it presents a security risk to overall platform integrity and protected data

https://en.m.wikipedia.org/wiki/Trusted_Computing

Literally all TPM's are proprietary. It's basically a permanent, unauditable backdoor, that has had numerous issues, like this one (software), or this one (hardware).

We should move away from them, and other proprietary backdoors that deny users control over there own system, rather than towards them, and instead design apps that don't need to trust the server, like end to end encryption.

Also: if software is APGL then they are legally required to give you the source code, behind the server software. Of course, they could just lie, but the problem of ensuring that a server runs certain software also has a legal solution.

[–] moonpiedumplings@programming.dev 2 points 1 week ago* (last edited 1 week ago) (1 children)

I think the bigger issue is the copyright violation. You can't just take others code and change the license. That's not how it works.

Stenzek did not do this. He either got permission to change the license of gpl pieces from their original author, or rewrote them. The edit by Leah in her post fails to acknowledge this, but it should be noted that she states the situation has a lot more nuance, and that she is trying to convince steznek to keep duckstation free software, rather thab threatening legal action against him.

reached out to the bigger community for support.

Like Near/Byuu did? And how did that go?

Although, I do agree, and I would rather have free software. But it's clear that Duckstation going proprietary is his attempt to boycott the retroarch developers.

[–] moonpiedumplings@programming.dev 5 points 1 week ago* (last edited 1 week ago) (3 children)

UPDATE on 15 September. I’ve had a talk with Stenzek. This is an evolving situation with a lot more nuance to it than first glance. The decision to make DuckStation proprietary is still terrible, and I intend to rectify this; I’ve proposedh a number of ideas to Stenzek for how to effectively retain DuckStation as a free software project. If this is unsuccessful, I’ll fully fork it myself (from prior to the re-licensing) and probably find people in the PSX scene willing to help maintain it (in that scenario, my role will only be to facilitate and provide infrastructure, while not having an active role in core development, as I already have my Libreboot project which takes all of my time). I simply wish to prevent what is currently the best emulator of its kind becoming proprietary software.

I hope she's aware of why the Duckstation dev decided to go proprietary: An ongoing harassment campaign by Retroarch.

There is a post by Near/Byuu that documents some of the retroarch developers problems, and some of it is especially damning. I read through some of the leaked IRC chats, and they refer to Near by homophobic and racial slurs (the n word, yes), and this behavior clearly hasn't stopped, given Steznek's abrupt and harsh reaction.

On another thread related to this, I mentioned that many people theorize that Talreth (developer of AetherX2, PS2 emulator for android), and Steznek (Duckstation) are the same person. Although there is not hard evidence that they are the same person, their stories parallel in that both of them took code offline because of persistent harassment.

Leah Rowe taking over a fork of Duckstation is nice, but it doesn't really do anything. People were already going to fork Duckstation, and the Retroarch team did — in the form of SwanStation.

She notes this in the email she sends:

I would also point out that a fork of DuckStation does indeed exist:

https://www.libretro.com/index.php/category/swanstation/

I posted about all of this on my Mastodon. Please see the following post:

https://mas.to/@libreleah/113131594753424867

Unless the DuckStation author changes the project back to GPL, I would suggest that you all boycott the project, and tell others to do the same; you could send all future contributions to SwanStation instead, which is part of libretro. I would suggest that all future works go to a fork (could be SwanStation), instead of DuckStation, while still permitting Stanzek to contribute; this way, any future abusive re-licensing could not realistically occur. The reason I say this, is because based on my own research, it seems that Stanzek’s bios against the GPL has existed for some time, so I’m uncertain as to whether he could be trusted in charge of a public project.

But, in the github reply by stenzek

I find it especially ironic, considering when the GPL was actually violated on multiple occasions, even as recently as a few months ago, nobody ever takes issue with that.

I like free software too, but this stuff doesn't exist in a vacuum. I think this and her attempts at action, even with the edit to the post, are premature. Her taking over a fork of Duckstation is nice, but I think she, a transwoman, needs to remember why the Retroarch devs harassed the shit out of Near/Byuu: Because they were nonbinary.

If she does decided to maintain a fork of Duckstation, I hope she has a plan that allows her to avoid falling victim to the same harassment that eliminated Near, Talreth, and Steznek. Because while a Playstation emulator is nice to have, Libreboot is essential to obtaining a truly free software society.

[–] moonpiedumplings@programming.dev 2 points 1 week ago* (last edited 1 week ago)

There was no CLA. The duckstation dev rewrote all gpl code, or obtained permission to change the license.

[–] moonpiedumplings@programming.dev 4 points 1 week ago (1 children)

So, officially no. But there are ongoing theories in the r/emulationonandroid subreddit that they are.

I think it could be either way, but it's unlikely that they are the same person. In both cases, harassment caused them to shut there projects down, which could be a reasanobale coincidence, or could be indicative of a larger harassment campaign.

[–] moonpiedumplings@programming.dev 3 points 1 week ago (1 children)

Crowdstrike didn't target anyone either. Yet, a mistake in code that privileged, resulted in massive outages. Intel ME runs at even higher privileges, in even more devices.

I am opposed to stuff like kernel level code, exactly for that reason. Mistakes can be just as harmful as malice, but both are parts of human nature. The software we design should protect us from ourselves, not expose us to more risk.

There is no such thing as a back door that "good guys" can access, but the bad guys cannot. Intel ME is exactly that, a permanent back door into basically every system. A hack of ME would take down basically all cyber infrastructure.

 

cross-posted from: https://programming.dev/post/18069168

I couldn't get any of the OS images to load on any of the browsers I tested, but they loaded for other people I tested it with. I think I'm just unlucky. > > Linux emulation isn't too polished.

 

I couldn't get any of the OS images to load on any of the browsers I tested, but they loaded for other people I tested it with. I think I'm just unlucky.

Linux emulation isn't too polished.

 

According to the archwiki article on a swapfile on btrfs: https://wiki.archlinux.org/title/Btrfs#Swap_file

Tip: Consider creating the subvolume directly below the top-level subvolume, e.g. @swap. Then, make sure the subvolume is mounted to /swap (or any other accessible location).

But... why? I've been researching for a bit now, and I still don't understand the benefit of a subvolume directly below the top level subvolume, as opposed to a nested subvolume.

At first I thought this might be because nested subvolumes are included in snapshots, but that doesn't seem to be the case, according to a reddit post... but I can't find anything about this on the arch wiki, gentoo wiki, or the btrfs readthedocs page.

Any ideas? I feel like the tip wouldn't just be there just because.

 

I've recently done some talks for my schools cybersecurity club, and now I want to edit them.

My actual video editing needs are very simple, I just need to clip parts of the video out, which basically every editor can do, as per my understanding.

However, my videos were recorded from my phone, and I don't have a presentation mic or anything of the sort, meaning background noise, including people talking has slipped in. From my understanding, it's trivial to filter out general noise from audio, as human voices have a specific frequency, even "live", like during recording or during a game, but filtering voices is harder.

However, it seems that AI can do this:

https://scribe.rip/axinc-ai/voicefilter-targeted-voice-separation-model-6fe6f85309ea

Although, it seems to only work on .wav audio files, meaning I would need to separate out the audio track first, convert it to wav, and then re merge it back in.

Before I go learning how to do this, I'm wondering if there is already an existing FOSS video editor, or plugin to an editor that lets me filter the video itself, or a similar software that works on the audio of videos.

 

cross-posted from: https://programming.dev/post/6822168

I was watching a twitch streamer play the game pogostuck (A game similar in frustration and difficulty to Getting over it with Bennett Foddy — Don't Fall!).

They were also reading chat at the same time (usually out loud, as well). Multitasking.

Lots of sources (here's one) say that true multitasking is impossible. Rather, it's very fast switching, where there is a degradation of performance.

Knowing this, I naturally made it my mission to trip the streamer up with seemingly benign messages.

I was sharing some actual information about another streamer who beat another game, but a made a typo something like:

I remember a streamer beat the game a game ...

And I noticed how much more the streamer struggled to read this compared to previous, accidental typos (missing spaces, extra spaces, etc.). He spent a good 5 seconds on this message, and during the process, he fell really far. 😈

So I decided to do some testing. Inserting words, swapping them around, and whatnot, to see what tripped him up the most. Most typos didn't affect him.

There was one typo that tripped him again, where I said something like:

If it wasn't for a for

So it seems to be repetition? But I couldn't always replicate this with other forms of repetition.

Later on, I copied the two guards riddle, with an alteration:

One of the guards always lies and the other always lies as wekk. You don't know which one is the truth-teller or the liar either. However both guards know each other

Sadly, I didn't cut the part about "don't know which is truth teller or liar" out.

The streamer spent a good 5 minutes interpreting this puzzle, and eventually interpreting it as the original puzzle. Then, he was trying to solve a riddle, game, and read chat all at once.

He was stuck on the bottom until he gave up on the riddle (I revealed that I meant what I said when I said both guards lie). 😈

Anyway, that was a bit off topic but still relevant.

I'm wondering if any studies have been done on this? I know studies have been done on human's ability to read words with the letters partially scrambled, but what about typos?

How can I improve my distraction game (with plausible deniability of course)?

 

I was watching a twitch streamer play the game pogostuck (A game similar in frustration and difficulty to Getting over it with Bennett Foddy — Don't Fall!).

They were also reading chat at the same time (usually out loud, as well). Multitasking.

Lots of sources (here's one) say that true multitasking is impossible. Rather, it's very fast switching, where there is a degradation of performance.

Knowing this, I naturally made it my mission to trip the streamer up with seemingly benign messages.

I was sharing some actual information about another streamer who beat another game, but a made a typo something like:

I remember a streamer beat the game a game ...

And I noticed how much more the streamer struggled to read this compared to previous, accidental typos (missing spaces, extra spaces, etc.). He spent a good 5 seconds on this message, and during the process, he fell really far. 😈

So I decided to do some testing. Inserting words, swapping them around, and whatnot, to see what tripped him up the most. Most typos didn't affect him.

There was one typo that tripped him again, where I said something like:

If it wasn't for a for

So it seems to be repetition? But I couldn't always replicate this with other forms of repetition.

Later on, I copied the two guards riddle, with an alteration:

One of the guards always lies and the other always lies as wekk. You don't know which one is the truth-teller or the liar either. However both guards know each other

Sadly, I didn't cut the part about "don't know which is truth teller or liar" out.

The streamer spent a good 5 minutes interpreting this puzzle, and eventually interpreting it as the original puzzle. Then, he was trying to solve a riddle, game, and read chat all at once.

He was stuck on the bottom until he gave up on the riddle (I revealed that I meant what I said when I said both guards lie). 😈

Anyway, that was a bit off topic but still relevant.

I'm wondering if any studies have been done on this? I know studies have been done on human's ability to read words with the letters partially scrambled, but what about typos?

How can I improve my distraction game (with plausible deniability of course)?

 

cross-posted from: https://programming.dev/post/5669401

docker-tcp-switchboard is pretty good, but it has two problems for me:

  • Doesn't support non-ssh connections
  • Containers, not virtual machines

I am setting up a simple CTF for my college's cybersecurity club, and I want each competitor to be isolated to their own virtual machine. Normally I'd use containers, but they don't really work for this, because it's a container escape ctf...

My idea is to deploy linuxserver/webtop, as the entry point for the CTF, (with the insecure option enabled, if you know what I mean), but but it only supports one user at a time, if multiple users attempt to connect, they all see the same X session.

I don't have too much time, so I don't want to write a custom solution. If worst comes to worst, then I will just put a virtual machine on each of the desktops in the shared lab.

Any ideas?

 

docker-tcp-switchboard is pretty good, but it has two problems for me:

  • Doesn't support non-ssh connections
  • Containers, not virtual machines

I am setting up a simple CTF for my college's cybersecurity club, and I want each competitor to be isolated to their own virtual machine. Normally I'd use containers, but they don't really work for this, because it's a container escape ctf...

My idea is to deploy linuxserver/webtop, as the entry point for the CTF, (with the insecure option enabled, if you know what I mean), but but it only supports one user at a time, if multiple users attempt to connect, they all see the same X session.

I don't have too much time, so I don't want to write a custom solution. If worst comes to worst, then I will just put a virtual machine on each of the desktops in the shared lab.

Any ideas?

 

So basically, my setup has everything encrypted except /boot/efi. This means that /boot/grub is encrypted, along with my kernels.

I am now attempting to get secure boot setup, to lock some stuff, down, but I encountered this issue: https://bbs.archlinux.org/viewtopic.php?id=282076

Now I could sign the font files... but I don't want to. Font files and grub config are located under /boot/grub, and therefore encrypted. An attacker doing something like removing my hard drive would not be able to modify them.

I don't want to go through the effort of encrypting font files, does anyone know if there is a version of grub that doesn't do this?

Actually, preferably, I would like a version of grub that doesn't verify ANYTHING. Since everything but grub's efi file is encrypted, it would be so much simpler to only do secure boot for that.

And yes, I do understand there are security benefits to being able to prevent an attacker that has gained some level of running access to do something like replacing your kernel. But I'm less concerned about that vector of attack, I would simply like to make it so that my laptops aren't affected by evil maid attacks, without losing benefits from timeshift or whatnot.

I found the specific commit where grub enforces verification of font files: https://github.com/rhboot/grub2/commit/539662956ad787fffa662720a67c98c217d78128

But I don't really feel interested in creating and maintaining my own fork of grub, and I am wondering if someone has already done that.

 

I'm having trouble with networking on linux. I am renting a vps with only one NIC, one ipv4 address, and a /64 range of ipv6 ones. I want to deploy openstack neutron to this vps, but openstack neutron is designed to be ran on machines with two NIC's, one for normal network access, and entirely dedicated to virtualized networking, like in my case, giving an openstack virtual machine a public ipv6 address. I want to create a virtual NIC, which can get it's own public ipv6 addresses, for the vm's, without losing functionality of the main NIC, and I also want the vm's to have ipv4 connectivity. I know this setup is possible, as the openstack docs say so, but they didnt' cover how to do so.

Docs: https://docs.openstack.org/kolla-ansible/latest/reference/networking/neutron.html#example-shared-interface

There is an overview of what you need to do here, but I don't understand how to turn this into a usable setup. In addition to that, it seems you would need to give vm's public ipv4 addresses, in order for them to have internet connectivity. I would need to create a NAT type network that routes through the main working interface, and then put the neutron interface partially behind that, in order for ipv4 connectivity to happen.

I've been searching around for a bit, so I know this exact setup is possible: https://jamielinux.com/docs/libvirt-networking-handbook/multiple-networks.html#example-2 (last updated in 2016, outdated)

But I haven't found an updated guide on how to do it.

view more: next ›