pootriarch

joined 2 years ago
MODERATOR OF
[–] pootriarch@poptalk.scrubbles.tech 14 points 2 years ago (1 children)

i rather doubt a government would push people out of signal-protocol apps and into Some Other App if they didn't already have a backdoor into the designated substitute

 

(i own this in digital format, we are not the same)

 

I had reimaged my old Samsung on LineageOS as it seemed to be the only alternative that supported my model. It was fine until I installed OSMAnd, which couldn't get a location. Shame on me for not noticing that I would need microG for that. Not feeling comfortable with all the rooting and flashing needed to shoehorn microG into an existing image, I figured I'd try LineageOS for microG.

Having loaded a lot onto this phone already, I wanted to try a dirty flash first, knowing full well it might not work. The first prerequisite is to use an image of LOS/µG that is dated higher than the image in the phone. I had just updated, so I needed to wait for the next one.

The docs say that LineageOS for microG will be updated "a couple of times a month". But the latest LOS/µG image has remained at 11/2/23. This means I haven't had an opportunity to try the dirty flash, but it's also a security warning sign for me—LOS updates weekly like clockwork. Irregular and slower-than-promised updates make me a bit nervous for this aspect of device safety. It's not just my model either; most of the images are backdated more than two weeks.

https://download.lineage.microg.org/

(Yes, I know my boot loader is unlocked, and no, Calyx and Graphene don't support me, so I made my choice between physical insecurity and Google insecurity.)

strangest thing. i updated firefox and now i have no notifications. only a limited number of sites have notification perms; they still say they have that permission and my system settings still have firefox allowed. i have another machine running ubuntu (with firefox from the PPA for apt) and notifications are unchanged there.

Prerequisites

  • Internet-facing web server with reverse proxy and domain name (preferably SSL of course)
  • Server behind the reverse proxy with Rust environment

Installation

  • Don't bother downloading the source code to your server; installing it that way gives you a big debug executable
  • Instead just cargo install mollysocket
  • Move the mollysocket executable if desired
  • Run mollysocket once so that it will emit the default config

Configuration

  • Fish the config file out of .config/mollysocket/default-config.toml and copy it somewhere.

config.toml

  • In the new file, replace the allowed_endpoints line with allowed_endpoints = ['*']. The default 0.0.0.0 config appears to be a bug; this setting controls access to endpoints within the app, not IPs from outside. Leaving the original value causes mollysocket to reject everything.
  • Put a proper path in the db = './mollysocket.db' line rather than just having it land wherever you're sitting.
  • Delete the mollysocket.db that was created on first run (even if it's already where you're intending to put it). This is just to make sure the web server creates it and has the correct permissions.

Run script

  • The environment variable ROCKET_PORT must be set or the server will sit and do nothing. It's best to create all of the environment variables mentioned in the README, whether that is in a user profile script or in a shell script that wraps startup. You can change any of these values, but they must exist.
  • export ROCKET_PORT=8020
    export RUST_LOG=info
    export MOLLY_CONF=/path/to/your/config.toml
    

Proxy server

  • You'll need to proxy everything from / to your mollysocket server and ROCKET_PORT.
  • Exclude anything that you may need served from your web server, such as .well-known.

Things to know

you probably already found this, but for others who might be curious:

https://molly.im/

https://github.com/mollyim/mollyim-android

in the settings if you change notification method from websocket to unified push, the UP settings come up, including a server address (which is what they intend to be used) or some air gap mode that i can't find documented

 

The Molly fork of Signal now has a variant that supports UnifiedPush, but it requires a helper called Mollysocket to be installed on a server somewhere. I can't get my head around the (we'll call them 'lean') docs, and I've never encountered such a helper for other UP apps. They just ask what to attach to, and they attach.

Has anyone fought through this?

[–] pootriarch@poptalk.scrubbles.tech 3 points 2 years ago* (last edited 2 years ago)

if your threat model were 'encrypt everything at rest', invitations to people outside your own service would be tricky as they have to be machine-readable text in a specific format. i'm sure it's possible but you'd have to be specific in looking for that as a feature.

my needs are more modest - don't store email in GAFAM or particular regimes - and i use runbox, which is bog-standard except for being stored somewhere else, being paid, and having slightly more homely webapps. using 'evolution' on linux, a bog-standard email program that's also a bit more homely than alternatives, invitations go out to whomever i choose and look normal. i make recurring events for myself all the time and remove individual occurrences. i've added on ical subscriptions for things like country holidays, which are the first thing you'll notice missing when you leave outlook.

the mail's just imap and the calendar's just caldav. when you get into providers that don't provide imap or caldav for (valid) security reasons, that's when you're more likely to get integration issues with regular people.

[–] pootriarch@poptalk.scrubbles.tech 3 points 2 years ago (1 children)

i'm shopping for mp3 players for precisely this reason - a friend has an ipod touch that abruptly stopped scrobbling. the last.fm app is stuck in a loop sucking battery. and she needs bluetooth anyway. she has always kept music and phone separate but now we have to ask the five whys on that before getting her a new unfamiliar gadget.

 

i hadn't fired up my python project in an age, probably two vscodium updates. when i did, i had no more syntax checking and the alert window showed errors reaching the 'jedi' server.

downgrading the vscode-python extension to 2023.16.0 was seen as the surefire way to clear this. it worked for me, too - got my syntax error highlighting back and no pesky errors in the alert pane.

they created a new issue against the extension, or the packaging system, or something, which was closed immediately though the problem still persisted. the chatter was about a cache, somewhere, with a lot of 'perhaps' and 'if'. one day i'll try bumping this back up, maybe after vscode-python passes the problematic 2023.18.0 version.

 

every so often someone posts a link and someone else asks, where can i get a link that's on a different service? songwhip is an aggregator that provides a page with links to multiple services. obviously if you want to post the exact video or the exact remix, a direct link is what you need. but it's quite useful for 'joe bob says check it out' scenarios.

part of humans learning to drive safely is knowing that flouting traffic laws increases your chance of being stopped, fined, or if you're not the right demographic, worse things. we calibrate our behavior to maximize speed and minimize cops, and to avoid being at-fault in an accident, which is a major hit to insurance rates.

autonomous vehicles can't be cited for moving violations. they're learning to maximize speed without the governor of traffic laws. in the absence of speed and citation data, it's hard to measure how safe they are. there is no systemic incentive for them to care about safety, except for bad press.

again not foss so won't dwell at length — but i use fund manager from beiley software. commercial, but works double-entry and handles more investment complexity than a human could ever need. windows app, i run it under wine on linux and crossover on mac. (i don't own a windows box — that's how irreplaceable it was for me.)

asus pn51, a mini nuc-like box

 

A few updates ago Pop started nagging me to accept firmware updates. My layman's reading of the release notes is that it's a Microsoft package that can block boot based on an ever-increasing number of packages they don't like.

Is it safe to take an update like this? Unlike a kernel change, I don't know how to recover if this goes wrong.

so per wikipedia and confirmed at MDN, firefox is the only major browser line not to consider certificate transparency at all. and yet it's the only one that has given me occasional maddening SSL errors that have blocked site access (not always little sites, it's happened with amazon).

i don't understand how firefox can be simultaneously the least picky about certificates and the most likely to spuriously decide they're invalid.

 

ooooh, give you up

h/t @cmconseils@mastodon.social

https://mastodon.social/@cmconseils/111284052730734939

 

Chromium derivatives like Vivaldi and Brave decried the Google Web Environment Integrity… um, 'feature', at varying volumes, back in the summer when it became widely known.

But can any Chromium-based browser actually avoid implementing this? Have there been more recent statements?

 

Since the integrity environment gunk, I've switched all boxes over to use Firefox as primary. This took a lot of configuring, as Firefox out of the box brings… a lot of stuff I don't want.

One of those things is telemetry — whatever that means to Mozilla — that was tamed only with a combination of an enterprise profile (hi sudo!) and user.js hacks.

However, the policy and user.js changes don't work on the Ubuntu box, where I've installed Firefox from the PPA to get it out from under Snap (and thereby usable with a password manager). The policy locks down and disables the right configs and the configs all have the right settings, but it keeps pinging incoming.telemetry.mozilla.org. Two Macs and a Pop!_OS box don't ping Mozilla at all with these settings.

No harm no foul, I just blocked them in NextDNS and laugh in their general direction. I just wonder what else is different in the PPA.

 
 

Every few Firefox releases there's one where they helpfully throw new junk in your face or mess with your settings. Firefox 118 is both.

Mozilla has added a translation engine that they say is client-side, based on an engine called Bergamot that they created. They removed all languages other than the one I'm writing in from my settings, even though I read (poorly, and for sport) in other languages. And then they put a pop-up over every page that's not in English - including some I've deliberately switched to other languages - offering to translate it.

Getting rid of this requires an about:config hack that I saw only on The Site We've Chosen Not to Use. So here's the incantation:

browser.translations.automaticallyPopup false

and if you're really angry

browser.translations.enable false

And put back any languages it removed from your site preferences.

Honestly, if I didn't know these people weren't Google, I'd be really suspicious. But with Chrome's stellar Ad Privacy, I have to put up with Mozilla's crap, as the clock has to be ticking even for the 'good guy' Chromium derivatives.

 

on a block of downtown san francisco, there are two block-long lines labelled 'address interpolation'. there aren't many nodes along this block, but the ones that exist mostly have explicit addresses assigned.

these were created 14 years ago (potlatch 0.10f). what do they do, are they valuable to renderers or to the map itself?

view more: ‹ prev next ›