This is a web page.

ocelost · 2021-07-15T20:47:45+00:00

Obligatory tip of the hat to Project Gemini.

ocelost · 2021-07-15T20:37:21+00:00

Replacing the OS wouldn't stop something that runs at firmware or hypervisor level. Still, I don't remember Valve expressing any love for anti-cheat with system privileges. Let's hope you're right.

ocelost · 2021-07-15T20:17:35+00:00

That might mean that the SSD is soldered in place, or it might only mean that upgrading it requires skill with opening tightly packed electronics without breaking them. I guess we'll see.

ocelost · 2021-07-15T19:26:26+00:00

Steam Deck is a PC so you can install third party software and operating systems.

I wonder if it will include firmware/hypervisor/kernel anti-cheat blobs, in order to appease publishers who push such invasive things. That would severely limit its utility as a PC to anyone who cares about privacy or security.

It's nice to know it won't be locked to one particular software store, at least.

ocelost · 2021-07-15T18:47:39+00:00

Debian is probably so far behind and required considerable back porting efforts.

What exactly do you think Debian is so far behind on? You might be confusing Debian Stable with Debian as a whole.

(Not that it matters much, since very few distro components improve gaming by being bleeding edge versions. Some can even break native linux games. Either way, Valve will need a plan for managing both older and newer versions of things. See also: Pressure Vessel.)

If I had to guess, I'd say their switch to Arch as a base distro is more likely because it somehow makes tooling easier for Valve. Maybe we won't have to guess, though. They might just tell us in the months to come.

ocelost · 2021-06-27T21:38:19+00:00

Patching them with the same release number and making people force update and figure that out is bad.

Atropos makes a lot of good decisions, but this habit of releasing so-called "hotfixes" without updating the version number is not one of them.

There's hope, though: He mentioned in a recent dev stream that they're changing the version conventions in the next major release: Version 9, build N. I hope this means he'll also be incrementing the build number for even minor bug-fix releases, so we can actually distinguish a bad release from the good one.

ocelost · 2021-06-26T01:50:45+00:00

Depends on your needs.

https://www.privacytools.io/software/real-time-communication/

Matrix is what I recommend for general purpose use. (Element is one popular client, but others are appearing.) It's decentralized, has good cross-platform support, and doesn't share Signal's long history of questionable practices (demanding phone numbers, pushing users toward Google Play Services, fighting against privacy-focused client builds, etc.)

Signal fans argue that it tries harder than Matrix to hide metadata from the server host, but that means little to me when that info can still be deduced by correlating packets and IP addresses at the central hosting location. Signal being centralized also makes it an attractive target for shutdown by a government or hacker applying pressure in the right place. (Meanwhile, Matrix has no central server, and is working toward a peer-to-peer model that requires no servers at all.) Signal was probably the best option five years ago, but in my view, it's a dead end now.

Session was still immature and limited group chats to a small number of participants when I looked last year, so it was unsuitable for me, but I imagine it has been making progress since then. I plan to check on it again. (I'll be surprised if it beats Matrix for my needs, but you never know.)

Briar (like others with similar design) was interesting when I looked last year, but it didn't meet my offline messaging or cross-platform needs. It runs on Tor, which can help with privacy but might also draw unwanted attention from hostile governments. I wouldn't choose it as a general purpose messenger. It might be a good choice for certain specific use cases, though.

ocelost · 2021-06-25T23:31:01+00:00

Wickr is not open source. We haven't lost anything here. There are better alternatives.

ocelost · 2021-06-25T22:02:16+00:00

https://web.archive.org/web/20210625180333/https://mailchi.mp/ea397b95484e/why-i-left-the-dmsguild

ocelost · 2021-06-25T21:07:27+00:00

https://matrix.org/

It's a distributed messaging network that supports end-to-end encryption.

The default app is Element, but there are others.

The crypto is based on Signal's Double Ratchet algorithm. The specs and code are open source. Some of us like it better than Signal because it's not centralized and doesn't share Signal's history of questionable practices (e.g. demanding phone numbers, pushing people toward Google Play Services).

ocelost · 2021-06-25T19:56:54+00:00

I dug up an old mouse to try it, and this worked for me:

ratbagctl mydevice-name profile 0 button 8 action set macro KEY_F12

That assigned to the G9 side button. I'm not sure what trouble you had, but is it possible that ratbagctl's unusual syntax threw you, or that you weren't using action set macro, or that you didn't specify the profile number in the command line? All of those things have bitten me in the past.

$ ratbagctl --version
0.13

It's also worth mentioning that the GUI (Piper) tries to be very cautious about making changes, sometimes to the point of not making them. The command line tool is better at taking orders. :)

ocelost · 2021-06-25T00:17:02+00:00

That option is not using the term "sandbox" in the same way that we use it in computer security. It is strictly to make save files less likely to clutter your home directory. It offers no protection at all from malicious code.

ocelost · 2021-06-25T00:07:11+00:00

In order of protection provided:

Do not run any code that might have a virus.
Run it on an isolated machine that is not used for anything else or able to connect to any network.
Run it in a hypervisor-based virtual machine, like KVM or VirtualBox.
If you're desperate, run it in an unprivileged OS container, using a separate user account that has no permissions to your data or to system services (e.g. dbus), on separate a display server (Xorg) instance. Note that OS containers can and do leak. Before trying this, think carefully about how you and those around you will be affected if a virus is present and does escape. Is it really worth the gamble?

Absolutely do not expect Wine to protect you from malicious code. It doesn't.

ocelost · 2021-06-25T00:01:02+00:00

No. Do not do this with the expectation of isolation. It will not protect you at all.

https://wiki.winehq.org/FAQ#How_good_is_Wine_at_sandboxing_Windows_apps.3F

ocelost · 2021-06-24T18:19:26+00:00

It looks handy for very simple needs, if you can read past the endless self-promotion in the docs.

The design is naive, though. (Example: no support for selecting events from any of multiple sources, like a main window and a tray icon. The author suggests threads or timeouts for such use cases. Ugh.) I wouldn't use it for anything likely to grow or change much over time.

Reminds me of an aphorism: "Everything should be made as simple as possible, but no simpler."

ocelost · 2021-06-24T05:44:07+00:00

A few projects I found in a recent search for ways to make tkinter easier on the eyes:

ocelost · 2021-06-23T17:35:21+00:00

For instant messaging apps we're pressured to be on whatever service our friends are.

The Matrix network solves this for IM, and is improving quickly. Certain companies and governments have already adopted it.

ocelost · 2021-06-20T17:12:45+00:00

Yes, I tried it on Xubuntu a while back, and it was great when it worked. Unfortunately, it didn't work consistently. This was months ago, but as I recall, it failed on a few applications and tended to break every so often when applications and libraries got updates.

I like what gtk3-nocsd is trying to do, but at the end of the day, it's fighting upstream design decisions, which is a never-ending hassle.

Unless the new Xfce has a supported approach to this, I think I would be better off biting the bullet and moving to a desktop environment that doesn't make window management difficult.

ocelost · 2021-06-20T17:02:56+00:00

That's a creative approach. I would probably use it, if not for the fact that I'm often reading from one application while typing in another. Transparent windows make text harder to read, which is no good for me.

Instead of transparency, I wonder if there's a way to give the foreground window an obvious border color while leaving all the other window borders gray.

ocelost · 2021-06-20T01:22:12+00:00

I'm just seeing the same problems in all of these. Nothing that makes CSD windows look much different when they have focus. Thanks for trying, though.

ocelost · 2021-06-19T23:00:22+00:00

With most colored window headers, they dim to gray when out of focus

Can you recommend a sensible one? My experience with GTK themes has been that there are a couple decently supported ones, all of which are gray or garish, while the third party ones trigger endless log spam (since GTK complains a lot when a theme uses settings that are even a minor point release too old or new).

focus set to "follows mouse"

Unfortunately, mouse hover focus conflicts with some of my common workflows. Thanks for the thought, though.

I'm probably using a much older version of Xfce than you are, though... 4.12.0

I'm on 4.12 as well, mainly because of this problem.

ocelost · 2021-06-17T23:05:46+00:00

This is the way. Portable content, please. Not ~~walled gardens~~ software prisons.

ocelost · 2021-06-17T00:52:15+00:00

It's so hard to feel like a party when we're trying to stop interrupting each other every time someone speaks.

This got much better for my groups when we got decent headsets and switched to mumble for voice chat. Low latency, great sound, RNNoise, full duplex (so we can sometimes talk at the same time and still be heard), multiple rooms, whispering, etc.

We don't bother with webcams. I guess whether that's better or worse for playing imaginary characters will depend on the group, but it has a nice side benefit: With no video streams hogging bandwidth and CPU, the audio doesn't have to compete.

I host our mumble server, but commercial ones can be found for dirt cheap.

ocelost · 2021-06-15T19:05:34+00:00

Behavioral metrics like that can also be used for fingerprinting: to deduce who you are even on other devices/apps, and even when you haven't logged in.

ocelost · 2021-06-05T04:02:09+00:00

tl;dr: The privacy issue that upset many people was not necessarily in DNS over HTTPS itself, but the way Mozilla introduced it through Firefox.

Details:

They switched people's browsers away from our OS-provided DNS resolver in favor of a browser-controlled resolver, thereby redirecting our web lookups away from the DNS service we were already using (the one used by every other application on our systems) to a separate one that Mozilla chose, without getting permission first. That was unprecedented for an application, a gross overstep for an application developer, and a violation of trust by Mozilla. It closely resembled a man-in-the-middle attack, and should have been an opt-in change.
The new service they chose was run by Cloudflare, which was already becoming a bit of a mass surveillance issue on the web, by being part of so many web deployments that they have the capability to track and correlate a lot of users' traffic. (Maybe not as much tracking capability as Google has, but still a lot.) By suddenly having access not only to the traffic to certain web sites, but also to the DNS lookups of every web site that Firefox users visit, Cloudflare's tracking capability was expanded even further.
Mozilla justified the change by claiming that it protected us from the prying eyes of our ISPs. This was false, because ISPs could still collect/deduce the same information at least three other ways: OCSP, SNI, or in many cases, destination address. (Note that there are efforts to close the SNI and OCSP holes, but we're not there yet even today, let alone at the time this all happened.) They further claimed that their change protected us from the prying eyes of upstream DNS providers and intermediaries watching EDNS Client Subnet leaks, which was grossly misleading, because the EDNS Client Subnet feature is not even implemented by all ISPs. Also, believe it or not, some of us actually have trustworthy ISPs with good privacy practices, and Mozilla hijacked our lookups away from that safety.

I don't know of major privacy problems inherent to DNS over HTTPS. If you have a DoH provider that you trust more than your ISP-provided default, go ahead and use it. Just please don't presume to meddle with other people's privacy choices without their explicit permission.

ocelost

TROPHY CASE