alufers

Smart lightbulbs are crappy, since If you turn them off using a light switch, you can't turn them back on via Wi-Fi. I've installed smart relays (Sonoff mini) behind light switches, which means I can control them localy and remotely at the same time.

That being said, anything that can be flashed using tuya-convert will be good. But beware, because not all Tuya lightbulbs hava an ESP chip inside and they have patched the exploit tuya-convert uses in newer firmwares. So check your model on google.

Before I got a Raspberry Pi with home assistant, I was trying to write a simple client for this protocol in C so I could host it on my OpenWRT router. Of course my client bugged and sent some random junk which caused the unit to completely lock up, it displayed 88 on it;s display and didn't respond to the IR remote. After this I had to reset it via the circuit breaker.

If I recall correctly, the data was encrypted using a static AES key, and I think the unit checked if the data decrypted correctly, but don't quote me on that.

I personally just flash everything possible with open-source software. All my light switches and Wi-Fi lightbulbs run Tasmota, which I password protect and semi- regularly update. The one odball is my Gree AC unit, which is on a separate WiFi network and subnet (I just run hostapd on my RPi since it's close-by). But it's more to protect it from the outside, not the other way, because it's controlled with JSON sent over UDP, and if you send a malformed packet the microcontroller inside crashes. When this happens and the compressor is engaged it will freeze up, possibly destroying itself and start flooding the floor, because the condensation pump won't turn on.

How would you know how a message contains an exploit before you know such an exploit even exists?

Also for iPhones it's usually iMessage instead of SMS which supposedly is e2e encrypted.

Unfortunately it's my work laptop.

Sorry for changing the topic but does anybody know the reason Intel has removed the seep states?

It drives me absolutely nuts when I open my bag and feel the heat coming out of it, and my laptop is left with 20% charge.

I once needed to create a bot that sent notification and I just used the webhook feature in a Team channel. Not defending Teams though, it is a horrendous piece of software.

OSM is so good that even the fire fighters use it in Poland for navigation and finding fire hydrants. The funny thing is that if you modify or add a fire hydrant a guy from the emergency services asks to send a picture of it before he approves the change.

You can either use root access or disassemble the app, remove the flag, and then assemble it again. Impossible to do if the app uses SafetyNet though.

You are joking right? If not, I'd kill for a video of this setup working.

Nope, but it's not a problem since a friend can use his account to log in to yours server.

Oh sorry, English is not my native language and I had to rephrase a few times, totally missed that.

>You'll see webrips all the time with 1080p because someone can just record their screen and call it a day.

I've checked my tracker and practically all TV shows from Netflix that are in 4K can be downloaded in 4K. And I am 99% sure they are not screen caps, for example the entire second season of The Witcher was released 17 December at 09:01, and my tracker had it ready to download at 12:26 at 4K with 3 audio tracks and 2 subtitle tracks. The runtime of this season on imdb is about 8 hours, so it would be impossible to screencap, which means they had a bypass for the DRM ready ahead of time.

Of course these are just examples that I made up and I would never enter or use such filthy and illegal websites.

And for the mobile and smart TV experience there is Plex. It even has features which aren't possible with the legitimate services, such as "Watch Together" which allows you to watch stuff with friends over the internet.

Can we just stop the shitshow with DRM? I have NEVER encountered a TV show/movie that I could't rip using a torrent either on public p2p sites or a private tracker.

But I have seen a lot of my non-technical friends and family having a degraded experience, who pay for their streaming services every month. It was either because they were using a browser or device which was deemed unworthy of full quality streaming by the mighty DRM authors. And now the poor users of the TB-X505X will also have a degraded experience.

Unfortunately the Linksys E8450 is unavailable in my country (Poland) or is ridiculously expensive. I settled on a Totolink X5000R which supposedly is supported by OpenWRT and has a Mediatek MT7621A. I will receive it in 2 days and test it.

Couldn't you just create an account for them that has a few whitelisted posts that are squeaky clean? Or better yet apply the whitelist when a request is made from a not-yet-released version of the app, based on headers?

Woah, really in-depth write-up. It's sad that so many vendors are locking-up their Linux devices, preventing technically savy people from running their own software there (and also not releasing drivers to their hardware, for example it is really hard to find a 802.11ax router that is supported by OpenWrt).

> This app is written in Go, and it’s really hard to disassemble. Shouldn't it be easier than an app written in C/C++? As far as I know Go embeds reflection metadata, including type information, which should help with decompiling. I have never tried though, so I might be wrong.

How is setting up a catch-all more secure in terms of account takeover? All the emails still go to one mailbox.

The only benefit is that when a website decides to sell your data or leak it, you know who is to blame and you can block that one e-mail they send the spam to.

> Speaking of which, how long before it won't be possible to host your own web server?

It's increasingly getting harder and harder. Recently I was trying to watch a TV show with my friends using a self-hosted Plex server, which was located in one of my friend's house, connected via a gigabit, albeit residential link. Another friend was using LTE internet at that time. He couldn't watch the show, because his connection was so slow, but when he did a speed test the download speed was good enough (100+ Mbit).

Turns out the mobile carrier was throttling connections to select IP ranges to about 1 Mbit (we tested that with a few other IPs). I reckon it was to cripple peer-to-peer protocols. So I guess it's a matter of time until you will be allowed only to connect to certain IP addresses owned by the biggest companies (AWS, Azure, GCP) and nothing else.

Is there any alternative, though?

I connected a Raspberry Pi I keep under the desk as a server via HDMI and I could easily issue commands. Wanted to write a deamon that translates MQTT -> DDC, but never got to that and I removed the cable last time i needed it for something else.

No idea really (that's the problem with usb-c stuff), it didn't say thunderbolt anywhere and it was cheap, so I suppose it's just usb-c.

Sometimes it also the availability of commands depends on the cable/adapter used. If I connect my monitor directly via HDMI to my laptop I can send all the DDC commands I want, but when I use an USB-C -> DisplayPort cable ddcutil couldn't event detect the monitor. Sadly I must use this cable, because it's the only way I can get 4K@60FPS.

> I'm also curious: has the plan to drop "less active" repos from the index gone through? Has anything changed?

Whaaat? I hope it doesn't go through. I use GitHub code search for clues when reverse engineering cheap Chinese IoT crap. Usually I can find some headers / SDKs accidentally uploaded and set to public by a random Chinese guy. Those repos usually have one commit and zero traffic, but they contain invaluable information about proprietary MCUs.

> wrapper script to set up LD_LIBRARY_PATH, or custom derivation to patch their ld lib paths.

There is your problem, I don't want to spend time writing wrapper scripts, or researching how to craft my buildFHS for every little piece of software I will run once for an oddly specific purpose.

Running the proprietary VPN on Arch Linux was as simple as running debtap, and then installing the package via pacman, even though the package shipped by the vendor was made for Ubuntu. It even figured out the dependencies automatically.

I know I could do the same thing on NixOS, but it would be way more clunky and time consuming. For example: this is how a package is installed from a .deb using nix: https://github.com/NixOS/nixpkgs/blob/nixos-19.09/pkgs/tools...

If Arch can do it in two commands, so should NixOS, just with two lines of nix :)

I really tried making a derrivation for for the nomachine server, but it consists of a wrapper script in bash which for some reason is very long and complicated, this script calls a binary which required some libraries which were missing in the NixOS repo, and everyting assumed the program was installed in /opt/something. Then I tried steam-run, but the program just segfaulted on me when I tried. This is where I reckoned investing more time was not worth it.

On Arch I just do `yay -S nomachine` and call it a day.

But I really believe that someday the NixOS community will catch up, but currently it is not for me, since sometimes I want to get stuff done and not tinker with my system.

The knowledge is one thing, because you can always learn how to do things the "Nix way" (either by reading the incomplete documentation or tinkering for hours until the thing works).

But the real problem is that software does not understand nix either.

For example loads of scripts expect /bin/bash to exist, but on NixOS it is missing. Want to run a random python script from github? Well that's a bummer, because there is no nix version of a random library this script uses. Also no-machine server and Chrome Remote Desktop don't work, and these are the two remote desktop solutions which work on spotty 4G.

And I had to ditch NixOS, because my employer forced me to use a proprietary VPN, and I there is no way it would run on NixOS.

Reminds me of the times when you could install Ubuntu via an .exe file using WUBI. This is how I started with Linux on my grandparents' computer without breaking it when I was 11.

Yes, it does. Unix permissions can be stored on NTFS, but Windows just doesn't use them.

What I would really like to exist, is a VM image for Windows 10, without all the telemetry, updates and anti-virus software. I hate that when I need to test something on IE, my laptop's fans start spinning up, and the VM is unusable, because Microsoft decided its a good time to scan the whole disk and consume all the vCPUs allocated to the vm.

You would get a lot of false positives, meaning apps that legitimately need the location. For example navigation apps or unfortunately apps on Android which use Bluetooth.

This really annoys me, because the dialog looks the same for apps that want to use GPS data and apps that use Bluetooth, and there is no way to grant just Bluetooth permissions.