evgpbfhnr

You can script around https://git.kernel.org/pub/scm/linux/security/vulns.git/ (which is likely what the page you linked use)

> Replacing Pandoc (GPL and so incompatible the the App Store TOS)

... wait, you can't publish an app using GPL components to the app store? What's the point of this? .. oh, that made quite some noise around 2010 https://lwn.net/Articles/391423/ but I had forgotten all about it... Impressed this still stands...

You're describing https://bellard.org/ts_zip/ ("Text Compression using Large Language Models") ?

It's actually already implemented in javascript, I didn't understand what this was about until I turned js on and saw the blocked screen.

And it gets even more fun when browsers such as firefox implemented this, then decided no we won't do it and removed the feature -- now there's no way to access your router web interface over link-local address...

(rationale being that whatwg said no: https://github.com/whatwg/url/issues/392 ; firefox bug https://bugzilla.mozilla.org/show_bug.cgi?id=700999 )

The "solution" is to use a proxy such as https://github.com/twisteroidambassador/prettysocks/tree/ipv... which incidentally encode the % as a `s` and handle special URLs like this http://fe80--1ff-fe23-4567-890as3.ipv6-literal.net for you through the socks dns resolution feature... I've never found anything else that works recently -_-

I'd definitely love to see more screens like this sold (and getting better & more affordable with time)!

The mira pro color is marked as sold out and I can't even figure how to check non-color version on their site, so this doesn't look like something they sell a lot of though...

Our company had the same shift, but it's not so much forbidden as just unsupported as they disabled simple password auth.

If you waddle through setting up a project on the google developers console, setup your own oauth auth flow, find/scaffold something with mutt oauth script to fetch your mails locally, then you can likely get it to work too... (And then sending mails is another sidequest, and if sending mail breaks for some reason that's one in two odds you don't notice for a couple of days.. but it's fine spending work time on this right?)

How they react after you're done is another problem though... I told the IT lead and his reaction was just a shrug, but some could be more vindictive.

(logo doesn't render on my browser... So I wouldn't have guessed either.) (firefox/linux, but it really is a font problem, not a browser problem)

Ironically it was quiet enough in our previous apartment, but moving to a house we now have the neighbor using their awfully loud snow-spitting machine before 6AM after snowy nights... (And it snows a lot)

iiuc, this mail isn't about his PRs being rejected, it's the OCA submission e.g. the CLA obtention form.

(So his ping "any progress?" apparently fell on the wrong ears, if he wasn't told he had to submit a new application with something corrected...)

Great js implementation! I don't have any iThing but I'd happily play your js version in a browser for a while.

Since you mentioned Simon Tatham puzzles there's a js version here[1], but it really just isn't quite as good

[1] https://www.chiark.greenend.org.uk/~sgtatham/puzzles/js/patt...

(if I were to nitpick, for large grids one might want to make the separating line a bit thicker every 5 blocks for faster counting, and repeat numbers at the bottom/right -- but at the size the examples are in neither are needed)

(BTW you didn't mention for overlapping but there's a nice trick: just try from either end, count how many cells are leftover, and take that off the starting side of each block)

>> You definitely can use Linux with few simple servers with 128 MB RAM. > > This is not difficult, you just need to run `htop` and perform addition of the RES column (which is in KB unless a unit is shown). Example:

I'm not quite sure what points this makes... That's supposed to fit on 128MB? And it doesn't include memory consumed by the kernel itself (which is not negligible at this scale), and linux needs spare for cache to work remotely decently.

    $ awk '{ tot+=$2 } END { print tot /1024 }' < list
    214.035

I'm sure you can run a linux with 128MB of ram, but certainly not with systemd and a default kernel... Perhaps DSL (damn small linux) or alpine.

mem, yes, definitely. I'm not sure how you can protect yourself from that (or root user using ptrace or equivalent debugging tool) though...

Oh, memfd_secret?

       The memory areas backing the file created with memfd_secret(2) are visible only to the processes that  have  ac‐
       cess  to the file descriptor.  The memory region is removed from the kernel page tables and only the page tables
       of the processes holding the file descriptor map the corresponding physical memory.  (Thus, the pages in the re‐
       gion can't be accessed by the kernel itself, so that, for example, pointers to the region  can't  be  passed  to
       system calls.)

> This article does not mention that environment variables are also visible by process in /proc/*/environ (which has restrictive permissions, but is completely visible to root).

He's explicitly not using export, so they won't show up there. Plain variables are not in the environment.

(it's good to bring up this file as well as getting inherited by child processes though)

> I’m also intrigued by the potential that type systems have for “tagging” secrets and preventing their propagation beyond where they’re needed

facet (rust) allows tagging fields as sensitive so they won't show up in logs: https://facet.rs/guide/attributes/#sensitive

I'm sure other languages have equivalents but I rarely see this.. for example I was about to say serde doesn't do it, but it looks like it's possible with a wrapper type? https://docs.rs/redactrs/latest/redactrs/

Anyway, this kind of tagging is good, I want more!

I don't get why a bad guy couldn't dump the current log / hash, then load a kernel module that'd just replay the same values whenever someone asks for it? Does the log have a challenge/nonce from the client that'd change the hash everytime it's obtained? (if the client loads their own kernel module they can check it's on the list, but the whole point is about not having to do that, right..)

I had the same problem on our home server.. I just stopped the git forge due to lack of time.

For what it's worth, most requests kept coming in for ~4 days after -everything- returned plain 404 errors. millions. And there's still some now weeks later...

I get a new fingerprint id everytime I refresh the page (firefox, linux) -- so that might be sampling a tiny bit too much. audio and canvas fingerprint are constant though so it's probably plenty enough...

Also convinced they're observing a correlation with this rather than something age specific. It's like exercise, it's really impressive how people who stay active in their late years can still be very fit way into their 80s or 90s, yet if one stops trying it just crumbles away.

Breaking the system is the point! Let them break stuff, you learn when you have to fix it afterwards.

Thank you!

Unfortunately I get the same kind of garbage around closing curly braces / closing parenthesis / dots with this magick filter... It seems to do slightly better with an extra `-resize 400%`, but still very far from as good as what you're getting (to be fair the monochrome filter is not pretty (bleeding) when inspecting the result).

I wonder what's different? ( ImageMagick-7.1.1.47-1.fc42.x86_64 and tesseract-5.5.0-5.fc42.x86_64 here, no config, langpack(s) also from the distro)

To author -- code sample as images is great for syntax highlight but I wanted to play with the examples and.. got stuck trying to copy the content.

(also expected tesseract to do a bit better than this:

  $ wl-paste -t image/png | tesseract -l eng - -
  Estimating resolution as 199
  const std = @import("std");
  const expect = std.testing.expect;
  
  const Point = struct {x: i32, y: i32};
  
  test "anonymous struct literal" {
  const pt: Point = .{
  x = 13,
  -y = 67,
  33
  try expect (pt.x
  try expect(pt.y
  
  13);
  67);

)

If you're curious about the legacy link being a 404, the correct link seems to be that: https://tenacityaudio.org/legacy/legacy.html

(found sniffing around https://codeberg.org/tenacityteam/tenacityaudio.org , this 404 was reported on IRC)

Oh! That didn't exist a few months ago, I need to update and do this then :D

I have a script that allows searching for windows based on title; so e.g. if I know I had a shell open in directory X I could search for that and jump to it... But in practice I quickly have 5+ shells in a directory once I start working on something and at this point my script doesn't let me differentiate between these easily enough to be useful.

Hmm, perhaps that could be made more interactive and allow cycling through these without closing the search overlay... I'll give that a try! :)

Yes and no; the difference with workspace is that I was limited to 0-9 with my old wm, so at some point I'd just run out of space and had to close some windows. (well, that, and X11 is apparently limited to 256 clients by default and I never changed that; but I rarely hit that limit :P)

I do have some struts on the side, but I'm basically always juggling with at least 4 or 5 tasks so I always have things open; (I'm not using any right now but I do like the "quake terminals" temporary term styles... But for the same reason it's not always appropriate -- if I didn't close the term, it's because I wasn't done with it and mean to get back to it...)

I started using niri before the overview, I think that could help if I get used to it. But better than overview, what I'd want is something always visible like some horizontal scrollbar indicator to remind me there's e.g. more than 3 windows hidden or something. That might be possible to do with waybar and a bit of glue parsing the windows list...

My only complain about niri is that after a few weeks without reboot I end up with ~500 terms open, as I often open a new shell to check something, get distracted, and forget about it as it scrolls out of the view... (I usually notice at the 400-500 mark because this machine starts swapping noticeably, and closing it all is a chore that usually ends in pkill without checking...)

Maybe a bit more self discipline would help :)

"How it works" https://realtimelogic.com/ba/doc/en/SoftTPM.html

I couldn't find "actual sources", but one of their github repo has this: https://github.com/RealTimeLogic/BAS/blob/main/examples/Mako...

Which extracts to this .config file (looks like lua code, that creates a secret from PBKDF2 of... what? I couldn't find where secrets would come from here, but that repo obviously misses the interesting bindings; from the how it works link it looks like they're just hashing the SN to generate a pseudorandom key but I don't see why you couldn't just generate a key for neighboring devices by just faking the SN then...)

    local maxHash=pcall(function() ba.crypto.hash("sha512") end) and "sha512" or "sha256"
    local sfmt,jencode,jdecode,symmetric,PBKDF2,keyparams,sign,jwtsign,createkey,createcsr,sharkcert=
    string.format,ba.json.encode,ba.json.decode,ba.crypto.symmetric,ba.crypto.PBKDF2,ba.crypto.keyparams,
    ba.crypto.sign,require"jwt".sign,ba.create.key,ba.create.csr,ba.create.sharkcert
    local function setuser(ju,db,name,pwd)
    if pwd then
    if type(pwd) == "string" then
    pwd={pwd=pwd,roles={}}
    end
    db[name]=pwd
    else
    db[name]=nil
    end
    local ok,err=ju:set(db)
    if not ok then error(err,3) end
    end
    local function tpm(gpkey,upkey)
    local keys={}
    local function tpmGetKey(kname)
    local key=keys[kname]
    if not key then error(sfmt("ECC key %s not found",tostring(kname)),3) end
    return key
    end
    local function tpmSign(h,kname,op) return sign(h,tpmGetKey(kname),op) end
    local function tpmJwtsign(p,kname,op) return jwtsign(p,function(h) return sign(h,tpmGetKey(kname)) end,op) end
    local function tpmKeyparams(kname) return keyparams(tpmGetKey(kname)) end
    local function tpmCreatecsr(kname,...) return createcsr(tpmGetKey(kname),...) end
    local function tpmCreatekey(kname,op)
    if keys[kname] then error(sfmt("ECC key %s exists",kname),2) end
    op = op or {}
    if op.key and op.key ~= "ecc" then error("TPM can only create ECC keys",2) end
    local newOp={}
    for k,v in pairs(op) do newOp[k]=v end
    newOp.rnd=PBKDF2(maxHash,"@#"..kname,upkey,5,1024)
    local key=createkey(newOp)
    keys[kname]=key
    return true
    end
    local function tpmHaskey(kname) return keys[kname] and true or false end
    local function tpmSharkcert(kname,certdata) return sharkcert(certdata,tpmGetKey(kname)) end
    require"acme/engine".setTPM{jwtsign=tpmJwtsign,keyparams=tpmKeyparams,createcsr=tpmCreatecsr,createkey=tpmCreatekey,haskey=tpmHaskey}
    local t={}
    function t.haskey(k) return tpmHaskey(k) end
    function t.createkey(k,...) return tpmCreatekey(k,...) end
    function t.createcsr(k,...) return tpmCreatecsr(k,...) end
    function t.sign(h,k,o) return tpmSign(h,k,o) end
    function t.jwtsign(k,...) return tpmJwtsign(k,...) end
    function t.keyparams(k,...) return tpmKeyparams(k,...) end
    function t.sharkcert(k,...) return tpmSharkcert(k,...) end
    function t.globalkey(n,l) return PBKDF2(maxHash,n,gpkey,5,l) end
    function t.uniquekey(n,l) return PBKDF2(maxHash,n,upkey,5,l) end
    function t.jsonuser(k,global)
    k=PBKDF2("sha256","@#"..k,global and gpkey or upkey,6,1)
    local function enc(db)
    local iv=ba.rndbs(12)
    local gcmEnc=symmetric("GCM",k,iv)
    local cipher,tag=gcmEnc:encrypt(jencode(db),"PKCS7")
    return iv..tag..cipher
    end
    local function dec(encdb)
    if encdb and #encdb > 30 then
    local iv=encdb:sub(1,12)
    local tag=encdb:sub(13,28)
    local gcmDec=symmetric("GCM",k,iv)
    local db
    pcall(function() db=jdecode(gcmDec:decrypt(encdb:sub(29,-1),tag,"PKCS7")) end)
    if db then return db end
    end
    return nil,"Data corrupt"
    end
    local ju,db=ba.create.jsonuser(),{}
    return {
    users=function() local x={} for u in pairs(db) do table.insert(x,u) end return x end,
    setuser=function(name,pwd) setuser(ju,db,name,pwd) return enc(db) end,
    setdb=function(encdb) local d,err,ok=dec(encdb) if d then ok,err=ju:set(d) if ok then db=d return ok end end return nil,err end,
    getauth=function() return ju end
    }
    end
    ba.tpm=t
    end
    
    local klist={}
    return function(x)
    if true == x then
    local hf=ba.crypto.hash(maxHash)
    for _,k in ipairs(klist) do hf(k) end
    tpm(ba.crypto.hash(maxHash)(klist[1])(true),hf(true))
    klist=nil
    return
    end
    table.insert(klist,x)
    end

They have access to the patches.

They just can't make an official release with it, because they can't publish the patch sources (embargoed) and their releases being open-source must match what they published...

bwrap.

I don't run AI, but anything I don't fully trust 200% runs without access to my home, and if it doesn't really need internet without internet either. bwrap commands can be a mouthful so I suggest making a script for things you commonly do, e.g. "run with this directory as $HOME" or "run with empty home, keeping just this directory as is", with a couple of flags to enable networking or wayland/sound... Once you have this there really is no benefit to not sandboxing. It's probably not as good as running in a full VM, but it's good enough for me.