744 karma · joined September 1, 2011
https://www.youtube.com/watch?v=zFhYJRqz_xk and https://www.youtube.com/watch?v=uoJwt9l-XhQ
Also while not about cancer specifically, the book Immune by the kurzgesagt founder Philipp Dettmer has a chapter on it and the relation to the immune system. Which is very relevant for these new immunotherapies.
"Yellow"
I think the "temperature" (randomness) of a LLM makes it so you'd need to run a lot of these to know if it's actually getting it right or just being lucky and selecting the right color randomly
I tried Tasmota first but struggled with trying to get the rules to handle my slightly complex logic. Which was that when a water level sensor triggered, run a pump 15 seconds, wait 5 mins, run 15 sec and repeat for x times. But with the catch that if the sensor triggered before the run was done, it should ignore that.
After reflashing esphome I got it done in a few minutes in C.
They have been focused on the end goal, even if it meant having to kill the original idea that drove the initial fame and success. The automated, solar powered platform [1]
I try to remember them when I'm getting too emotionally attached to an idea. They remain pragmatic, focused on reducing the plastic in the optimal way. Even when that means doing it manually, by driving around in "dirty" ships, instead of the nice clean automated solar powered platforms they initially pitched.
Same with expanding to the rivers. Where their initial (and still working) platform is a automated and solar powered one, but recently they are just putting up fences/barriers and then manually scoping up the trash with (again, "dirty") excavators.
I wish them all the luck.
for example, the developer of Clip (Riley Testut) had to add a pointless "map" function which uses the user's location in order to be allowed to run in the background
The first version I tried used the user’s location to remain active, but was rejected by Apple. Testut then updated Clip with a Map feature — so there’s a reason for the app to remain active in the background — to receive approval.
[1] https://www.theverge.com/24100979/altstore-europe-app-market...
Getting some Qs about Delta availability, hope this clarifies things!
• Delta is exclusive to AltStore in EU
• Because of Apple’s new dev terms, all downloads in EU cost us €0.50/yr in AltStore PAL and App Store…so couldn’t offer Delta in EU App Stores without making it paid
• App Store only supports one-time paid-upfront apps, so we’d have to pick a price that could support ~years of CTFs
• PAL’s €1.50 covers Delta’s CTF
• We’d make everything free everywhere if it wasn’t for the CTF
I'm not a memory expert, but as I recently read a book on the subject I think I have better than average understanding of it. If you can read Swedish or Finnish I do recommend it, the title is "Minnets Makt" by Julia Korkman (freely translated "The power of memory", official title is "Memory Dependent")[1].
The book taught me a lot about how memories work, how they are formed, recalled and modified during the years. And as memories are a core part of everyone's life, I think it would be good for more people to understand them better.
I did find a youtube video where the author, does a short lecture meant for law enforcement to teach them the basics of how memories work. As for them it is even more important to understand how meories, especially the recall of memories work when they interview people.
Disclaimer, I haven't watched it yet, only skimmed it but it does seem to cover the same concepts as in the book.
I recommend spending 27 minutes watching it for anyone who's curious about how the memory work. https://www.youtube.com/watch?v=qSyEs6feH0M&t=442s
I don't care so much for the transit, but I'm a bit worried about the fact that I have many years of emails stored in "plaintext" (citation makes because they probably use FDE and maybe other encryptions but they can still read everything) on the providers server.
I'm not worried about a malicious provider, but worries they might at some point make a mistake which allows them to be hacked.
If anyone knows any solutions for this that works in iOS/Mac I'd love to hear.
The only thing I've found on this is some research a few years ago with ideas how to do this; but I haven't seen any implementations of it. I've linked to it here: https://www.cs.columbia.edu/~koh/papers/koh-eurosys19-e3_eas...
Still the fact that you can use it without disclosing your phone number to anyone except signal is indeed useful and a improvement from before.
https://support.signal.org/hc/en-us/articles/6712070553754-P...
> The first version I tried used the user’s location to remain active, but was rejected by Apple. Testut then updated Clip with a Map feature — so there’s a reason for the app to remain active in the background — to receive approval.
Yes, I'll admit that I prefer some limitations on background processes in order to preserve my battery. But apple is not doing that, instead they allow it but only after the app adds some pretend functionality which makes the user experience worse for everyone.
And let's think about how many pointless background processes they themselves have added over the years, it seems that every patch level there is a bunch more.
It's like if you open YouTube in incognito. It will show you whatever clickbait is most likely to catch an "average" YouTube-user from your country. It's wildly different from what you are seeing signed-in.
Do happen to know if the other services also create unique SSL certs for each service?
Also on some pages disabling JavaScript makes the experience better (although nowadays most pages just break), but if you don't have a way to easily disable it per-website you could check out my pet project https://noscript.it
Combined it with STM's automatic url-rewrite and you can get automatic per-site noscript even on the iPhone.
This seems like a useful solution, but I guess it's hard to do as a policy as there is a fuzzy line between the game taking too much attention and not being interesting enough.
(No relation other than being a happy user)
But my tl.dr. as I understand it is that IAB provides a Transparency Consent Framework[2] to its users, which includes popup cookies.
They lost a case where they argued they don't have any responsibility ( to the degree that they didn't even have a Data Privacy Officer or had done a Data Privacy Impact Assessment) for providing the IAB compliance popups. These popups were used by others in order to do gain "consent" to do real time bidding ads (and probably other things), it might be that they also provided some level of RBT.
They lost and the court said they are jointly responsible and need to fix long list of things and pay 250k euro.
IAB then appealed and the appeals court deferred it to the ECJ, who has now said that yes they do have a join responsibility.
So as I understand it, this is sadly not the death-blow to valid or invalid consent popups. But at least it might improve the UX on them.
[1] https://web.archive.org/web/20240109014435/https://www.gegev... [2] https://iabeurope.eu/transparency-consent-framework/
Sure there is no such thing as "free unlimited" bandwidth but I much prefer unlimited with a fixed cost until they decide it's not worth it and shut me down vs unlimited risk with no ability to cap it.
The lack of cap is the worst part and it's 100% a business decision. Every provider who tracks bandwidth could add a cap but they just choose not to because it's too profitable and the risk is mostly* on the customer anyways.
*there is of course a tiny chance they the customer goes bankrupt and they get almost notning, but usually they just need to pretend to be nice and forgive all or most of it
And yea, I agree that it's hard to know if the dog is just dumb, or independent and lacking any ambition to please us by learning "silly" games.
One thing one trainer I listened to said was that some dogs are actually more like cats.
That stuck with me, and I have kind of accepted that she will probably never be the kind of dog that follows my hints and commands blindly. The important thing is after all that she doesn't have any "dangerous" traits like aggression or being over protective.
My "solution" is just to update it infrequently, but that does not feel like a very sustainable solution either.
If they ever introduced a LTS version I would jump on that straight away. My home automation needs to do not change every month. And I'd be willing to pay money for that.
But it might be that it's a bit unrealistic for this ecosystem and the amount of contributions, so I'll just keep putting off updates until I know I have time to fix it if and when it breaks.
Yes. This is why relying on "patching" is a bound to fail at some point. Maybe it's a 0-day, or maybe the attackers are just quicker.
The solution to this is defence in depth, and it's very easy for most services, especially when self-hosting personal things. Few tips most people can do is.
Put up a firewall in front or put it behind VPN/tailscale.
Hide it in a subfolder. The automated attacks will go for /phpmyadmin/ , putting it in /mawer/phpmyadmin/ means 99.9% of the attackers won't find it. (This is sometimes called security by obscurity and people correctly say you should not rely on it, but as a additional layer it's very useful).
Sandbox the app, and isolate the server. If the attackers get in, make it hard or impossible for them to get anywhere else.
Keep logs, they allow you to check if and how you got attacked, if the attack succeeded and so on.
Depending on the service, pick one or more of these. Add more as necessary.
The key thing is that you should not rely on any ONE defence, be it keeping it patched or firewalled, because they will all fail at some point.
The one thing that computers are really good at is storing data (especially text) so I believe it should be a core function of any computer that it should never loose anything a user has input.
Sadly the reality is far from the truth. The number of times I have entered something into a webform or an app, only to have it disappear for some weird reason...
I've had iTerm session logging enabled on my personal machine for a while and have found it very useful every now and then when I need to remember what or how I did something a long time ago?
But there is a decently large risk that the output will contain something sensitive I don't want stored, so I'm wondering if there is some project which does this but would allow me to write some rules on what to react, which servers I don't want the output stored from etc.
For now I just manually disable logging when I know I will do something sensitive or when I know it's going to generate a lot of noise I don't want to waste space on. I have a shortcut created so I can select "Toggle logging" with shift+cmd+o.
And then there is 2.0, and all the extensions [1]
And multiply that with the number of implementations.
If the goal is to make something that "always" works, you probably need a big team to keep up with the moving field of various bugs and reimplementations
[1] https://www.loc.gov/preservation/digital/formats/fdd/fdd0000...
Myself I have ended up with mostly using Soulver and TextMate. TM is not really the same thing but it has nice built in text manipulation for more advanced things like "diff selection with clipboard", regex and "sorta and remove duplicates". The thing it lacks is on the scratchpad/autosaving... So I just abuse the window restoration feature and never close or save any documents but have 50 textmate windows :-)
It's not really hidden as if you initiate a connection with ssh it will reveal itself, but if you try https it will reply as a webserver
It world by looking at the first few bytes and deciding what to do based on that
At one point I was running https/ssh/openvpn/custom-tcp all on one port..
Here is someone else explaining how to do it, I don't think I ever wrote it up
Older TLS protocols have vulnerabilities yes, but most of them require a very motivated attacker with the ability to do a MITM.
I wrote a blog post about why I have decided to support older protocols, https://blog.nyman.re/2021/02/07/usability-security.html , the tl.dr. is that only allowing new TLS just means more forced obsoletion. For Banks and other sensitive things, yes it makes sense, for your personal blog, not so much.
I mean... Google still allows TLS 1.0 , if it was a "huge security risk", do you think they would?
The updating OpenSSL/breaking symlinks sounds interesting, do you have more info?
Personally I have a old iPhone 5S running iOS6 which I use for listening to podcasts. I ran in the the TLS issue there and my solution was to use a proxy https://bitbucket.org/ValdikSS/oldssl-proxy
Works well, and until maybe a year ago or I could even browse Apple's Podcast Store, but at some point that stopped working so now I'm stuck with the ones I have there.
(Cydia still works though... Thanks Saurik)
I have a old clock radio in a box which I was thinking to turn into a internet/podcast radio at some point (so I could always get the news right when I'm supposed to wake up)
I was planning to retrofit a piTFT or something into it but it would be much cooler to reuse the existing LCD... although based on the amount of work required and history of me completing these "interesting" projects I have on the shelf... I will probably do neither and at some point just buy something suitable :-)
I'd recommend listening (or reading the transcripts) to anyone who's needs or wants to understand more about JWT and other tokens
(And if you're not, check out the other episodes still. That podcast is great, some of the episodes get really deep into the cryptography weeds but if I get trough them I still feel like I learned something :-) thanks for making it)