gnyman

Also disabling JS works.

And if that is a hassle my little hack to selectively view pages with js disabled works great here https://noscript.it/?p=0#https://www.economist.com/business/...

Yeah, this is one of the problems with for-profit.

Even if the company could make the bottom line with only a subscription fee. Someone is willing to pay a lot for visibility, and they pay more the less other ads there is. So the paper/service/blog accepts one well paying ad. And nobody minds because it was just one ad.

But look at that money, let's do another ad, just once. But this isn't the first and only so they pay a little less. So maybe we could put in two ads, I mean they are relevant and nobody cares. And suddenly ads are a commodity but you already have a ad-selling department and people willing to pay a little...

I mean I don't think ads are exclusively bad, but it's just the nature of the system that they will get worse until they are bad.

I'll admit I did something similar for a game called Dark Age of Camelot as a teenager. Very educative, learned about both network sniffing, hubs vs switches and Linux. Was it worth it to give me an advantage in the game? No, I never played the game seriously enough to be able to use it, I think I used it for a week after spending two setting it up, but it was a great learning experience.

The k-anonymity is such a clever trick, I remember being impressed by the simplicity and efficacy of it back when I read about it also.

I'd also like to call out the one who Troy says suggested him [1], Junade Ali who goes into more details about this in his post about it [2]

Not because Junade would have invented it (apparently that was Pierangela Samarati, Latanya Sweeney and Tore Dalenius. [3]) but because his blog post on it is a really great explainer of it using concepts software developers are familiar with.

[1] https://www.troyhunt.com/ive-just-launched-pwned-passwords-v... [2] https://blog.cloudflare.com/validating-leaked-passwords-with... [3] https://en.wikipedia.org/wiki/K-anonymity

This is just my two cents but I pay for both GPT and Claude as I find they complement each other.

I found Claude with the bigger context window quite good for doing "reviews" of multiple scientific papers, and answering questions about things like common findings or differences.

GPT couldn't do that natively at all until recently (and the few third party api-based solutions I tried wasn't good at it either), and just copy pasting text into GPT very quickly made it loose track.

Maybe the new bigger context for GPT means I can cancel Claude, but I haven't yet, going to give 2.1 a proper try first.

I also tried Elicit, and I believe they are on the right track, but did not produce anything useful when I tried.

I really think there is potential in using LLM's to for example do high level "reviews" of what is published on a specific topic but I have yet to find something that can do that. Claude with feeding it select papers manually is the closest. I hope someone at Google is building something around scholar.google.

The amount of background crap has been steadily increasing on Apple devices, you're probably right in your observation that it's related to wireless/Bluetooth.

I have a iPad 2 (yes, the one from 2011) which I keep around with the plan to turn it into a house-automation screen and I'm always surprised when I look at it every 2-5 months to see it still has a decent chunk of battery left. And it's in sleep, not turned off.

I just checked it, it's at 76% with a standby time of 562h (23.4 days). And this is with WiFi turned on.

Im really impressed, it's after all a 12 year old battery. And the device was in daily use for the first 4 years and then less frequently.

This is a side topic but I find it's a good example of forced obsolescence, because there is nothing wrong with it other than the fact that it does not support modern web standards or modern iOS apps which makes it trash for most people.

Not specifically openBSD but the concept yes, I've played with it also

https://nyman.re/super-simple-ssh-tarpit/

Yeah, so much noise. I enjoy screwing around with them on my free time, "imposing cost" by giving back unexpected things. I don't know if it actually does something, but I bet returning either a gzip-bomb or a 5 MiB really obscure (but valid) HTML file will crash quite a few scanners.

https://nitter.net/gnyman/status/1181652421841436672

PSA if you use Alfred (w. Powerpack) you can get a always working version of this, but not bound to Cmd+V. It's a bit annoying to set up though

> If you go to the Workflows tab, click the [+] in the bottom left, under Templates > Clipboard > you'll find a "Paste as plain text from clipboard" workflow. Add your own hotkey, and you'll be able to do exactly what you need https://www.alfredforum.com/topic/10032-clipboard-hotkey-tha...

There is a multitude other tools recommended in this thread also. The one thing I would recommend for those who does not have any clipboard tool is don't just get something that does plaintext. Get something that does HISTORY and plaintext conversion.

Clipboard History/Search is among my top 10 productivity enhancements hacks that anyone can do and benefit from, might even be the nr 1.

Whoever championed it at Microsoft and managed to get it included by default in Windows 10 (Press Win+V) deserves a medal.

While intelligence plays a part, even smart people will ignore obvious red flags if they think they are winning.

Have you looked at Q4OS with the windows theme pack? https://q4os.org/ and https://xpq4.sourceforge.io/

It's does not seem well known but it looks and works very closely to old Windows.

I have a side project plan to take this, combine it with a decent laptop, pre install libreoffice and a browser and sell it as "Stable OS" with a long term "no-change" policy to anyone who just needs a basic computer where not everything changes at the whim of someone looking for a item on their resume.

I thought so at first but then I remembered server side request forgery, SSRF

That's a bug class that is quite common but rarely leads to code exec or other issues (except in some cloud environments). If this is something that gives code exec after pointing curl at a malicious server it's going to be bad.

Fiver on 2)

Matches the "few years back"

Luckily HTTP/3 is so complex I doubt anyone could find the issue even if they looked :-)

IPv6 won't get found by brute-force but there are a few projects which tries to gather IPv6 addresses using various means and scans them as they are found.

Shodan did (maybe still does) provided NTP servers to some ntp-pools and scanned anyone who sent incoming requests.

https://arstechnica.com/information-technology/2016/02/using...

So as with everything, layer the defences, don't rely on you IPv6 address being secret as the only defence.

Yes, you can hide with a little bit of effort. Port knocking or Tor will stop almost any thing (but don't rely on it as the sole protection, just as another layer).

I like to prefix anything "I don't want scraped" with a random prefix, like domain.com/kwo4sx_grafana/ and nobody will find it (as long as you don't link to it anywhere). But I still have auth enabled, but at least I don't have to worry about any automated attacks exploiting it before I have time to patch.

Something as simple as moving SSH on a non standard port reduces the amount of noise from most automated scanners 99% (made up number, but a lot).

You cannot hide anything on the internet anymore, the full IPv4 range is scanned regularly by multiple entities. If you open a port on a public IP it will get found.

If it's a obscure non-standard port it might take longer, but if it's on any of the standard ports it will get probed very quickly and included tools like shodan.io

The reason why I'm repeating this, is that not everyone knows this. People still (albeit less) put up elastic and mongodb instances with no authentication on public IP's.

The second thing which isn't well known is the Certificate Transparency logs. This is the reason why you can't (without a wildcard cert) hide any HTTPS service. When you ask Let's Encrypt (or any CA actually) to generate veryobscure.domain.tld they will send that to the Certificate Transparency logs. You can find every certificate which was minted for a domain on a tool like https://crt.sh

There are many tools like subdomain.center, https://hackertarget.com/find-dns-host-records/ comes to mind. The most impressive one I've seen, which found more much more than expected, is Detectify (which is a paid service, no affiliation), they seem to combine the passive data collection (like subdomain.center) with active brute to find even more subdomains.

But you can probably get 95% there by using CT and a brute-force tool like https://github.com/aboul3la/Sublist3r

Yes, and not only design, it's metrics-driven everything.

And often the metrics can be counter productive in the long term, but by then people have collected their bonuses, promotions or left the company.

Here is a example I encountered from few years back where Google Ads was loading slower then the search and ended up replacing the first result just when you were about to click it. https://twitter.com/gnyman/status/1257239940309622784

If it was intentional or not I don't know, but I recall that this persisted for many months before being fixed.

I think it's obvious (but maybe I'm wrong) that accidentally clicking on ads is not what google wants, long term. As that won't get any real results for the advertiser. Which in turn reduces their interest to spend. But short term I bet Google made a lot of buck on this.

Either way, maybe it's unavoidable in a capitalistic world, it's not like non-software companies were driven by a consumer happiness score before either. The reason it feels so bad is just that a lot of us have been here during the growth phase when end-user happiness is a more important metric.

And this has been the case since Windows NT in 1993 according to a presentation I saw from Sami Laiho where he strongly argues that you don't need and should be a admin account as default.

From microsoft's documentation [1] > Administrator-to-kernel is not a security boundary.

I recommend the talk https://www.youtube.com/watch?v=Y09nAxZFKzc

[1] https://www.microsoft.com/en-us/msrc/windows-security-servic...

Haha I sense a trend for these home grown static site generators :-)

Yours are much more advanced, but a few years back I made a minimal PHP static page generator and named it...

PHP keep It Stupid Simple, or in short P.I.S.S.

https://blog.nyman.re/2020/10/11/introducing-piss-a.html

Yeah, I look forward to getting sideloading and at the end of last year it seemed like apple was preparing to play nice, and there was rumours they would announce info at WWDC2023 and that it would be included in iOS17 (which would mean ahead of the required deadline).

But then the rumours stopped. Which made me come to the same conclusion as you.

And looking at previous examples of BigTech defying the spirit of directives, like how Google blatantly ignored the consent rules for GDPR for 3 years[1], I guess we will get proper working sideloading around 2027.

The only hope is that even if it’s hard and complicated, it will make things like AltStore work well enough that I can sideload a few things to fix the biggest annoyances in iOS.

[1] https://iapp.org/news/a/cnils-eprivacy-fines-reveal-potentia...

Second this, produced by BBC https://www.bbc.co.uk/programmes/w13xtvg9

Gave a lot of insight and background into North Korean hackers, how they operate, how they live and so on. I was familiar with their operations from before, like the SWIFT hack from being in the infosec field. But I still learned a lot.

...because I wasn't sure if this was just nostalgia or fake memories so I went down the rabbit hole of trying to refresh my memories about why I switched from AltaVista to Google

I had some memory of AltaVista being full of SEO (as I recall it was mostly a keyword search engine) spam.

And that was probably true, but I also came across this Quora page https://www.quora.com/Why-did-Altavista-search-engine-lose-g... and it reminded me about two other things stand out to me as true

1. AltaVista was slow and you needed to know your syntax to find things 2. AltaVista was cluttered. Google had very clean results.

I think on 1 google is still fast, but 2. not so much. Google's results are far from "clean", instead it feels like the main goal is showing you as much ads as possible and preferably getting you to accidentally click on one.

This in and the fact that Kagi results are as good or slightly better (and much more customisable) than Google is probably the main reason I'm so happy with Kagi.

After all, Kagi sources results from Google so it's no surprise the quality is similar https://help.kagi.com/kagi/search-details/search-sources.htm...

Yes, second that. Happy paying user for bit over a year now (and was in the beta before that).

It feels a bit like how it felt discovering Google back when AltaVista was still a thing.

Thanks for the links, interesting story about switcher.

And yes, hearty recommendation on the craptop.

I was discussing with a colleague a while back when he said he had to get one as he was unable to reproduce a problem on his M2 even with the 6x cpu throttling you can do in Chrome. On the old laptop he dug out of storage he managed to reproduce it instantly.

I need to check with him how easily he could fix it, one argument I have to why some optimisation is always good is that it's easier to fix things as you go along vs having to go back and try to make things better. I mean if there is one thing making it slow then it's easy, but I have a feeling it's often a mix of things and at that point you might not be able to replace the slow parts as everything else depends on them.

On a side note inspired by this blog post.

I'm wondering if humans are mostly incapable of producing great things without (artifical) restrictions.

In this case, marginalia is (ridiculously) efficient because Victor (the creator) is intentionally restricting what hardware it runs on and how much ram it has.

If he just caved in and added another 32GiB it would work for a while, but the inefficient design would persist and the problem would just show it's head later and then there would be more complexity around that design and it might not be as easy to fix then.

If the original thesis is correct, then I think it explains why most software is so bad (bloated, slow, buggy) nowadays. It's because very few individual pieces of software nowadays are hitting any limits (in isolation). So each individual piece is terribly inefficient but with the latest M2 Pro and GiB connection you can just keep ahead of the curve where it becomes a problem.

Anyways, turned into a rant; but the conclusion might be to limit yourself, and you (and e everyone else) will be better off long term.

That's not a "dark pattern", it's just the result of of making the browser a OS and giving websites free rein of anything inside.

There is an aptly named browser extension to help combat this called StopTheMadness [1] , I recommend it.

Let's try to save the term Dark Patterns for the things that that deserve it, where the goal is to steer the user to make a unfavourable choice at the benefit of someone else.

https://underpassapp.com/StopTheMadness/

This post made me think about a talk I just watched by Tristan Harris at the Nobel Prize Summit, so I'm sharing it with you here in the hopes that you'll find it as relevant and insightful.

https://www.youtube.com/watch?v=6lVBp2XjWsg

(I had written a tl.dw. but I decided to remove it as I didn't feel I managed to capture the essence of the talk.)

Yeah and then add to that the websites which are not apps but still break :-(

As for noscript.it, I'm not aware of any existing lists, I have a short hard coded list so far. If you start a list I'd happily use and contribute to it :-) On noscript.it I have an additional problem in that not all sites allow embedding into a iframe and some block the cloudflare proxy I use to get around that. I maintain another list for those pages, but it probably breaks for a lot of other pages also without any useful error message to the user.

Congrats on shipping. It's great to see more alternatives in this space, I built https://noscript.it a few years ago to allow me to selectively disable javascript in Safari. But I rarely use it, or any of the other alternatives (like Stopthescript and Brave) that is available because so much of the Web is just broken beyond repair without javascript and there is no incentive to try to reverse this trend.

I mean, most noscript users are invisible to analytics, so even if there was a lot of us, which there isn't, nobody would know :-)

And also the worst pages which abuse javascript the most, and where users would benefit the most from noscript have negative incentive to allow that as it a lot of the bad JS is ads.

Sorry for turning this into a rant about general things instead of your app. I have a lot of feelings about this :-)

One idea for your app though, what do you think about a shared broken-blocklist? It's something I considered a few times, as displaying a white page isn't great UX. And without great UX the critical mass of people without JS enabled will be hard to reach. So my idea was to have a blocklist shared between either all users of an app or all noscript solutions. I think the UX would improve if we could just show a informative error message instead of a blank or mostly broken page, and crowd sourcing a list of pages which won't work without JS might be the way to go?

At least over here in Finland you can get premium light which is just 6.99e per month, and does not include youtube music.

Which was the thing that finally made me upgrade, as I already have a preferred music streaming service, I refused the premium bundle out of principle for a long time.

As a principle, I think each product and service should stand by itself and bundling things up just makes the experience worse for the end user (Teams etc). But that's a bit different discussion.