grepular

I have my own custom perl script which basically does the same which I've been using for probably a similar amount of time. Never used a dedicated RSS reader. My feeds just get turned into email and dropped into the appropriate folder thanks to my sieve filters. Can read/delete things from any of my email clients. Absolutely no need for a dedicated RSS reader.

I view the webpage source and search for the strings "rss", "atom" and "feed" until I find one. I currently have 145 feeds. I follow blogs, news, I get updates about local events, I follow youtube channels, I get notified about new releases from various github repos, follow updates on various status pages, follow various subreddits etc.

I could go smaller using the light package, but I wanted a full featured Exim in the container. And I'm using the testing image so it keeps up with the latest version of Exim.

I find part of the fun of dockerising small apps is in trying to get the image as small as possible with as few files in it as I can. This one looks like it still contains a lot of stuff that's not needed.

For example, my exim image https://hub.docker.com/r/grepular/exim4 is built like this: https://gitlab.com/grepular/docker-exim4/-/blob/main/Dockerf... - The final image only contains the necessary executables, shared lib files, CA certs, timezone files, a few other bits and nothing else.

I recently doubled the thickness of my iPhone SE by adding an external battery. Fits in my jeans pocket fine along with several other things in the same pocket. If they can get it that thin, why don't they just add more battery and take us back to the time when we could run phones for weeks between charges.

[edit] I'll answer my own question. Nobody is going to replace an iPhone because it drops from 21 days battery to 14 days battery, but they probably will replace an iPhone that drops from 21 hours battery to 14 hours.

I made this about 6 years ago. It's a python script that acts as a wrapper to the npm command. When you run something like "npm install" or "npm start" or whatever, it actually runs the command inside a docker or podman container.

Minimum stuff that is needed is mounted into the container depending on the mount command being run, with stuff being mounted read-only when possible.

So you basically don't need to worry about your ~/.ssh or ~/.bitcoin folders being stolen by a malicious npm package anymore. And don't need to worry about one installing some persistent command or keylogger in the background.

Thought it was relevant given recent news

> LISAs are a trap if you want to buy in the South. You can only use it if the value of the property is £450k or less

In London it limits you. Outside of London, including most of the South, where the vast majority of British people live, most first houses cost less than £450k.

The limit should have been raised though yes. Or perhaps it should be set by region, I don't know. Hopefully it will be updated at some point.

Sorry yes. Brain fart. I meant median

I live in the East Midlands in the UK. You can grab a reasonable first house here for less than £150k quite easily. So you'll need a 5% deposit, £7,500 for one of those. One person on an average salary for the area would be able to afford a mortgage for a house like this on their own. But Nick has a girlfriend, who can hopefully work, so should be able to afford it easily.

But half of people earn less than the mean salar though. So what about those on minimum wage? Well, one person with a full time minimum wage job should be able to get a mortgage for close to £100k, so wouldn't be able to afford a £150k house on their own. They could scrape by and get a house close to £100k though. There are plenty of these. Again, two people on minimum wage should have no problem.

I recognise that people have all sorts of different circumstances, so this is not meant to minimise the difficulty of affording property, but I'm just not recognising this claim from the outset that you need a £100k deposit or high paid job to get on the property ladder. It's hard, but it's doable for most.

And on top of this, Lifetime ISAS are a thing, so you only need to save up 80% of your deposit, the govt will pay the rest. And shared ownership is a thing, making it even easier.

> We don't see the debugger output and go "how do I make this bad output go away?!?"

In the past, I've worked with developers that do. You ask them to investigate and deal with an error message, and all they do is whatever makes the error go away. Oh, a null pointer exception is thrown? Lets wrap it in a try/catch and move on.

> Tesla Model S in Autopilot mode allegedly came to a T-intersection and, failing to see that the roadway was ending, kept his foot on the accelerator

Autopilot requires you to have your foot on the accelerator? That seems weird to me.

I use a combination of mosh and screen for this. I only need to type something to get my session back, after a reboot. Changing networks or putting my laptop to sleep for days doesn't drop my sessions: https://www.grepular.com/Immortal_SSH_Sessions

Different than me? When I used to cycle, I skipped through traffic lights, when it seemed safe to, and I've seen many other cyclists do the same. It's not a bias, it's an observation. But I mainly said it as a joke, because it's a well known stereotype, for good reason. At least where I am.

I do this for my washing machine, drier, dishwasher and also 3D printer, in the UK. Have some Z-Wave Greenwave PowerNodes, hooked into Home Assistant. Works great. I also have Alexa hooked into Home Assistant so I was able to make it announce through our Echo Dot when a cycle for any of those devices completes.

Since when did cyclists take notice of traffic lights?

Nah. 5 billion years from now we'll have the technology to move the Earth to a survivable orbit.

I don't think this was done on purpose. If the query string is "?a=b" that's fine, and it's used in the cache filename. But if the query string is "?a" then it's excluded from the cache filename.

Either way, the correct full URL is fetched with the full query string. It's just how it's cached that is affected.

An intern can suffer negative consequences for fucking your DB. An LLM suffers nothing and is beyond the law.

I don't care if it's free or paid. If it has privacy flaws, they should be fixed, or people should be informed of them. Evolution Mail isn't interested in doing either of those things. So I'll do it for them. If you think that informing people is, "drumming up a mob", then you are wrong.

You forgot to say anything about the fact that they've been sitting on a privacy bug for 15 months and have done nothing to address it. You forgot to say anything about the multiple things that the bug report says they can do, to warn their users and patch over the problem on their side. You forgot to say anything about how those suggestions were met with arrogant clown and face-palm emojis.

You prefer to concentrate on the fact that I miss-directed my first bug report. You prefer to point at the fact that I requested submission to a bug bounty program, whilst ignoring the fact that I made effort to discover the issue and report it, without expecting a bounty.

It takes time and money to run https://www.emailprivacytester.com. I wont apologise for receiving the occasional bounty for doing it. Many email and webmail clients are more secure today than they would have been, thanks to my efforts.

Your comment exists only to generate drama.

They really haven't done number 1. A bug report was submitted, and then it has stalled for 15 months.

As of this point in time, nobody has explained to me why it would be a bad idea to add a "Do not rely on for privacy. More info" message next to the feature in Evolution Mail.

That is 100% true. Users of Evolution Mail should not rely on that feature for privacy. Because Evolution Mail has chosen to add known flawed software to their application.

And despite lacking the will or ability to fix that software, they are unwilling to take a different path to patch over the problem until it is fixed in the library, by sanitising the html and stripping problematic tags/attributes.

These are all their choices. And all of their choices lead to end users being exposed to a privacy risk, and unaware of it.

Yes. I will do that. Good idea.

I noticed that during my testing. Was difficult to keep it running for more than a few seconds at times. Thunderbird is a good choice.

The list is brand new. I will be updating it as I have time to test clients.

If only the developers of Evolution Mail made any effort to get the issue fixed in the 15 months they've known about it.

It's unacceptable to sit on a privacy affecting bug like this for 15 months.

This continously repeated bullshit that the source of the problem lies elsehwere is tiring. They're knowingly using a library with a security bug, and they're doing:

1. Nothing to get the devs of that library to fix it

2. Nothing to fix the library themselves

3. Nothing to warn their users

4. Nothing in their local application to protect their users.

This is not how secure development works.

Andre Klapper went and closed both issues. Presumably he's worried how bad they will look if the devs for either client went and actually addressed this issue instead of passing the buck and doing nothing like Evolution Mail have.

My blog posts denounced the projects approach to handling security/privacy issues in the software they distribute. They also recommended people stop using the software because it is insecure, and this issue is not being taken seriously by them. My blog posts are 100% factually correct, and I stand by the recommendations.

The fact that some devs took this personally is not my concern.

> it very probably affects Balsa and Geary at least

I've just tested, and both fail the link preconnect test but neither fail the dns prefetch test.

So the original bug I posted is on the Evolution Mail side, not the Webkit side. If you go back and look at the thread, you'll see they never actually investigated the issue. They just insisted it wasn't their problem. They were wrong.

They locked the bug of course, because their feelings are more important than distributing secure software to them, so I have no way of informing them of this. They're just pissed they can't lock my blog and that people are finding out about this issue, outside of their control.

So, at work, you find out a library you're using is insecure. Do you:

1. Submit a bug report to the library and then do nothing else, for over a year, with no end in sight, and say it's not your problem, you can't fix it, and there's nothing you can do, and you wont tell your users.

2. Address the problem by fixing the library yourself, or getting somebody else to actually fix it, switch to a different library, patch over the problem on your applications side?

If number 1 is your answer, you probably shouldn't be distributing software.

I'll let Balsa and Geary know about the preconnect problem. Will be interesting to see if they take the same awful approach that Evolution Mail did to addressing it.

[edit]

- https://gitlab.gnome.org/GNOME/geary/-/issues/1680

- https://gitlab.gnome.org/GNOME/balsa/-/issues/99