grepular

You use an insecure library in your product, it is your responsibility to deal with that situation yes. You can deal with it by:

1. Fixing the insecure library

2. Getting somebody else to fix the insecure library

3. Switching to a different library that isn't insecure

4. Patching over the problem in your application so that the insecure parts are no longer insecure (Santising and stripping html before passing to Webkit, as many, many other email clients do)

5. Warning the users about the problem (A "do not rely on for privacy" notice next to the feature in the UI, with a link to more info)

Evolution Mail wont do any of this. They don't accept any responsbility for the problem. They submitted a bug report to the library and then sat on their hands. If this is still a problem a year from now, they will still accept no responsbility and still claim there is nothing they can do about it, and their users will still be suffering from the problem with absolutely no knowledge about it.

I find it astonishing that anybody thinks their approach to this is acceptable, or even normal in the software industry. It's totally bizarre.

It's actually pretty ok for casual browsing these days. Have you tried it recently?

Those that aren't willing to pay for it directly, can still use it for free, but will just have to tolerate product placement.

Yes

Was a local error. Fixed now

Sorry about that. Try again now

And use https://www.emailprivacytester.com to test that your email client is configured correctly

Came up in a thread on a different submission, so thought I'd submit it even though it's a bit old, as it's still relevant today - https://news.ycombinator.com/item?id=44211612

You say "only with the restic backend" but you can do it with a simple Nginx backend too https://www.grepular.com/Nginx_Restic_Backend - The restic server part is redundant

Hmm. I assumed this worked like torsocks in that it would direct traffic through the locally running tor daemon. However, I've noticed that if I stop the locally running tor daemon, oniux still works whilst torify and torsocks do not. [edit] The documentation does actually say this. Pretty neat.

It works inside docker as well, but I needed to use --privileged. Just copied the binary into a debian:12 container and it works there:

  docker run -it --rm --privileged -v "$PWD/oniux:/usr/bin/oniux" debian:12

Instructions on front page for install don't work. Need to change the version number from 0.4.0 to 0.5.0

  cargo install --git https://gitlab.torproject.org/tpo/core/oniux oniux@0.5.0

And what commands do I run if I want to do 100 screenshots per second?

Precisely. Seems fairly likely the tariffs will be gone 5 years from now one way or another. Who in their right mind would build a business based on those tariffs still existing into the future.

Just rot13 any request data using javascript before posting, and rot13 it again on the server side. Problem solved. (jk)

> 2.5B * $.1/1000 = $250K/yr

Lets Encrypt doesn't send an email for every certificate that expires.

> especially if you let it expire

All certificates expire.

> No one in this thread used the word "stealing" before you

It's right there in the comment he was responding to

I could see how somebody might think that, if they ignore the content of what was said and only look at the presentation.

I couldn't even watch the whole video. Horrendous. Depressing. How can you tolerate having those men running your country America. Nightmare fuel.

I have some smart plugs which I can use to turn things on/off from Home Assistant, but more usefully, they report current power draw. I use this with Home Assistant to:

- Turn on my electric blanket from my watch 10 minutes before I go to bed

- Make my echo dot announce when one of the following finishes:

  - A washing machine load
  - A tumble drier load
  - A dishwasher load
  - A 3D print

Some other things I use Home Assistant for:

- Force charge my home battery during cheap electric periods

- Turn off the heat pump if the grid goes down, so I can decide myself if I want to use my remaining battery power on heating

- Announce if my printer is low on toner via a message to my watch

- Program a more efficient routine for my water heating than the native solution that came with my heat pump allows.

[edit] I just added another automation I've been meaning to: If the time is after 22:00 and I am home, and the outdoor temp is < 6C and I switch the TV from on to off, then turn on the electric blanket and send a notification to my watch to inform me it has been done. Done this because I sometimes forget to do it manually and turning off the TV at that time is a good indicator that I'm heading to bed shortly.

As the other guy said, that's why I mentioned using an ID. And as the other guy said, the same as required regardless of what channel you're using.

That race condition has nothing to do with long polling, it's just poor design. The sender should stick the message in a queue and the client reads from that queue. Perhaps with the client specifying the last id it saw.

Hmm. Maybe the dev that set it up made the first recipe run `just --list`

I don't have my work laptop to hand to compare, but I usually run "just" to get a list of commands and what they do, rather than "just --list". Hope that saves you 7 key presses going forwards.

UPS

It says my domain "grepular.com" doesn't have dnssec. It does. It also says I don't use DKIM or DMARC. I do.

Good catch. Thanks

There seems to be some weird encoding issues and failure to convert URLs to links properly, for my profile - https://mike-cardwell.at.hn/ - Also, some of the indenting and white space is broken making the PGP signature invalid

Their product wasn't that great anyway - https://www.grepular.com/Skiff_Emails_Various_Privacy_Failur...

Your fix is wrong. It states the SPF record is invalid. It is not.

https://datatracker.ietf.org/doc/html/rfc7208

> Unrecognized modifiers MUST be ignored no matter where, or how often, they appear in a record. This allows implementations conforming to this document to gracefully handle records with modifiers that are defined in other specifications.

A correct SPF validator will ignore the xss modifier, not treat the SPF record as invalid.

Basic XSS - https://mailready.info/authentication?domain=grepular.com