I’ve definitely ran into the situation where I fucked something up half-way though installing a new distro, then had to wipe it to go back to an old distro so that I could access the internet and find out what I did wrong so that I could start from scratch.

I hate doing debugging on my phone, but man sometimes is it better than the alternative.

Original image credit: https://www.tumblr.com/robotatertot/156736308530/truth

Trump doesn’t appear to care much about the law.

I understand that this is frustrating but it is arguably the right option. If the correct owner can recover the account without TOTP then the TOTP isn’t really protecting the account.

Of course there are various ways to authenticate and it can make sense to have authentication to be (username + password + OTP) OR (email verification) but for a lot of people that email verification is a weaker link. It is more secure to only allow the former.

What I wish is that more sites would document their account recovery procedure. Often times they ask for a phone number for verification or notifications and that silently becomes a backdoor into the account. Even better would be if users can select what authentication combos are supported on a per-account basis (there are a few companies with “lockdown” settings that are a simplified version of this).

Of course it then becomes important to make it clear to the user “if you ever loose you X your account is forever lost”. It shouldn’t be surprise.

This advice feels like “Have you moved to the surface of the sun? Make sure to drink lots of water.” It’s not wrong, but also not particularly helpful. The only solution is to stop buying these things. Ideally take them back and get a refund if it isn’t too late.

Not just the first hit in general but this also sounds likely to be a bait-and-switch. They will roll with that free 1TiB as long as they can for marketing and market capture. They have a few profit streams (ads, whales on bigger plans) to help cover those marketing costs. But most likely they will not be profitable and eventually will reduce/remove the free plan and try to upgrade as many users as possible to the paid plan (reducing costs and increasing revenue in one go).

Generally speaking it will be fine. SSH will also refuse keys with open permissions so you would notice if it was wide-open to other users of the device.

But you know if you are running random code or AI harnesses as that user it can be at risk. Or if you copy around the key all over the place it is more likely to leak. But generally speaking you are secure by default, just don’t do something dumb with the key and you’ll have no problems.

It sounds pretty reasonable. As long as you keep SSH patched and keep the key safe it should be quite locked down. Do double-check that password login isn’t allowed (or that all users have a very strong password).

One non-security note is be careful with rsync backup. Generally rsync isn’t considered a backup as any mistakes made in the source will be propagated to the “backup” on next sync. Although there are ways to use rsync to take good backups (like copying to a new directory for each backup).

Why only streaming services? Why not target the volume of any ads within content that contains audio? While we are at it why not say that the add can’t be significantly more bright?

CSS != HTML

I don’t think there is any way to play audio from CSS.

But I mean it is open source, you could patch it to do whatever you want.

I built Chibichange to have a way to conveniently deliver changelogs to Dawarich users

Have you considered just posting a changelog to your blog? That would be much more convenient than every app I run pinging me in its own way by phoning home to its server.

It does say “I agree to pay the above total amount” so it is pretty clear.

Yes, on one hand every commit to nixpkgs needs review (to some degree) on the other hand there are far too many committers to nixpkgs.

There are also gaps such as the bots to auto-merge packages with maintainer approval, so a simple attack looks like this:

1. Submit a package with you as a maintainer.
2. Create a new GitHub account and send a malicious update to that package.
3. Use a bot to merge with maintainer approval.

So nixpkgs is better than the AUR, but it isn’t great and unlike Arch has no separate official repos.

https://xkcd.com/1200/ comes to mind.

Games have no sandboxing anyways. They can access most of the data on the systems on which they run. Whether the game, crack or a HV crack makes little difference.

Sure, running a hypervisor or kernel level does allow them a bit more access, mostly around persistence. But I don’t think it is a huge difference to most people.

So IMHO you are already putting a lot of trust in any pirated software or crack, hypervisor bypasses are really just a small matter of degree. If you don’t trust the crack don’t run it. Easy as that. Or if you want robust protection run games on dedicated hardware with no personal information or in a dedicated untrusted gaming VM.

Because every three letter acronym means more than one thing. There are only 17 576 TLA so they are going to be heavily duplicated.

You should almost always spell out acronyms on the first use.

My wife’s last name was Wang. She was planning on taking her husband’s last name her whole life. Joke’s on her.

It’s not really though. They just used the screen from the pregnancy test and replaced all of the other hardware.

As much as I hate it, I’m 90% sure that they did some analysis (probably 10 years ago now) and found that there are enough people that don’t properly configure their computer that IP location is actually a better indicator than the Accept-Language header.

…which of course perpetuates the problem.

The fact is that it depends and it is a bit confusing for people not familiar. But it isn’t hard to get used to.

+8Q, Paris isn’t specific enough. There are multiple +8Q inside Paris. It can also be a bit risky to make short codes like this especially with larger cities as different maps may put the city in different spots.

What does work is +8Q Eiffel Tower which is useful for something like “Meet me here by the Eiffel Tower” or “I’m right here” when you are texting someone you are meeting and you know you are close but can’t see each other.

So you end up with a few common options:

• +8Q Eiffel Tower We are pretty close together but need to get the exact spot.
• V75V+8Q Paris, France For exact spots around a known area.
• 8FW4V75V+8Q For fully qualified with no reference needed.

And a few less useful options:

• 8FW4V7+ This large part of a city.
• 8FW4+ This part of the country.
• 8F+ This area of the world.

If I was designing the system I don’t think I would have done this “trailing zeros assumed” approach. Because IMHO for day-to-day use V75V+ Would be more useful as a shortcut for ????V75V+ rather than the actual V75V????+ showing a rough location on a human scale (in this case the Eiffel Tower park is pretty clearly targeted) rather than an area larger than a city. But that is really the only complaint I have.

The problem is that only your heaviest users are going to pay to remove the ads, so it doesn’t make sense to price the subscription at any sort of average user. You need to slide the price point way up the distribution just to break even.