Can you start to document the css in the source? So someone touches something, right above it is a comment: 'this class used for all card layouts on these type pages' or some such. Then there's a chance to spot the danger, in code review at least.
I agree with others here: visual testing should be last result as it is brittle, sweeping and numbing.
I'd like to see more on the reasons NOT to adopt jj. I have not used jj myself yet but digging around there seem to be some big blockers, depending on your repo/project:
You've made a great start. How much further you go depends on your needs and threat model.
Rsync is ok as a start but there are dedicated backup tools that will give you access to your files at any point in time. This is important if you delete a file and later need it back after an rsync has already run and deleted it remotely too.
Rsync will not encrypt your backups. If a burglar takes your Pi will they have easy access to all your files too?
With rsync+ssh you are also vulnerable to either yourself (more likely) or a rogue process on your own machine deleting the files over ssh (e.g. ransomware attack).
The answer to that is append-only backups. A backup tool like restic has a backend you can host that does exactly this:
The --append-only mode allows creation of new backups but prevents deletion and modification of existing backups. This can be useful when backing up systems that have a potential of being hacked.
The website cambridgeanalytica.org is published by Vortexlab Digital Marketing, a digital media and research-oriented publishing company headquartered in:
Dubai Silicon Oasis, DDP, Building A1Dubai, United Arab Emirates
So it seems like they're a separate thing, but it's confusing.
Wikipedia says:
(Cambidge Analytica) closed operations in 2018 due to backlash from the data scandal
In addition, if you attempt to visit a site that is a homograph of one already in your browser history the browser should show a warning, highlight the similarity and force you to confirm you want to proceed.
Enclosing characters in single quotes (‘'’) preserves the literal value of each character within the quotes. A single quote may not occur between single quotes, even when preceded by a backslash.
Not to say they are always the right choice though.
I think the desktops need to better protect users' secrets by accepting rogue user processes are part of the threat model now. There are lots of mechanism to lock known future user processes into a protected area (containers, chroot, etc), but none to lock existing and future unknown user processes out of a protected area.
Your idea of a yubikey access protected file area makes a lot of sense and I don't think it exists yet. Then a user could throw their existing ssh keys in there and immediately get physical protection on them.
It would need to be carefully controlled. Something like gocryptfs on FUSE as you suggest but with a stronger threat model layered on top as theirs is short: https://nuetzlich.net/gocryptfs/threat_model/
Thanks to these attacks I think creds got to all move to physical security keys so there's nothing to (digitally) steal any more.This tool is a good idea for the short term.
When Antennapod requests the episode the server can inject the ads and geolocate you based on your IP. Thus they can tailor them at the point of delivery to your region (and anything else they know/guess about your IP). Antennapod does not inject ads itself, it is at the mercy of what the podcast server returns.
I'm not familiar with Pikapods but Monica v4 has trouble with notifications. First you need to ensure it's been configured right to even send a test email, this can be triggered with a command if you have access:
php artisan monica:test-email
Various Monica environment variables must be set to configure this, it should be in the docs somewhere if not I can fish my config out for you.
Even once that's working you'll need Monica to run its regular jobs for sending notifications, there's config for that too. Finally the code has bugs and will often miss reminders in my experience. There are some open bugs still on this and I guess the devs have moved onto their rewritten version (chandler):
We’re also making it possible to add alt text for profile pictures and headers now, making your profile more accessible for blind and visually impaired users.
If you’ve been holding off updating Syncthing-Fork we have two pieces of news for you. First, the original dev continues to collaborate still, we know this was a pain point back then. Second, we’ve just added BasicSync, A simple app for running Syncthing, which just controls Syncthing’s running behaviour as hands off as possible, while the original service hums in the background.
So it seems since the handover things have settled but there is also a new fork which takes a more bare-bones approach.
has anyone made a read-only FUSE filesystem for a git repository where every commit is a folder and the folder contains all the files in that commit?
the idea is that you could just run cd COMMIT_ID and poke around instead of checking out the commit
and maybe the branches could be symbolic links to the commit folders?
And I did in fact do something very like that, back when I was playing with FUSE! But I never put it up anywhere cause it had an annoying build process, and didn’t seem to add much, and—
Well, in any case, Evans asked to see it, so here it is, cleaned up to be a plain old SwiftPM package. It should work on macOS and on Linux as long as you have FUSE (macFUSE or libfuse-dev), libgit2, pkg-config, and Swift installed; on Linux you’ll have to create the mount directory first. (If you run the command and it fails it’ll tell you what path it tried to use.)
% swift run mount-git /path/to/checkout
By the way, if you don’t know who Julia Evans is, they make blog posts and zines exploring all sorts of software in a way accessible to newbies and veterans alike, all with a lovely sense of discovery and enjoyment. This follow-up post to the original prompt really underscores their approach:
guys this is such a fun idea I cannot believe people are in the replies trying to explain to me why they think it is impractical
the whole point of computers is to do impractical things and see what happens
You should definitely follow them and/or subscribe to their newsfeed. :-)
Same experience as quoted - I used to use it. Once you have it 'trained' it's good to know the bad stuff is not getting through but it's a pain to maintain and for every new site you visit it takes experimentation to get the right setup.
You really want to share the pain of setup with other privacy people which is how ublock works with its lists I think.
...[the group] has claimed responsibility for similar DDoS attacks on the likes of eBay's Japan and US divisions, as well as BlueSky in just the past month alone.
Why the group is targeting London-based Canonical remains unclear and no reason was given via its Telegram channel. It is presumably because Ubuntu is one of the most popular Linux distros.
For example, the Anthropic-claimed 181 Firefox exploits ran with the browser sandbox turned off and the FreeBSD exploit transcript "shows substantial human guidance, not autonomy."
Additionally, the "'thousands of severe vulnerabilities' extrapolates from 198 manually reviewed reports. The Linux kernel bug was found by Opus 4.6, the public model, not Mythos," Devansh said.
Another researcher, Davi Ottenheimer, pointed out that the security section (Section 3, pages 47-53) of Anthropic's 244-page documentation "contains no count of zero-days at all. With no CVE list, no CVSS distribution, no severity bucket, no disclosure timeline, no vendor-confirmed-novel table, no false-positive rate."
Ottenheimer likens it to "the ending of the Wizard of Oz, a sorry disappointment about a model weaponizing two bugs that a different model found, in software the vendor had already patched, in a test environment with the browser sandbox and defense-in-depth mitigations stripped out."
Can you start to document the css in the source? So someone touches something, right above it is a comment: 'this class used for all card layouts on these type pages' or some such. Then there's a chance to spot the danger, in code review at least.
I agree with others here: visual testing should be last result as it is brittle, sweeping and numbing.