Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)E

entwine

@ entwine @programming.dev

Posts
1
Comments
375
Joined
11 mo. ago

  • WhatsApp Clone... But Decentralized and P2P Encrypted Without Install or Signup

    Jump

  • javascript over the internet can be be intercepted by a network admin or ISP.

    Let me introduce you to my good friend HTTPS, and PKI more broadly.

    we step away from “iOS and Android” and enable users to run this on their platform-of-choice. generally, all “modern” operating systems support browsers out-the-box. users should be responsible with how they run this app: e.g. if you trust firefox more than chrome.

    So is it about convenience, or security? You expect users to audit their multi-million LOC open source web browser and supply chain before using your app?

    Browsers are notoriously not secure. Javascript is heavily sandboxed and access to operating system resources is heavily restricted, so attacks through there are relatively rare. However, attacks from the OS side are almost trivial execute. There's nothing the browser can do to protect its data if the OS falls into the hands of an attacker (eg malware or device confiscation)

    im using the metered.ca turn servers because they have a free plan (more than enough when i limit it to only brokering p2p connections). you have the option to use your own api key to do things like enable a “relay-mode”, which will proxy all messages. using the api key is simple UI abstraction for users to configure a TURN/STUN server. im open to make this as configurable as nessesary if users want to add multiple of their own servers.

    That doesn't solve the issue I brought up, which is that a state actor can trivially censor your app by attacking those servers. By contrast, blocking Delta chat would require them to block the entirety of Gmail, for example.

    "reliable” is a relative term.

    No. Your app is either reliable, or it isn't. A centralized service is vulnerable to being taken down, but that has nothing to do with reliability. The majority of internet traffic goes to centralized sites with 99.99%+ uptime.

    IMO, a chat app that struggles to send or receive messages is a toy. It's like trying to use the Pine Phone as a daily driver if you're someone who actually needs to male phone calls every day. Except, pinephone's reliability issues are implementation details that theoretically could be fixed, whereas your app's are architectural that would require a redesign. That's partly why I brought up meshtastic, because it's at least a fun toy.

    my app is speciafically based on webrtc, which has unparalelled transfer speeds; which is especially useful when sending large files.

    Comments like this, and your apparent misunderstanding of basic HTTPS make me think you're just vibe coding all of this. WebRTC doesn't have "unparalleled" transfer speeds. That sounds like something ChatGPT would say. WebRTC is a just protocol designed to provide a simple way to do streaming in the browser, without requiring apps to build their own custom protocols on top of eg websockets. Using it for text messages is kind of absurd, because such an application doesn't fit the low latency/high bandwidth the protocol was designed for.

    There's nothing wrong with vibe coding btw, you do you, but people need to stay fae away when security is involved.

    For anyone reading this thread looking for a secure chat app, just use Delta Chat, or even Signal (which has some issues, but it's better than nothing). If you're feeling adventurous, look into meshtastic.

  • X.Org Server May Create A New Selective Git Branch With Hopes Of A New Release This Year

    Jump

  • when now-XLibre developer Enrico Weigelt was making a lot of changes to the codebase that then ended up with a lot of that code being later reverted.

    Looked this guy up, and apparently he's a right wing anti-vax nutjob who got yelled at by Linus Torvalds for spreading misinformation on the kernel mailing list.

    Why do we have people like this?

  • WhatsApp Clone... But Decentralized and P2P Encrypted Without Install or Signup

    Jump

  • Javascript over the internet is not secure - im investigating the to use service workers to cache the file.

    Can you explain what you mean by this? What is not secure here?

    How is this different to any other messaging app? - the key distinction between this project and other like it like signal and simpleX is that its presented as a PWA.

    I don't see how this offers any security advantages? A PWA isn't any easier to uninstall than a native app if you're worried about someone catching you with the app installed. On the contrary, native apps can be hidden behind a custom pin on modern Android (and probably iOS), and PWA security is entirely at the mercy of whatever browser you installed it in.

    P2P - so that it can be decentralized and not rely on a central server for exchanging messages. The project is using WebRTC to establish a p2p connection between browsers.

    Most WebRTC connections still require a TURN/STUN server, meaning the infrastructure is effectively (and unavoidably for most people) centralized. That makes it less reliable and more vulnerable to being blocked than something like Delta Chat, which relies on the existing public email infrastructure. A state censor can't block Delta without blocking all email traffic (or the whole internet, like Iran and Cuba do lol), but they can block your TURN/STUN servers pretty easily.

    Beyond that, P2P is inherently less reliable by its nature. IMO, this is only an acceptable tradeoff if you're going all in on mesh networking solutions (eg meshtastic), which I assume you're not. There are already secure messaging apps in that space, and it's not something the average joe will be able tp use.

    Since they're both E2EE, there is no risk using the more centralized Delta over your P2P version. You just get to deal with the annoyances of P2P with no added benefits.

  • ‘It’s such poor quality software’: GOG owner criticises Windows, says it will support Linux better in the future | VGC

    Jump

  • Yup. It seems CDPR were the Linux haters all along.

  • How do you vet open source software if you don't know code well?

    Jump

  • You can't, obviously. I know how to read code, but I still rarely do it since it's very time consuming. Usually, if I'm nervous about something, I'll first look at the author and see if they're well-known, or at least tied to a real identity. In the rare cases that I have reviewed a code base (I'm not a security expert or anything) to check for malware, the things I looked for were:

    • obvious red flags, like urls to fishy sites, or calls to filesystem APIs where it doesn't make sense, paths that it shouldn't be trying access, etc
    • anything that looks obfuscated, poorly written, or delibrately designed to be difficult to read

    But if it's anything related to Node/NPM, I always use a throwaway rootless podman container without filesystem access. Even if the author is trustworthy, their dependency graph is likely a bag of used needles that they picked up on the side of the road.

  • hell no!

    Jump

  • Question about resurrecting a discontinued distro

    Jump

  • A "distro" is basically just:

    • a precompiled kernel
    • some preinstalled software

    Idk anything about Poseidon but,

    is it easy enough to replicate just by downloading the relevant packages?

    The answer to that is yes. Just pick a base you like (eg debian, fedora, ubuntu, ...) and install the software you need. You could automate it with some simple scripts, or be fancy and write a Butane config to preconfigure a base Fedora CoreOS image. IIRC, the Omarchy distro is just the former, not even a proper "distro".

    If you want to create your own "proper" distro that other people will want to use, there's a lot more that goes into it: updates, builds, tests, deployment, patch sets (because you'll inevitably need to patch various components for compatibility), bug reports, some kind of governance structure...

    It's a whole software development thing. If you just need a customized platform for your buddies/workplace, customizing an existing distro is the only reasonable choice. I'd suggest looking into bootc and ublue if you need more than a simple post-install shell script.

  • Windows 7

    Jump

  • People can always make more children, but shareholder value? That comes once in a lifetime.

  • Fedora 44 Will Be the First Distro to Adopt KDE's Plasma Login Manager

    Jump

  • If you were on an atomic spin (eg kinoite) the process is:

    1. Enable automatic updates
    2. Upvote posts from non-atomics asking for help out of pity

  • Set the challenge to create my own 3d engine from scratch. Where to start?

    Jump

  • https://scratchapixel.com/ for valuable background

    After that, I recommend you learn webGL and write your first project in javascript. It's not as cool as a native executable in C++, but you will gain a lot of crucial 3D graphics knowledge without getting sidetracked by typical native development woes (which should not be underestimated)

    Once you feel you have a good grasp on the 3D math, working with a graphics API, writing shaders, and the general architecture of a 3D application, THEN you should start looking into native development. Maybe start learning Vulkan as a next step, although that's a tough one if you don't already have C or C++ experience (mostly because of memory management concepts). Instead of Vulkan, you could instead go with OpenGL or a high level library like Sokol.

    It should go without saying that this isn't an easy topic. It's a deep, deep (but rewarding) rabbit hole. There's a lot of stuff to learn, and it will take a while. A sense of overwhelming dread, hopelessness, and inadequacy is part of the process.

  • Removed

    Are there ANY debuggers for Linux, that has a GUI

    Jump

  • There's nothing wrong with wanting a GUI front end, but the ignorance on display here is embarassing.

    No, I don’t want to spend weeks to learn GDB inside-out, so I don’t have to search online for 15-30 minutes on an AI infested internet every time I want to use it, for each feature I’m using it for that day.

    Weeks? Just type 'help' and you'll get the instructions in under a millisecond. No AI slop. There aren't even that many commands to learn lmao.

    Pro tip: type 'apropos

    <query>

    ' to search for appropriate help pages when you don't remember the command.

    Do better.

  • Killswitch Engineer

    Jump

  • When misleading slop like this gets around, and peoplw get the impression that ChatGPT is alive or sentient somehow, it lets them continue their grift.

  • The billion dollar race to replace Windows

    Jump

  • Linux isn’t a replacement for Windows. It’s its own thing, with its own issues but also advantages.

    Linux isn't a replacement because Linux isn't an operating system. The "battle" isn't between Linux and Windows, it's between Windows and specific distros, like Ubuntu or Fedora. Mainstream Linux will require one of those to up their game when it comes to hardware partnerships and customer/end user support. Doing so will require competing against Microsoft along those same business areas, not just from an engineering perspective.

    Unfortunately, I don't think that will be easy. Microsoft is incompetent at a lot of things (incl business most of the time), but they have unlimited money and leverage, and their relationship with the US govt means they're unlikely to see any antitrust scrutiny when they do illegal shit to suppress competitors.

  • We Mass-Deployed 15-Year-Old Screen Sharing Technology and It's Actually Better

    Jump

  • But move fast and break things doesn’t seem to accommodate that kind of approach.

    I think it's more of a "chatgpt, design my product for me" type situation.

  • We Mass-Deployed 15-Year-Old Screen Sharing Technology and It's Actually Better

    Jump

  • The fact they chose moonlight as their streaming protocol is proof they vibe coded the entire idea lmao. Moonlight/Sunshine are reverse engineered implementations of Nvidia's proprietary GameStream product, designed for low latency streaming of game video/input on a typical home network. No competent engineer would choose that for this kind of application.

  • Help needed!

    Jump

  • This is unnecessarily complicated, and I don't see how your second version is supposed to be more optimal? You're just adding pointless indirection by encoding the branching logic as an int, and then branching again in a switch statement.

  • Help needed!

    Jump

  • This would be easier to understand if you defined a function like:

     c
        
char IsMonth(int value){
    return value > 0 && value <= 12;
}

    Then try to rewrite your program using that inside of the if statements. For example

     c
        
if(IsMonth(p1)){
    ...
}

    If you do that, I'm pretty sure you'll find the problem. As a hint, notice that IsMonth is a boolean value, since a number can only either be a month (true) or not a month (false). I haven't debugged it, but I can tell there's a problem just by the number of printf statements you currently have.

  • Lutra: General-Purpose Query Language

    Jump 
  •  
        
func get_album_by_id(album_id: int16): Album -> (
  get_albums()
  | find(func (this) -> this.id == album_id)
)

    I'll admit I'm not a database guy, but isn't this inefficient? It looks like it's first querying the DB for all albums, then filtering the results in the interpreter. I assume the db engine has a more optimal implementation for when you do SELECT WHERE query, designed for whatever data structures it's using internally.

    Also, minor nitpick but why does it have so many different ways to define a function body?

     
        
func something() -> { ... }
func something() -> ( ... )
func something() -> ...

  • Firefox Will Ship with an "AI Kill Switch" to Completely Disable all AI Features - 9to5Linux

    Jump

  • can you give an example of a website that doesn't work in FF? I've been an exclusive FF user for many years (maybe at least 8), and I can't remember ever encountering a compatibility issue. The worst is when a website lies about needing chrome, but if you change the useragent it works perfectly.

    Recently I switched to LibreWolf for better privacy, and that one has a lot of features disabled to combat fingerprinting. This does break a lot of sites, but ut's easy to disable that in settings.