Just your normal everyday casual software dev. Nothing to see here.

People can share differing opinions without immediately being on the reverse side. Avoid looking at things as black and white. You can like both waffles and pancakes, just like you can hate both waffles and pancakes.

been trying to lower my social presence on services as of late, may go inactive randomly as a result.

  • 0 Posts
  • 327 Comments
Joined 3 years ago
cake
Cake day: August 15th, 2023

help-circle
  • Honestly. I think if tracking is disabled it should do the following:

    • anything screen dimension related including available height/width -> blocked (realistically java-script should never need to disclose this information outside of an internal function anyway)
    • User Agent: generalized (this usually already is the case)
    • Cookie status: kept the same as needed for functionality.
    • addon/plugin info: blocked
    • buildID: blocked
    • hardware concurrently: generalized instead of a set number (low end being < 4 middle being < 12 high anything else)
    • any hardware characteristics(such as gyro, battery state, etc) -> request for permission by default

    Like there are many steps that can be done to help mitigate fingerprinting, its just getting vendors to actually do it.

    being said I had never known about the TLS fingerprinting option, I generally don’t see that shown on the fingerprint detector sites, that’s interesting.



  • No, I disagree.

    It is not one person’s doing. That is the deflection.

    I will not downplay the effect of this by saying they are the only one involved. Every maintainer so far that has locked or approved any changes that they did are equally at fault here. In fact, one of those linked articles even stated that the primary reason they locked it is because they didn’t like the amount of coverage it got. This is a failure on the community as a whole, not the individual.

    edit for clarification: By failure, I’m talking more on projects that are humoring it and actually going through with it without considering the potential side effects of just blanket applying that.

    Currently considering that a handful of these are locked or posted as we don’t know if we’re going to be doing this yet, I haven’t quite put them in that same sector yet, but it’s rapidly approaching it.








  • Yeah, I had never heard of it, I generally stray away from video based mediums, but I am a little surprised I didn’t come across articles for it, I can only assume that none of the creators I followed covered it.

    Although it was kind of funny to see the beginning of that second video, him still trying to do damage control, it looked for a second like he was going to agree that he had screwed up that install because he said it was 100% his fault and then he Backtracked and said that it wasn’t his fault and I’m like so close lol.



  • I have never seen that page before, but that’s hilarious. I somewhat hope that he did that as a demonstration of, hey, someone may do this because it’s hard for me to wrap my head around someone who uses a computer for a living, doing something like that.

    Being said, I think that prompt went above and beyond what was needed. At some point you just need to let the user touch the hot stove top… It stated what it was going to do, stated that it was going to be potentially dangerous and unlikely what the user wanted, and then reiterated that it was core essential packages needed for it to run… I don’t know what else they could do there. I would definitely be against adding further restrictions though. If he was willing to type that in, I don’t know what would stop him from doing that, to be honest, Maybe a…" I acknowledge this would break my system…" instead of it being yes-do as I say. But I don’t know.

    Being said hard agree there is zero reason that a package like steam should be able to uninstall your desktop., That was definitely a bug or a misconfiguration with the steam package. That was unexcusable. I just think they gave more than enough information of what that would do and he did it anyway.

    I firmly agree at some point the ends don’t justify the means and Android has definitely got to that point with unsigned packages prior to making this change., And I don’t think the ends justify the means to implement such a system. And I definitely think there is ulterior motives for implementing it.


  • I had thought about it when i was thinking of getting an EV prior. The answer is “yes”, technically, but I didn’t find it cost effective to do so. I don’t own the building, or pay power utility, its bundled in my rent, and whatever power solution I installed would need to run roughly 150-200 ft feet across a lawn and part of an active driveway to get to my designated parking area(I had considered over or under but that also adds cost). Said parking area has already been designated as non-negotiable as the closer parking is strictly for the landlord’s wife who has mobility issues(fully valid). On top of that I have been instructed to not put a constant load on the outdoor outlet, it according to them has high wear on it and they are worried about the risk of putting something constant on it because it used to run as an input for a generator that ran higher than what the line was actually rated for(old building, was before the requirement of a bypass switch, they used to just kill the main breaker before turning the generator on to prevent backfeed, more dangerous but it was how it was done) and almost burned it out, so any solution would be either rewiring the outdoor outlet line from the fusebox on, or installing a dedicated charger line for it and then running it across prior distance. (which I had at one point thought about)

    technically possible, but I don’t think it’s cost effective to do something like that, especially considering even if given permission, it’s for a property I don’t own and don’t know how long I would be living here.


  • Yea the argument stated works better for rooted environments than rootless environments or sideloading.

    In a non-root scenario, you would need to specify a few permissions to give a keylogger that amount of access. I think that a big issue is people not understanding that there is a difference between a rooted device or root installed app, and a sideloaded application.

    Just because you have a non-google device or a rooted device != you have a compromised device. Applications aren’t going to magically install running as root, every rom worth their salt keeps it a clear isolation between the layers, and some roms don’t even allow you to use the root environment after installing it.

    In your standard google phone install? A keylogger wouldn’t be able to be installed without enabling an accessibility permission. It’s not like you can just “oops I just sideloaded a keylogger haha silly me” like described. Both google installed and side loaded applications would require prompting a warning page that very clearly states it allows logging of the screen for the logging part of it to work.


  • Lets be real though, currently they already have to blow through 4 other warnings about installing unsigned APK and enabled the browser or file manager to be able to install applications. It’s almost certain if they are that far deep/commited, they are going to call the scammer back if the scammer left a number.

    Yes this might allow for a time delay where the scammers number could be disabled if reported by enough people, or someone else to be like “yo this is a scam” if they mentioned it but, I don’t think this is as secure as they are saying it will be. The target audience for this is very unlikely to be thwarted by a time delay. Plus, the scammer will make some excuse about how the warning is just a safety percaucion and doesn’t need to be followed as this is a normal usage of the toggle, and then have them call back after the delay is done.

    For clarification: the target audience doesn’t know about the scam, and all they care about is that someone is seemingly willing to assist with an issue or problem they have. Said person knows the solution and they just have to wait for the timer to be done to be able to do said solution. They have no reason of telling others about it (unless they were complaining about googles time delay) as they already got someone who is seemingly able to assist.

    Honestly, having to have the user type “I agree that I have verified the application i am trying to install is genuine and not a fraudulent app” or a listbox of checkmarks to toggle in order to enable it would be far more efficient for this case.

    Hell take the example image the article on the dev page has and make it into toggles instead and it would work far better than a timer does.



  • yea those charts can be deceiving at times though , charge finder said I had one within 35 minutes I looked at what it was, the station it said is the old town house, and that’s been disabled/damaged(the charger not the building) due to vandalism since mid covid and was never fixed. The other option shown is the high-school but it’s restricted to students and Staff only and is parking pass enforced. I could likely abuse it via visitor pass, but that’s still 40 minutes to get there, time spent charging and then 40 minutes back. They had a town vote to install a community one a few years back at a town meeting but, there wasn’t enough local support for it to get on the official vote.

    Being said, it must be nice having the luxury of charging it at home. I don’t have such luxury. If I could I would have jumped on an EV for my last car when I had to upgrade 5 or 6 years ago