FFS:
"IT APPEARS LIKELY THAT ALL RECENT COMMERCIAL COLOR LASER PRINTERS PRINT SOME KIND OF FORENSIC TRACKING CODES, NOT NECESSARILY USING YELLOW DOTS. THIS IS TRUE WHETHER OR NOT THOSE CODES ARE VISIBLE TO THE EYE AND WHETHER OR NOT THE PRINTER MODELS ARE LISTED HERE. THIS ALSO INCLUDES THE PRINTERS THAT ARE LISTED HERE AS NOT PRODUCING YELLOW DOTS"
https://www.eff.org/pages/list-printers-which-do-or-do-not-display-tracking-dots
"I spent yesterday evening reading up on optimal selection of argon2id parameters for storing passwords in my web app that lets me catalogue what electronics parts I have in my storage bin" - statements dreamed up by the utterly deranged
years ago I took a more maximalist approach and it always led to project burnout and security yak shaving.
so you have my permission, as someone who has worked in security for over 10 years now, to use "it doesn't fucking matter lol" as a threat model for these kinds of side projects and work on useful functionality instead of spending twenty hours of your precious time building a login page and password reset workflow that will only ever see one user anyway.
one of the best way to avoid being duped by fake fiber arts patterns right now is by sussing out AI art pictures, being extra weary on etsy (etsy is hit hardest by this right now sadly...) and making sure to check the designers social media to see if they are a real person or not
to my knowledge ravelry hasnt been hit as hard as etsy but its a good idea to be mindful of this regardless so you dont get scammed
idk if people know it or not but the the AI generated craze has unfortunately hit the fiber arts community quite hard. crochet and knitting patterns made by AI are sadly spreading like a virus and tricking people into buying shitty patterns that are never going to work up like they are displayed. LLMs are completely incapable of making fiber arts patterns properly.
meta - void.rehab limiting sharkey instances
starting today (with withdrawal version 2023.12.3.withdrawal2
), void.rehab and all instances using it's withdrawal patchset will be disabling reactions from sharkey instances. what this means is that all reactions received from sharkey instances will be turned into plain likes. this is due to sharkey's development team prioritizing misskey-specific niceties over interoperability. as part of my promise of quality, i am introducing this restriction and urging those considering migrating to sharkey to reconsider their options. the following is an explanation of the issue and how it reflects on sharkey as a whole
first, some background. federated misskey reactions are sent in an odd way - as likes. more specifically, a field called _misskey_reaction
is added to any like activities that are reactions. on base misskey, there are no likes, so this makes sense. on mastodon, there are no reactions, so a reaction will get automatically processed as a like. this is a very neat solution to the problem of two projects having a different set of features. there's just one issue: akkoma added reactions as well. these reactions, however, were implemented differently from misskey. you can add as many akkoma reactions to a post as you want, and akkoma's likes were an entirely separate system from reactions. this meant that, on akkoma, misskey "likes" were generally received as ⭐ emojis (as was the common choice for a like emoji). this was annoying, but hard to solve because likes weren't a thing on misskey
eventually, firefish (then called calckey) added likes. likes and reactions were still part of the same system, but there was now a button that would insert the instance's default reaction emoji. but that's not the only change that this system brought; this change fixed likes showing up as emoji reactions on akkoma. if you look at the renderLike
function at firefish.dev/firefish/firefish/-/blob/dbb73b8e3dae89dd989caa709b45571437fb584a/packages/backend/src/remote/activitypub/renderer/like.ts#L9 , the logic is quite simple. if the emoji reaction is the default instance emoji, don't send it as an emoji reaction. this fixed the issue of likes showing up as emoji reactions on akkoma and pleroma, and was overall great
during this period of firefish-style likes, a clear meaning could be realized through emoji reactions. a reaction matching your instance's default reaction meant that a user liked your post. a different reaction - say, a ❤️ - would mean that someone is sending love to you. this is similar to every other platform that has emoji reactions. if you posted about something sad that's effecting you, you'd get a lot of ❤️ reactions. this seems simple, but it established a language of communication on fedi through reactions. you were able to show your support for someone through a nice pretty emoji, without having to add yet another reply that would flood their notifications
at some point, sharkey came into existence, and it wanted to add firefish-style likes as well. but they went about it differently. if you read sharkey's codebase, in the ApRendererService
's function renderLike
( activitypub.software/TransFem-org/Sharkey/-/blob/f091b84c6ed19519505594bcb9f2e802876e61fe/packages/backend/src/core/activitypub/ApRendererService.ts#L272 ), you will see that it uses an isMastodon
variable. later in the function, it checks if the target instance's softwareName
is set to "mastodon", "akkoma", or "pleroma", and stores that in that isMastodon
variable. when the object is created, if the target passes the isMastodon
check, and the reaction is the default reaction, it will send a plain like instead of a reaction. this fixes the akkoma like reaction problem, but introduces a new one: firefish (and it's forks). you see, firefish is not mastodon, nor is it akkoma, nor is it pleroma. additionally, new fedi software is always under development, and they will have the same issue as akkoma, except worse
and by worse, i mean that on sharkey the default default reaction is set to ❤️ for some reason. this breaks the language that previously existed with ❤️ reactions, but that should only effect sharkey instances. except, sharkey specifically sends out likes with reaction data to all instances other than the ones they hardcode to send normal likes to. and furthermore, many sharkey instances have their reactions set to other values (some even to animated emojis), causing further pollution of reactions. on iceshrimp, the reactions list of a post, which previously would show the number of likes in the ⭐ emoji and then a list of specific reactions, now shows a five different emojis that the likes might be spread across. now, i thought this was a bug at first. surely this code couldn't be intentional. it would be absurd to intentionally cause the only practical sharkey alternative to have such a degraded reaction experience!
so, i talked to a sharkey developer about this, and the response i got astounded me. first, i was talked down to, which... sure, if you don't know who i am, you might assume i have no clue what im talking about. but i do know what im talking about. i understand how federation works, i cleared explained the issue and how to fix it, and they still disrespected me in every single message in our conversation. but whatever, i don't derive my ego from what frontend developers think about me. so i read her explanation, and... she understood the issue (after i explained it a few times), and decided not to fix it because "sharkey let's instance admins and user change the like reaction to funny reactions". her justification for this incompatibility was that she thought it was funny
and really, this isn't about reactions. this is about a development team i've never heard of barging into fedi software development, spamming advertisements all over my feed, and reducing the quality of my instance for my users. no care has been taken here, and i do not believe care will be taken in future decisions. there certainly wasn't care taken when remote code execution made it's way into the codebase, using an api in a way that the documentation (in bright red text) tells you not to. it's not just that there was an RCE, it happens to the best of us. it was the absolute carelessness that was exhibited in the code, and in the implementation of other features like reactions
i do not trust the sharkey team to develop a piece of software that my friends can trust to represent their identity, and i do not trust that any private data on sharkey will remain private forever. security research on sharkey will continue, and any new feature added makes me worry that a new vulnerability will appear. to my fellow instance admins, while we wait for the next RCE, i suggest migrating to iceshrimp or staying on firefish. and to the sharkey team, please do better
deconstructing a disposable water filter
actually, this is cool enough to post on main, so, I will
a weekish ago, my water pitcher broke, and because I hate all the companies that make these, I decided to not get a new one. but, I already had ordered a new filter to come in the mail before it had broken, and I figured I might as well disassemble it for science reasons
and… the result was not what I expected, but what I should have expected
a bit of background: the two main components of a good water filter are activated carbon and ion-exchange resin. both of these can be obtained very easily in bulk, coarse variants, but the tricky part is putting them into a filter that works purely by gravity alone. if the water just falls down past them, it won't actually filter enough, so, you need to make sure it's hindered enough it gets filtered, but not so hindered it takes forever to pass through
activated carbon, or activated charcoal, is charcoal that's been treated with superheated steam to increase its surface area. it's called carbon/charcoal interchangeably because charcoal is effectively just carbon: you burn something so hot it can get rid of the ashy stuff (everything but carbon) but you don't expose it to oxygen, so that the carbon can't be converted to carbon dioxide when it burns. (this is why the carbon usually goes away when it burns, and leaves the ash behind.)
the reason why activated carbon is good is because its high surface area makes it very easy for all sorts of stuff to get trapped in it, from big organic particles to even elements like iodine and chlorine. its one weakness is that it can only draw out non-charged or weakly-charged particles, since water tends to strongly hold onto charged particles.
to get out the charged particles, an ion-exchange resin is used. this is the same sort of weird chemical structure that's used inside cells to regulate their internal chemistry, and it's called ion-exchange because it literally exchanges out charged particles for each other: positive ions of heavy metals like calcium, iron, lead, and mercury get replaced with less dangerous sodium and potassium instead.
like I said, these two parts can easily be bought in bulk as coarse powders or beads, but running water through those won't really filter it unless you let it sit through. so, I was wondering how a standard gravity filter would stop the water. I figured that it probably just had a bunch of the coarse stuff packed in a tube, then some fine mesh at the bottom to ensure it slowly drains through
…nope! the charcoal and resin is the mesh. it's ground down finely and woven into this spiralled-up cloth. it makes perfect sense, since the thing that is slowing down the water is also the thing that is interacting with the water and filtering it, ensuring that the water is constantly up against what amounts to almost the entire filter at once. this also makes sense when you consider that this filter is rated to actually remove heavy metals from water: since any amount of lead or mercury is bad, you'd better be sure that any amount of it has every opportunity to interact with the filter instead. since the charcoal and resin effectively get "used up" as they filter stuff, either by filling up all the holes or using up all the ions to exchange, you want things to be used up as uniformly as possible, to ensure nothing gets missed. this all makes perfect sense.
anyway, now all this is making me wonder even more if you can just buy this filter mesh and use it yourself instead of having to get some sort of weird plastic casing. I really would like to have my own version, to avoid having to deal with proprietary nonsense, but we'll see
to explain the picture below: the filter housing is about 4cm across, and I unceremoniously sawed through a bunch of the plastic welds with a knife to get it open. there were two thin, fine cloth filters on the edges between the plastic and the carbon-resin mesh. I was shocked when I saw the mesh so I cut it in half to verify it was uniform, and it was
"When all you have is an SUV every trip looks like a drive"
More Lanes are (Still) a Bad Thing by Not Just Bikes
https://www.youtube.com/watch?v=CHZwOAIect4
a capitalist would look at the doujin art scene that has sprung up around Touhou, encouraged and cultivated by its author with his permissive licensing, and say that, despite ZUN being famous/beloved and easily making enough to live off of, that he's a failure, as he hasn't turned Touhou into a paperclip maximizer
but if your goal is the enrichment of culture and the arts, upholding storytelling traditions and inventing new ones, of inspiring and bringing together the next generation around a shared medium, then Touhou and ZUN have succeeded beyond all expectations, in its own niche way
capitalism is a thought-terminating cliche that cannot fathom people valuing things other than monetary growth
I just peer-reviewed a forensic analysis in a case.
The suspect mailed a package with a hidden Apple AirTag in it to a victim's old home address.
The package was forwarded to her new (and formerly safe) address....
Might be good to warn DV victims of unexpected mail.
@SwiftOnSecurity Just
City of Damocles - a 1-bit art commission I did for Cohost user belarius, on a 1986 Mac Plus, with a trackball and a paint program that doesn't support layers. #art #retrotech #commission
Trans woman, bisexual, someone's fiancée, forever a programmer, poly, and former total mess