- 47 Posts
- 68 Comments
daveyOsborn@infosec.pubOPtoInternet Relay Chat•How to generate IRC handles when a group of people who know each other meet in a public space
1·6 days agoOf course. There’s a good xkcd or something for this you would love but I can’t find it… something like “the more I read about Alice and Bob, the more I am convinced that they should just meet in person”.
daveyOsborn@infosec.pubOPto
Is this Instance Down?@infosec.pub•libretechni.ca → ~~504 Gateway Time-out~~ ~~it’s back up~~ back down againEnglish
1·8 days agoServer is online today but every page is an error: “There was an error on the server. Try refreshing your browser.…”
daveyOsborn@infosec.pubOPto
Is this Instance Down?@infosec.pub•crazypeople.online → offline, despite the TLD.English
1·15 days agoStill down for me, but infosec.pub finds posts from a crazypeople.online account to a cp.o community. So it’s working for someone.
daveyOsborn@infosec.pubto
Free OpenSource Software @infosec.pub•Is It Really FOSS? - Where projects are evaluated to see if they're as free and open source as advertised
1·16 days agoI tried to go to the FSF directory to compare to isitreallyfoss, and discovered that they have started blocking Tor quite rudely, by just giving an unreasoned 403 forbidden. FSF should be embarassed.
Interesting to note openVPN has some red flags on isitreallyfoss, but no mention of the Android app. The f-droid version has no anti-features, but I wonder if f-droid folks should have a closer look.
daveyOsborn@infosec.pubto
Free OpenSource Software @infosec.pub•Looking for FOSS alternative to Avenza for geo referenced PDF viewer
1·17 days agoI assume you have considered OSMAnd~, and the openstreetmaps were unsuitable? I was not aware PDFs could have geo coords for what you describe. Sounds useful though.
Might want to cross-post to !foss_requests@libretechni.ca. It’s a ghost town but at least your request would sit at the top of the stack for a while.
Could increase your reach by crossposting to these places as well:
daveyOsborn@infosec.pubOPto
Free OpenSource Software @infosec.pub•Need an onion forge with a clearnet face, like nixnet (but it needs to function)
1·17 days agoStart here to get an overview of advantages. It misses some factors, so I also suggest this thread.
I want to stress the idea of taking load off the exit nodes – which the first link to torproject misses. It not only directly improves the speed for users of the repo, it also gives a better balance to the whole Tor network.
The reddit thread is decent enough to share but I have to correct something: someone said “Onion services are about protecting the server rather than the user.” They neglected to realise that using an exit node potentially exposes users to DNS leaks. Onion links are immune to DNS leaks and DNS shenanigans (recent events with Autistici being an example of DNS creating vulnerability to bad actors like one particular orange menace).
The linked sources are a good start but they miss some other factors:
- Promotion of Tor. The Tor community is severely marginalised because it’s small. Small groups are easy to oppress. Tor needs promotion. Onion links help promote Tor by increasing awareness.
- The clearnet is under constant attack including burdens added by Microsoft’s copilot and AI bots. The clearnet is generally quite enshitified in part due to self-defense measures. Onion sites tend to not need (and not deploy) the extent of full-blown defensive posture that makes the clearnet UX shit.
- MS Copilot is probably not harvesting onion forges. Which means the clearnet variant could easily be hardened against it by (e.g.) bluntly blocking all MS IPs, as the onion would still be reachable to humans that have an MS IP for some reason.
- An onion site /can/ optionally be implemented as a fully redundant server, so when the clearnet host goes down the onion continues offering availability. Two benefits: increased availability and also promotes Tor when it happens. (Not sure if gitea/forgejo or gitlab is better in that config).
daveyOsborn@infosec.pubOPto
Is this Instance Down?@infosec.pub•crazypeople.online → offline, despite the TLD.English
2·18 days agoThanks for the feedback. It was still down for me ~5 min ago, but now it’s up. Maybe the response time is just on the edge of the browsers time-out tolerance.
daveyOsborn@infosec.pubOPto
Is this Instance Down?@infosec.pub•libretechni.ca → ~~504 Gateway Time-out~~ ~~it’s back up~~ back down againEnglish
1·18 days agoOffline again. This time it times out.
daveyOsborn@infosec.pubOPto
Is this Instance Down?@infosec.pub•libretechni.ca → ~~504 Gateway Time-out~~ ~~it’s back up~~ back down againEnglish
1·19 days agoIt’s back online.
daveyOsborn@infosec.pubOPto
Is this Instance Down?@infosec.pub•mander.xyz -- the science instance -- is down (update: speculation about forced shutdown due to a sanction against Russian agents)English
2·18 days agoTo do that well, the post history should be reconstructed. A couple large nodes would possibly be subscribed to every mander community, so they would have a history of posts and comments which could then be reconstructed. Sadly, I think the software to do that does not exist:
https://libretechni.ca/post/1442074
As old as Lemmy is now, it’s really a shame there is no backup tool.
The mander community list and descriptions are available in lemmyverse. Unfortunately the descriptions are truncated despite someone’s request a year ago: https://lemmy.tgxn.net/post/5663028
daveyOsborn@infosec.pubOPto
Is this Instance Down?@infosec.pub•mander.xyz -- the science instance -- is down (update: speculation about forced shutdown due to a sanction against Russian agents)English
7·22 days agoThis makes me realise it would be useful to know the admin’s handle of instances while they are offline. In principle, would be good if the Lemmyverse scraper bot would grab that so it’s in the public dataset.
(update) request made
daveyOsborn@infosec.pubOPtoRight to be Offline / Offgrid / Analog / Unplugged 🔌📪📖📟📝@sopuli.xyz•Italian provider of email and blogs “Autistici/Inventati” is shutting down on 25 September amid US bullying -- could be a reason for taking the analog path
1·27 days agoWell I agree that there are two assaults going on:
- assault on privacy
- assault on analog (aka forced digital transformation, to use European nomenclature)
But they will have more success reversing the order. The GDPR is a façade to comfort people as they get cattle-herded into a fully digital lifestyle. Then after analog mechanisms are ruined, only then will the privacy abuse come full force. Most people have not noticed that the GDPR is not really being enforced. It’s just a show.
If things happened in the reverse order, too many people would fight the forced digital transformation.
daveyOsborn@infosec.pubOPtoEuropean Tech Sovereignty@europe.pub•Italian provider of email and blogs “Autistici/Inventati” is shutting down on 25 September amid US bullyingEnglish
2·1 month agoIndeed it is the most obnoxiously hostile act somewhere between bullying and license to kill bounty. I would like to know how the system works because certainly the US is not the only player.
Is it really a case where Trump can willy nilly list whoever he wants, and all allies are obligated to obey without question? Is there no mechanism by which Italy or the UN can say “hold on, we are not going to accept Trump tagging his political adversaries as terrorists and then lick boots unconditionally”? Anti-terror policy is losing legitimacy with every abuse of it, including Trump’s assassination of drug dealers under the abusive claim of “narco-terrorism”.
daveyOsborn@infosec.pubOPto
cybersecurity@infosec.pub•153M+ US & Canada drivers licenses leaked on the dark web (Update: source of the leak revealed)
1·1 month agoIn principle, yes. But FWIW, here’s a good example of doing it poorly:
daveyOsborn@infosec.pubOPtodeGoogle@discuss.tchncs.de•Don’t like Google maps renaming “Lake Ontario” → “Lake America”? Show your objection by changing your SSIDEnglish
1·1 month agoSaw this in the article:
This is the biggest drawback of hidden SSIDs. When a network is hidden, your phone or laptop has to constantly shout, “Are you there, [Hidden Home Network]?” everywhere you go.
There is a paper that describes how an iOS device listens to everyone else’s phones as they broadcast all the SSIDs they connect to (regardless of where the two phones intersect). It gave the impression that phones also reveal non-hidden SSIDs when looking to connect, as it’s uncommon for people to have hidden SSIDs.
It’s a handle that is broadcasted from your wi-fi router, if you have one. It enables your phone or laptop to distinguish your network from your neighbors.
daveyOsborn@infosec.pubtoDiscussions related to Infosec.pub@infosec.pub•Cannot share links for a post I made
1·1 month agoI will say I find it interesting you are calling my use of mildlyinfuriating@lemmy.world as not being open/the problem, but isn’t the isolation (setting as private) infosec.pub more of a walled-garden and less open?
Infosec.pub is not making a value judgement that permanently discriminates against demographics of people. It’s the difference between an oppressive US corporation arbitrarily systemically singling out groups for marginalisation to save a buck for the corporate as it bullies over 30% of the world’s web territory, and a small charitable volunteer instance with limited resources doing what is necessary to protect itself from an onslaught of attacks.
I can freely share the link of the community post I made even if it is hosted through cloudfare.
Of course. You can share Facebook links too. And those who are in the excluded groups will just waste their time on an unusable link. If you are going to be a pragmatist and not give shit about politics, it’s unclear why you are in the fedi as opposed to Twitter and Facebook.
I imagine mildlyinfuriating@thelemmy.club didn’t exist when I subscribed to lemmy.worlds community or maybe there were only 3 people in it. Surely the expectation is not to keep monitoring all my communities and check if a better version of said community pops up.
Subscribing is about /reading/, not /writing/. When deciding where to post, I often search communities because it’s a changing landscape with new communities emerging daily. Moderately advanced folks would do that by visiting lemmyverse.net which happens to have a filter you can use to filter out Cloudflare instances. I personally use a script instead which queries on lemmyverse’s dataset. If I were to make a post as you did, I would search the terms:
infuri shitif shittif asshol dark%pattern(each token is an SQL “like” query surrounded with wildcards). So that gives:🏰zerobytes.monster🌩|amitheasshole “Am I the Asshole?”
🏰zerobytes.monster🌩|assholegonewild “Gone Wild; Asshole Style”
🏰zerobytes.monster🌩|mildlyinfuriating “jukmifgguggh”
🏰pawb.social🌩|AITA “Am I The Asshole?”
🏰lemmynsfw.com🌩|asshole “Asshole”
🏰lemmynsfw.com🌩|assholebehindthong “Asshole Behind Thong”
🏰lemmynsfw.com🌩|godasshole “GodAsshole”
🏰lemmynsfw.com🌩|pulsatingasshole “Pulsating Assholes”
🏰lemmy.world🌩|actually_infuriating “Actually Infuriating”
🏰lemmy.world🌩|aitah “AmITheAsshole”
🏰lemmy.world🌩|amitheasshole “Am I the Asshole”
🏰lemmy.world🌩|asshole “asshole”
🏰lemmy.world🌩|assholebehindthong “Asshole Behind Thong”
🏰lemmy.world🌩|assholedesign “AssholeDesign”
🏰lemmy.world🌩|assholegonewild “Asshole Gone Wild”
🏰lemmy.world🌩|assholegw “Asshole Gone Wild”
🏰lemmy.world🌩|bassholes “bassholes”
🏰lemmy.world🌩|darkpatterns “darkpatterns”
🏰lemmy.world🌩|enshittification “Enshittification”
🏰lemmy.world🌩|enshittify “Enshittification”
🏰lemmy.world🌩|godasshole “godasshole”
🏰lemmy.world🌩|mildlyinfuriating “Mildly Infuriating”
🏰lemmy.world🌩|mildyinfuriating “mildy infuriating”
🏰lemmy.world🌩|notinfuriating “Not Infuriating”
🏰lemmy.world🌩|qualia “Qualia: Living Ad-Free and Breaking Away from Dark Patterns, Hidden Fees, and More”
🏰lemmit.online🌩|AmItheAsshole “Am I the Asshole?”
🏰lemm.ee🌩|amitheasshole
🏰sh.itjust.works🌩|amitheasshole
🏰sh.itjust.works🌩|furiouslyinfuriating
↑ Kingdoms under the imperial Cloudflare empire ↑⚠lemmy.ml/c/aita “Am I the Asshole?”
⚠lemmy.ml/c/assholedesign “Asshole Design”
⚠lemmy.ml/c/mildlyinfuriating “Mildly Infuriating”
⚠lemmy.ca/c/amitheasshole “AITAH?”
🥧 fedinsfw.app/gaping_assholes “Gape”
🧺 thebrainbin.org/deshittification “Deshittification”
🗽☯ thelemmy.club/c/Mildlyinfuriating (39/0) “Mildlyinfuriating”
🗽☯ discuss.tchncs.de/c/amitheasshole (125/1) “Am I the Asshole? ”
🗽☯ sopuli.xyz/c/enshitification (40/2) “enshitification (not only enshittification)”
🗽☯ infosec.pub/c/assholedesign_web (92/5) “Asshole Design (web edition)”
🗽☯ slrpnk.net/c/asshole_crappy_design (49/12) “Asshole Design and Crappy Design”
🗽☯ slrpnk.net/c/enshitification (942/710) “Enshittification”
🗽☯ lemmy.cafe/c/disenshittify (147/37) “Disenshittify”It lists the shitty Cloudflare places first because those are the least interesting and tend to scroll off the terminal screen. Then it lists non-CF nodes that are still centralised due to their sheer disproportionate size which is indicated with a “⚠”. The “🥧” means piefed and “🧺” means kbin (which the db unfortunately has no Cloudflare flags for, thus ethics is a crapshoot and needs a deeper look). Finally, it lists known open free world places using “🗽☯” to indicate freedom and balance. The paranthesis indicate (subscriber count / active users in a month) to give an idea of activity. Those who realise this decision is inherently political and who want to promote an open free world would choose one of the last 7 in the list. I will sometimes choose the /least/ active among them and then crosspost from there so subscribers in the more active groups can see that another interesting group exists – thus encouraging subscriptions that help improve the balance. Of course in the case at hand, we know infosec.pub is closed as it is under attack, so it would not be a good link to share.
Also, as an end user that is on Lemmy because I want a non techbro place to read news topics/share crap going on when appropriate
You can of course choose to be low-tech if you want, but you should know your bubble will be shaped by others on your node. The in-app search on the instance is limited in scope to content and communities based on subscriptions of others on your node.
If you want to expand your bubble help shape it, it’s useful to grok lemmyverse. I block Cloudflare nodes in my settings and I subscribe only to free world communities (“🗽☯”) to do my part in shaping the bubble for a more balanced decentralised space with minimal boot-licking.
W.r.t. “non techbro place”, I guess you mean to refer to a place that is not for tech experts. It’s worth noting that many read “techbro” as “tech millionaires”, such as the CEO of Cloudflare, Twitter, etc.
, like yesterday this type of stuff explains very clearly why Lemmy is and will continue to be a ghost town in comparison.
Lemmy is not a single town. It’s a vast collection of many towns and a good number of those towns are ghost towns. Network effect is a global problem that Lemmy /tried/ and failed to correct. The devs simply assumed that having a federation of instances would automatically counter network effect. There are several oversights and defects in the software which actually exacerbate network effect.
Lemmy certainly needs to improve but I doubt it will make much headway. It’s more likely that a different software package will emerge one day that fends off walled gardens and network effect.
The barrier to entry/understanding is up there which is not welcoming imho.
The dumb users pile onto the Cloudflare nodes. I doubt the tech is too over their heads to give a bad UX. The refined sophisticated users avoid the centralised instances and their understanding improves. The fact that there is more to learn does not create a “barrier to entry” AFAICT. You can get started and function without understanding the evils of Cloudflare and centralisation. You can make adjustments as your knowledge and wisdom improves.
daveyOsborn@infosec.pubOPtodeGoogle@discuss.tchncs.de•Don’t like Google maps renaming “Lake Ontario” → “Lake America”? Show your objection by changing your SSIDEnglish
1·1 month agoI lost the link but the research was done by: Douglas J. Leith, School of Computer Science & Statistics, Trinity College Dublin, Ireland, 25th March, 2021 in a paper titled “Mobile Handset Privacy: Measuring The Data iOS and Android Send to Apple And Google”.
Every Android device owner is a Google spy. Every iOS device owner is an Apple spy. They don’t know it, generally. Android and iOS devices
constantly¹ harvest the radio data of their surroundings and they send the data home to their respective mothership. This is hard-wired into the platforms and has nothing todo with accounts. An arbitrary person randomly walks/drives by your house with their iPhone or android powered on, and it collects your SSID, MAC, GPS position, etc and sends it to Google or Apple, unwittingly, because people are oblivious as to what’s going on.¹ The phone user may need to have location services enabled for the phoning-home to occur… not sure if turning on location services enables the data sharing in both directions or just one. Guess I need to re-read the research.
daveyOsborn@infosec.pubtoDiscussions related to Infosec.pub@infosec.pub•Cannot share links for a post I made
31·1 month agoNormally I would say the best link for sharing is that of the host for the community, not the host of your account. But in this case you posted in Lemmy.world, which is jailed in the exclusive walled-garden of Cloudflare™. I highly suggest not posting in Cloudflare. It’s a centralized walled garden by an oppressive US-based tech giant. Might as well use Facebook at that point.
There is one open free-world “Mildlyinfuriating” community: !Mildlyinfuriating@thelemmy.club. I suggest posting there first, and then share that link. If you cannot stomach the idea of less reach/engagement or cannot resist the urge to use LW, at least make your first post in the free world and crosspost into the walled gardens so the ignorant walled-gardeners at least learn about the existence of free world communities.
Now to answer your question, the infosec.pub admin is also the fedia.io admin. This post could¹ give some insight:
https://fedia.io/m/fedia/t/2188602/Fedia-io-performance-issues-and-blocking-anonymous-access
That is, anonymous access to infosec.pub could have been blocked for the same sort of reason.
¹ But you may need to create an account on fedia.io to read that… LOL.
copy of linked post
Hi all. Fedia.io has for a long time been subject to ddos attacks, including many that are “accidental”, caused by myriad scrapers constantly hammering the site. I gave up on trying to play whack-a-mole with blocking them based on IP address (they do not honor robots.txt and do not use a conspicuous user agent string) since I was inadvertently blocking some legitimate users. So, I’ve restricted access to the content of fedia.io to only those that are logged in. That will mean we don’t show up in search engines and whatnot, which for some will considered a good thing and will likely cause others to leave.
There is a remaining problem related to the login form. Calls to the login page are breathtakingly expensive, computationally speaking, and so I also have a script that monitors unusual numbers of calls to that form and blocks at the firewall any offenders. I strongly suspect I’m catching some legitimate users with this too, and so I continue to try to tune it, but it’s maddening, y’all.
These issues have been causing performance problems for everyone (despite the fedia.io app running on a dedicated 96 core, 256GB server with nvme disks), and became unavailable for certain people that accidentally tripped various thresholds. I’m hoping most of this is resolved now.
Thanks for the patience.
update
Found this: https://infosec.pub/post/45546187
I erroneously assumed you would have already looked in !infosecpub@infosec.pub so I did not initially look myself.








I appreciate the info. So bug confirmed.
Either all subjects of abuse reports should see the report, or none of them. No good reason mods should have that privilege exclusively.
Also no good reason users should be unable to narrow the recipient list. It should be tick boxes so users don’t have to hunt around for who to contact, which deters spam reporting.