smb

smb , 4 days ago

that could come in veery handy once microsoft wants to pull some plugs.
i guess we can be grateful for the backup that is 1. not 100% in m$ hands any more then and 2nd cannot be as easy destroyed as some backups at archive.org.
i actually hoped for someone with enough money to create this type of security after m$ assimilated github and thought like "does nobody see the rising danger there?"
but even if china's great fork might be more reliable than m$ over time, maybe it's better to have your own backups of all the things you actually may need in future.

btw did microsoft manage to get rid of the hackers that settled into their network for .. how long??

i guess they'll tell

smb , 7 days ago

a public room is public. anyone could and should be able to enter it at any moment start recording and uploading everything to $terrorist@/or$three-letter-agency or such. The idea that someone else could also get the same already public data later is not threatening, as that data is already considered public as in "everyone in the world could have it a second after the data came into existance". and also as removing from the public is not considered possible, uploading that already intentionally published data again does not pose a greater threat than its first publication, but uses just a bit of bandwidth, not more.
if you are very sensitive about visibility of who you talk with, maybe don't enter "public" rooms in the first place.

if you join a private room, you already want to share with the other participants that you are f***ing talking to them, including when and who you exactly encrypted the data for, when, and to which servers they have to be forwarded.
i expect the server of all participants to forward messages to the recipients. for this the server needs to know this type of information.
Of course awareness, which data is used to make i.e. routing decisions is a good thing, but a "nightmare" would be teams zoom icq, whatsapp and similar.
i am sure that messengers exist that could be less traceable for participants, but full anonymity to who you are communicating with so that even the servers know nothing about what happens in a room is imho not even a goal of matrix for the future.

Not a "nightmare", but what a nightmare it must be to find out that a system that looked so promising did not fulfill "every" dreamexpectation one had with options that are even the opposite of ones dreamexpectation like "public rooms". that are meant to be public! how horrible!!!(lol)

by the way -as it seems possibly noteworthy here - if you exchange emails with someones @gmail address, then google has all of your mail histories metadata, as well as the server of your provider has. just to mention, do not send emails to @gmail.com if you dislike google knowing about it. and if you share a document with edit history, then the edit history is likely also shared ;-)
As "rooms" in matrix are meant to have a state that changes from the beginning sometimes possibly with every message and one can answer to a message which would reveal the existance of that message later when answered on, including at least a hint of what it was about, such information is imho meant to to be rather complete than hidden.
maybe 1:1 chat solves this issue for you, as every chat with a new other person would start empty.

i might be wrong, but matrix already is one of the most robust systems when it comes to "compromised servers". so very far away from a nightmare.
that is unless you are either a true criminal bastard or a true world saving hero, then every leaked byte might be the deadly one, that is true.

So in case you are a true world saving hero:
Maybe use a self build raspberry pi mesh proxy chain mounted on rooftops delivered by drones at night to proxy the signal of an in-memory-only-tasks-raspi to a free wifi, where the raspi that has its orders is using battery (like the rooftop proxy chain) but is hidden in a public transport to reach the proxy mesh by the transportations timetable. just to give a paranoic one some ideas and some work to do ;-) If you've build everything, then upload the code to github and designs to thingiverse so that "anyone" could have placed the proxy mesh to a free wifi on the rooftops, so you be more secure from beeing suspected ;-) lol
btw a mesh system to accomplish this already exists, i think they named it b.a.t.m.a.n. (no joke) protocol, so the main struggle should be handling of solar power vs wifi signal strength, distances, humidity and windproof mount design beeing able to be deployed by manually controlled quadrocopters. good luck!

smb , 8 days ago

while at the same time by-design cloaking it as pure bad quality could actually cause way more longterm damage than a little bit of paint.

on the other hand the paint could also be just a marketing strategy depending on what they smoked to get new ideas

smb , 10 days ago

its amazing how good services can be if some just skip the corporation-obligatory adding of enshittification. i remember an article about a downloadable (but not very legal) DVD with an installer for a (worthless but very popular) OS that included heaps of expensive industry software and the installer was point-klick what you want and then all is done in background and fully usable once done. reading that article it seemed to be a better installer than ever produced by any company for any product.

however as that payed streaming service seemingly leaves huge amount of bank records and ran for such a long time, i guess it would have been easy to stop their customers from paying them. it rather might seem that the real intentions of content corporations might not truely be what they officially claim.
maybe we learn in 25 years that the content corporations really were behind such services, maybe like "better get money from ALL markets!" or such.

smb , 1 month ago (edited 1 month ago)

🤔 maybe there is a lack of distributed fediversed search engine instances where:

1. everyone can host a search engine for their very own pages
2. everyone can crawl other pages and provide (maybe with permissions) the crawled data to other search engines (as compressed snapshots, api ...) or provide a search engine by themselves for all.
3. such search engines can be ranked or marked with "has anti features xyz" and put into followable 'collections' per topics.
4. possibility to add 3rd party rankings and filters, so that one can use only a subset of a search engine list that was pieced together by someone you know or trust, reduced by rankings or filters published by another one you somehow trust to limit the items in the first list.

then:
"for software development i use linuz personal 'devel' collection, this way i don't have to manually click through big G's gigabytes of SpaMalAds they always only frustrate you with and i am not distracted with dyo stuff when searching for server administration things like 'puppet stages howto'.
for my home projects i use my friends 'home of DYO' collection, i get more results than i need but get new ideas as well without seeing work stuff when looking up how to build a puppet stage for my little one. 👨‍👧
for kids its awesome, our school provides a collection including specialized search instances that fit learning, while that collection is also peer reviewed by a company that spezialized to ensure it does to not contain search engine instances that also index any unfitting content pages."

oh btw: no i do not have any info about duckduckgo status unfortunately, i stepped over it by myself today 🤷‍♀️

smb , 1 month ago

great, thanks. i'll try it out as i have some spare resources on my server.

smb , 2 months ago

i think it was not the whole hull but one of the materials, the hull was made of that had expired.
well, carbon fibre has its strenght when pulled, but when pushing it bends. but if one uses resin on the fibre, then it gets some strenght when pushed too. similar to steel and concrete, while steel can really be pulled a lot, concrete is way better when pushed than steel. steel is quite stable when pushed too, but thats not its main strength.
i think the resin was what really held the pressure in the sub, not the carbon fibre, but with this i only have that dangerous type of half-knowledge i'ld have to bring to expert level before doing something stupid (like depending on that to be fully true without really knowing).

in general things often last longer than their expected "minimum" to be used without concern.
but in practice one would have to test for damage or if its worn out (like its done with airplane parts at fixed intervals) even without using materials of bad quality. but that was AFAIK what oceangate's management decided to explicitly NOT check the sub for - despite internal demands to do so.

i would not say its not possible to build a secure pressure hull out of carbon fibre, or out of carbon fibre of not the best quality, or a hull of a different shape than a sphere, or a hull out of different materials with different bending behaviors under pressure, or when such components are "glued" together on the edges that do the different bending, but ALL of this at the same time and without even checking at least after a new maximum depth was reached? not to mention crackling sounds after which heared one would want to double check.
Even the wright brothers seemed more cautious to me.

today one would at least get some wear level statistics with unmanned vehicles in a slightly deeper than intended depth to have security margins and afterwards throughout checks for the parts that are important, single points of failures or are one of the proudly new developed.

smb , 2 months ago (edited 2 months ago)

All who could have an idea of what to do with it could seek a way to get that data out of every company or gov that have it for their specific reasons, no matter if data was collected lawful or not, or if access to the data is then lawful or not.

1. search for source of evidences on crime scenes: if one of your relatives happened to have been (related to crime or
   just bad luck) at a place where later on some evidence was collected, you might cause trouble for them bcs your data is very similar to theirs and that is obvious to laboratories. depending on the the "later on" current state of technology it could affect relatives more than two or three steps away from you. if you live in a country where law enforcement gives a shit about truth and just seeks for one argument to punish just anyone they can point a finger at, that could become a huge problem for the whole family then just because there was data that could have been abused.
2. illegal organ traders could - once they have access to your data - think you or your relatives could be a source of nice income if a client of theirs happen to pay enough. however you will probably never know as the illegal organ traders are unlikely to ring the doorbell to ask nicely for a contract. How much do you think would a richie in personal needs pay for "spare parts" if those who deliver them wants him to just never ask where it came from ? does it matter if such organ teaders could know a "compatible match" by data only? maybe not because they might know tomorrow or someone might put up an AI to do the matching (does it matter if that matching by AI is correct then? i guess such traders don't really care and their customers probably, but wouldn't that be possibly too late then?)

For me the latter is actually enough to not willingly give my DNA data to anyone. for no reason. gov might already have it (covid probes had been collected and frozen at least) but actively pushing your data out inzo the world would be insane IMHO.

Laboratories often use Microsoft Windows, Microsoft Active Directory and Microsoft Exchange, thus i personally see no reason to NOT believe that any data they have received once in time would - sooner or later - end up rotating uncontrolled in the hands of uncountable criminals waiting for any chance to make quick or huge money out of it.

smb , 3 months ago

usually at first you can do such, and later on, when a ceo wants more money, you then can buy that together with the new "pro" features actually nobody needs nor wants.

maybe better look for more stable solutions before they start acting like a broadcom ;-)

smb , 3 months ago

 HISTCONTROL=ignorespace
 unset RANDOM
 RANDOM=4
 clear
...

If RANDOM is unset, it loses its special properties, even if it is subsequently reset.

HISTCONTROL If the list of values includes ignorespace, lines which begin with a space character are not saved in the history list.

RTFM can save your server AND your bet ;-)

it is cheating of course if the predefined rules tell us about such requirements and if these are not met any more when unsetting RANDOM ahead of it.

smb , 3 months ago (edited 3 months ago)

i have two other possibilities at hand, that do not involve two SSDs:

1. don't use intentionally broken software in the first place ;-)
2. use another device for bootloader, could be a readonly CD or a usb drive, PXE/bootp could also do it.

And if your company wants you to use rotten software, they also want you to give them the delays, downtimes and annoyances that naturally come with rotten decisions, just keep that in mind.

Here is one thing to remember and why i call it rotten software and rotten decisions:

Microsoft offers a free "blame the ransomware people" to any CTO who just wants to receive money without working at all or not having to "think" during work. That same CTO can get a bonus after "solving" the ransomware issue and then: "look how 'invaluable' that CTO is to the company" he "worked" for month ( yelling at engineers he previously told to install rotten software???) and resolved the ransomware issue!!
This is same to those who work. no law has ever given people that many payed breaks from work as "rotten software" vendors did.
and if you made a mistake and did not get trained before, you could blame bot beeing trained.

Look at it from a "fingerpointer" point of view, one cloud always blame someone else for everything and the only one to blame is too big to fail and also untouchable due to their army of darkness lawyers. thus anything happened? no one could be guilty AND be held responsible.
Also if one is slow at work, and so is his OS, obviously easy to blame someone else again.

so microsoft offers a "solution" to "boss wants you to work more and quicker" but remember, that same boss only "needs" a cover for his own ass to be able to point to someone else and the ones creating the rotten software do deliver that ;-)

i do not know any better wording for such a situation than "rotten" thus i name it so.

smb , 3 months ago

i am happy to have a raspberry pi setup connected to a VLAN switch, internet is behind a modem (like bridged mode) connected with ethernet to one switchport while the raspi routes everything through one tagged physical GB switchport.
the setup works fine with two raspi's and failover without tcp disconnections during an actual failover, only few seconds delay when that happens, so basically voip calls recover after seconds, streaming is not affected, while in a game a second off might be too much already, however as such hardware failures happen rarely, i am running only one of them anyway.

for firewall i am using shorewall, while for some special routing i also use unbound dns resolver (one can easily configure static results for any record) and haproxy with sni inspection for specific https routing for the rather specialized setup i have.

my wifi is done by an openwrt but i only use it for having separate wifis bridged to their own vlans.

thus this setup allows for multi-zone networks at home like a wifi for visitors with daily changing passwords and another fror chromecast or home automation, each with their own rules, hardware redundancy, special tweaking, everything that runs on gnu/linux is possible including pihole, wireguard, ddns solutions, traffic statistics, traffic shaping/QOS, traffic dumps or even SSL interception if you really want to import your own CA into your phone and see what data your phones apps (those that don't use certificate pinning) are transfering when calling home, and much more.

however regarding ddns it sometimes feels more safe and reliable to have a somehow reserved IP that would not change. some providers offer rather cheap tunnels for this purpose. i once had a free (ipv6) tunnel at hurricane electronic (besides another one for IPv4) but now i use VMs in data centers.

i do not see any ready product to be that flexible.
however to me the best ready router system seems to be openwrt, you are not bound to a hardware vendor, get security updates longer than with any commercial product, can 1:1 copy your config to a new device even if the hardware changes and has the possibility to add packages with special features to it.

"openwrt" is IMHO the most flexible ready solution for longtime use. same as "pfsense" is also very worth looking at and has some similarities to openwrt while beeing different.

smb , 3 months ago (edited 3 months ago)

anyone remember the time when google removed(!) their internal "don't be evil" rule?
guess this is part of the outcome of that "be evil" that came along with removal of the opposite.
Abuse of this mechanism is IMHO veery predictable ;-)

There are plenty of google-free cellphones, one could easily stick to better products of better companies. help yourself, google's not gonna do that for you within the next 5billion* years as they IMHO already stated they "want" to be evil now, always remember that ;-)

*) thats round about when our sun expands too much for earth, so i currently dislike doing any predictions beyond that point ;-) i do not predict google would last that long, only that they'll keep beeing evil until their end.

smb , 3 months ago

ok, i have to admit, that i was thinking of google-"services" free phones like the new ones from huawei. but sure android is made by google (but not "owned" by them). however i can try to "rescue" my argument by saying something like "just use a nokia 3310! they're still working and the batterie should still last a week if not more" ;-)

however projects like lineage os might be a good choice to have threeth (as in more than "both"), more security, less dependency from google, and also more influence on the actual software included in the build, if it's not even possible to just compile it yourself and have freedom of changing every line of code as you wish.

smb , 2 months ago

my idea currently is to finish some projects that have priority and afterwards then look for lineage os on raspberry pi, combined with gsm modem and maybe a gps module, all powered by a slim powerbank. might make up a huge bulky phone but i almost want to start building it now.
On the other hand if i wait until my other projects are finished, the whole thing might be ready made available for self assembly...

smb , 2 months ago

hm you have a point that it might not have been removed completely, but the problem with that point that i personally have is that this reached me too late to just believe it was really never removed.
For some reasons i would not believe blindly in "evidences" that are in control of the one that is in question and could manipulate it later for such claims and also was experienced to not be trustworthy for what they say..

saying that, there are ways to check if something was there at a time or not. the one source i know that could help here only seems to store records from 29th jun 2023 18:44:33 onwards which is too late for this.

https://web.archive.org/web/20240000000000*/https://abc.xyz/investor/google-code-of-conduct/

you are right, it does not make a difference in if they can be trusted, but it makes a difference in why not and what to expect if you do so despite the red flags or -as a gov- just let things go on.
A person who by accident was speeding should maybe be treated differenrly than a person who intentionally(!) does so while risking others lifes. and what would be more proof of intention than a written statement or removed canary? thus such a statement does make a difference in terms of they just cannot handle their stuff, don't care at all or maybe even have evil intentions.

examples:

some kids making a fire in the forest cause they don't know the risks

vs.

some young adults making a fire in the woods cause they just don't care despite knowing the risks

vs.

a company making fire in the woods because its cheaper to do stuff there and they lack the resouces to do it safe and someone else will pay the firefighters anyway.

vs.

a company stating to want to do so cause they like it despite they could afford doing it secure but just no one could or would sue them anyway.

while i don't want to say google is like no.4 here, to me these examples all make huge differences, no matter if the woods actually cought fire or not.

smb , 3 months ago

ich you have adhd and asperger or better, you might end up beeing trained by yourself for ignoring google's, microsoft's or other f'uped up so called "autocorrection" and 'automatically' overlook single mismatching words but recognize the sentence as a whole without actually reading it word by word. some can read entire pages with a single look on it without focusing on a a specific region or i.e. the center while still beeing able to later rephrase the content of the entire page.

1up for all with special (dis-)Abilities!!

smb , 3 months ago

maybe parts of it has an undenieable reason:

https://lemmy.ml/post/13118580

smb , 3 months ago

my 2 cents just in case...:

A raid6 is not a replacement for backup ;-)
i use rdiff-backup which is easy to use, stores only one full backup and all increments are to the past while it is only possible to delete the oldest increments (afaik no "merging") i never needed anything else.
The backup should be one off-site and another one offline to be synced once in a while manually. Make complete dumps (including triggers, etc) from databases before doing the backup ;-)

i like to have a recreateable server setup, like setting it up manually, then putting everything i did into ansilbe, try to recreate a "spare" server using ansible and the backup, test everything and you can be sure you also have "documented" your setup to a good degree.

for hardware i do not have much assumptions about performance (until it hits me), but an always-running in-house server should better safe power (i learned this the costly way). it is possible to turn cpu's off and run only on one cpu with only a reduced freq in times without performance needs, that could help a bit, at least it would feel good to do so while turning cpu's on again + set higher frequency is quick and can be easily scripted.

hard drives: make sure you buy 24/7, they are usually way more hassle-free than the consumer grades and likely "only" cost double the price. i would always place the system on SSD but always as raid1 (not raid6), while the "other" could then maybe be a magnetic one set to write-mostly.

as i do not buy "server" hardware for my home server, i always buy the components twice when i change something, so that i would have the spare parts ready at hand when i need it. running a server for 5+ years often ends up in not beeing able to buy the same again, and then you have to first search what you want, order, test, maybe send back as it might not fit...
instable memory? mainboard released smoke signs? with spare parts at hand, a matter of minutes!
only thing i am missing with my consumer grade home server hardware is ecc ram :-/

for cooling i like to use a 12cm fan and only power it with 5v (instead of the 12v it wants) so that it runs smoothly slow and nearly as silent as a passive only cooling, but heat does not build up in the summer. do not forget to clean the dust once in a while...
i never had a 5v powered 12V-12cm fan that had any problems with the bearings and i think one of them ran for over a decade. i think the 12volt fans last longer with 5v, but no warranty from me ;-)

even with headless i like to have a quick way at hand to get to a console in case of network might not be working. i once used a serial cable and my notebook, then a small monitor/keyboard, now i use pikvm and could look to my servers physical console from my mobile phone (but would need ssl client certificate and TOTP to do so) but this involves network, i know XD

you likely want smart monitoring and once in a while run memtest.

for servers i also like to have some monitoring that could push a message to my phone somehow for some foreseeable conditions that i would like to handle manually.

debsums, logcheck logwatch and fail2ban are also worth looking at depending on what you want.

also after updating packages, have a look at lsof | egrep "DEL|deleted" to see what programs need a simple restart to really use libraries that have been updated. so reboots only for newer kernels.

ok this is more than 2 cents, maybe 5. never mind

hope these ideas help a bit

smb , 4 months ago

i guess the number they want to fundraise comes from an AI (maybe because they do not want to think by themselves any more)

as far as i am right with the "trillion" which is just a "billion" where i live and 1e12 (a 1 followed by 12 zeroes)

but according to wikipedia (in 2017) there are only:

14.000.000.000.000 USD existing in the world while they want to fundraise
7.000.000.000.000 USD

so basically they want half of the USD that had been printed in all history up until 2017.

maybe they just want to say that they want to push YOU into poverty, who knows.

may it by getting it from you or by letting some govs print money faster than ever, reducing your money to half or less of a fraction of its previous virtual value.

But the AI that came up with that number had "good luck" to not come up with the need of "more" money than ever has existed =D

i think i'ld prefer to use a dice when i really need a random "decision".

update:
Plz tell me if i am wrong with the numbers or what the current 2024 number of all "printed" (well physical AND digital) USD in the world is at the moment. thx

smb , 4 months ago

yeah, thats exactly what i am saying, most of the money ever printed sits in places it will never leave, so IMO there are no 5trillion available on the market and the cash flow does not allow to take out even a "little" bit (speaking in 1e12 terms) before things collapse for the majority.

oh yes, printing money works exactly like that, it was just printed in the past and nowadays they just increase numbers in databases: plopp and the value of that currency and especially everything that is bound to it decreases, ripping you of what you have saved without even touching your bank account.

smb , 4 months ago (edited 4 months ago)

maybe just "they" can't.

probably a bad idea to put those with already too many recource usage, who are living on the cost of society for uncountable generations, in positions to decide anything.
maybe.

smb , 4 months ago (edited 4 months ago)

quadrillion you say..

yes, banksters like to create bubbles, inflate, trade with them until all value was extracted, let the bubble burst and then let all bus drivers and other low income people pay for the loss which is the gain of some parasites.

quadrillion... bubble->add some time->burst

if we have both two dollars, one for security and one for trading. we both "invest" in buying call orders from each other for a dollar and repeat it a billion times on the same day then we creates a "cash flow" of two billion dollars alone, yet the value behind it was less than 2 dollars.

that is what high performance traders do, they sell/buy thousands of times per second, creating the illusion of cash flow and worth, yet their actions have negative value, destabilize the market on the long run to create illusion of worth. but that illusion is very welcome as it blinds people and let them believe and invest which then can again be harvested until the bubble bursts..

lets remove two dollars from my above example... i have now only one dollar for trading so do you. but none for security.
would you buy a call-option from someone without security? no. so wont i.
thus remove 2 dollars (half of them) and 2 billion dollars of cash flow cease to exist on that day alone!! well, the next day looks the same then. lol. guess that would be called a collapse that 'nobody could have foreseen". lol.

7 trillion usd is roundabout half of the worldwide existing usd in 2017 (cash and database money, no debts, no could-be-printed, no needs-to-equaled-later) that is if wikipedia is correct and i did not miscalculate the 'trillion' which is just a sloppy 'billion' here.
And further more the "worth" of the really 'existing' usd looks to me like a huge bubble by itself waiting to burst some day, but that is not the point or discussion here.

lets just hope that this "quadrillion bubble" you seem to be fond of does not burst too soon. there are still some resources to be ripped of from earth, some countries that could be enslavelaboured just to postpone the burst of that bubble, so the wave of destruction could carry that bubble for another generation maybe and we are sort of "safe", but not sure.
thus maybe lets hope it bursts rather sooner than later preserving some resources and preventing huge amount of hurt and damage from beeing done while leaving chance for a more stable bubble-free world without manmade intentionally created crisises just to let "others" pay for it.

intentionally created illusions are in total the most costly "realities" ;-)

smb , 4 months ago

it is unlikely that they see "you" driving then.
just to mention ;-)

smb , 4 months ago

oleep was a pretty effective habit, we should have kept that as it removed all annoyances of aleep and bleep, while had all blessings that came with cleep, dleep.. up to nleep, but some noobs wanting to play adult, created first pleep, then qleep wich was addictive and destructive preventing people from going back, not even to pleep. Then intentional enshittification was added and only sleep somehow was sort of a still acceptable solution but taking up like a third of the whole day while giving just as much relaxation to really "survive" the first two hours of a working day from which then the overall 90% of success at work comes from.

i miss the times aeons ago when oleep was still common, people were happier, friendlier, more productive and overall healthier.

cheers o_O
8-)

smb , 4 months ago

"daily" maintenance for linux???
i think we call that "eier schaukeln" in germany.

smb , 4 months ago

see, capitalism works!

1. sell 10million packages each with missing 2% of contents.
2. sell those 200000 extra packages with the contens you "saved" (no, not 204000 with again missing 2%, see below why)
3. do not pay taxes on extra packages you sold as you can "proof" you sold all 10million paying those taxes.
4. receive 200000 * price of package as personal taxfree extra income.
5. write that one guy who complained about missing 8grams of pasta a sorry letter
6. complain about time loss and costs writing a single sorry letter and pay paper and stamp out of "marketing" campaigns budget
7. complain about the world not trusting companies
8. complain about people using badly adjusted scales
9. complain about someone selling none-genuine products on market with your logo faked.
10. assume that those packages with missing contents could be just those fake products.

done a full circle.

but... kitchen scales are really bad.
most other scales as well.
i tried to find (electronic) scales that are actually precise:

for low weights i ended up with a scale with 0.01 gram precison, but it could only measure a bit more than 100grams (and also included a 100gr calibration weight)

for higher weigths i only found a scale for post offices measuring packages. the only thing the vendor "really" promised was that multiple times measuring the same thing would be showing the same weight (nope the best "affordable" scale on the market here did not promise to measure correctly, just to measure over and over the same...)

i guess the options for accurate measuring of more than 100gr are:

• old style mechanical scales daily adjusted
• high priced industry/laboratory scales with warranties

fun fact:

after i bought that 0.01gr precicion scale, amazon showed me small plastic clip bags with green leaf signs on it as "recommended" products for month, while i used the scale to mix just small amounts of 2-component epoxy resin in projects.