self

joined 2 years ago
MODERATOR OF
[–] self@awful.systems 7 points 1 month ago

exactly, it’s not a problem that’s unique to the web. I’d argue that as an execution environment, the browser has properties that make it slightly easier to catch this class of attack (though as you said, we’re in halting problem territory so there’s no universal check for this kind of thing):

  • there’s browser plugins (for Firefox at least, I don’t care about chrome) that alert you if the JavaScript you’ve been sent has changed and provide some tools to evaluate what specifically changed
  • you can examine JS memory in depth with a variety of tools, all of which come with the browser
  • you get a running log of network requests
  • as our intrepid cypherpunk visitor noted, you can mitmproxy it if you really want to? they seem to think it’ll be too late to do anything by then but like, losing your keys to an SLA doesn’t instantly dissolve you in a vat of acid or anything. they’ve still left forensic evidence of an attack in your browser’s cache and the potential for you to catch it and make a terrible lot of noise about it, and they really didn’t need to — Proton’s security is compromised enough by entirely silent server-side cleartext leaks, metadata logging (they turn it on silently on law enforcement requests; their no-logs policy is a legal no-op), and other evil fuckery

and I do have to emphasize that last bit. I’m not here to praise Proton, I’m here to bury it correctly. if the worst thing you’ve got to say about proton is that an SLA could request a custom JS exploit be sent to your browser, then it’s probably still a perfectly fine service to use if you’re just chatting with your grandma and your drug dealer, depending on your threat model. I’d argue that Proton isn’t suitable for anybody, because the class of attacks they’ve enabled allow for quiet mass surveillance, rather than the motivated (and loud) targeted kind.

[–] self@awful.systems 6 points 1 month ago* (last edited 1 month ago) (2 children)

and for the users at home playing the drinking game: of course this weird fuck’s been giving dangerously bad advice on privacy lemmy, why wouldn’t he be

I ain’t gonna dig any deeper to find out if privacy Typhoid Mary over here has a uniquely bad gpg setup he loves but if anyone does: that’s another shot

e: also lol @ coming into TechTakes with an account named after the fucking cypherpunks mailing list

[–] self@awful.systems 7 points 1 month ago

How many of their users do you think are sufficiently paranoid?

for fucking Proton of all things? come the fuck off it.

the rest of your post is wrong, but in a really boring way? like, you get that there’s a bunch of ways to catch this shit but want me to do the labor of proving that it’s possible for some reason? no, fuck off, go cosplay as a privacy expert elsewhere.

[–] self@awful.systems 10 points 1 month ago (5 children)

that’s utterly trivial for a sufficiently paranoid user’s browser to detect, and damning for proton if it is (not to mention, pushing hostile JavaScript doesn’t work for users on the imap bridge or using mobile apps they update via methods that can’t easily be tracked like Obtainium on Android)

the mechanisms proton uses to exfiltrate encrypted data and get their users arrested are far more subtle and deniable than that basic shit. specifically, they’ve been silently overcomplying with law enforcement data requests for years, which has led to documented arrests of activists, and all of their LLM features represent a significant data leak, as all of them are implemented in a way that sends cleartext to proton’s servers while maintaining the illusion that the feature is more secure than it is.

I wouldn’t be at all surprised if they were doing more evil shit than the above, but I would be very surprised if any of it were in the form of JavaScript that the user could, you know, deobfuscate and read

[–] self@awful.systems 14 points 1 month ago (5 children)

ah right, you only care about vague consolidation in the tech industry, but will take the industry’s word at their self-reported energy usage (while they build massive datacenters and construct or reopen polluting energy sources, all specifically to scale out LLMs) and don’t care about the models being fed massive amounts of plagiarized work at great cost to independent website operators, both of which are mechanisms by which LLMs are being used as a weapon with which to consolidate the tech industry under the rule of a handful of ethically bankrupt billionaires. but it’s ok, Claude Code is a massive improvement over the garbage that came before it — and it’s still a steaming pile of shit! but I’m sure going to bat for this absolute bullshit won’t have any negative consequences at all.

how about you fuck off, bootlicker.

[–] self@awful.systems 17 points 2 months ago (6 children)

404media posted an article absolutely dunking on the idea of pivoting to AI, as one does:

media executives still see AI as a business opportunity and a shiny object that they can tell investors and their staffs that they are very bullish on. They have to say this, I guess, because everything else they have tried hasn’t worked

[–] self@awful.systems 12 points 2 months ago

wait til you find out what the ml does stand for, it’s a real trip (and it sure as fuck ain’t Mali)

[–] self@awful.systems 8 points 2 months ago

holy fuck please learn when to shut the fuck up

[–] self@awful.systems 11 points 2 months ago (3 children)

programmers learned what N means in statistics and immediately realized that “this N is too small” is a cool shortcut to sounding smart without reading the study, its goals, or its conclusions. and you can use it every time N is smaller than the human population on earth!

[–] self@awful.systems 11 points 2 months ago
[–] self@awful.systems 11 points 2 months ago

this particular abyss just fucking hurts to gaze into

[–] self@awful.systems 13 points 2 months ago (1 children)

the reason why we’re calling AI a bubble isn’t because we think the people illegally running gas generators to power their datacenters have suddenly grown a conscience

we’re calling it a bubble because just like with NFTs, there’s no use case for LLMs or generative AI that stands up to even mild scrutiny, but the people funneling money into this crap don’t seem to have noticed yet

 

Netrunner is a collectible card game with a very long history. in short:

  • its first edition was designed by the Magic: The Gathering guy (with about as many greed and scarcity mechanics as Magic) and took place in the same universe as Cyberpunk 2077
  • the second edition was published by Fantasy Flight Games, replaced the scarcity mechanics with Living Card Game expansion packs (you get all the cards in the set with one purchase) and a sliding window for tournament play card validity, and switched universes and names to Android: Netrunner
  • the game went entirely out of print once Fantasy Flight dropped it
  • the current “edition” of the game and its rules are maintained by a non-profit cooperative named Nullsignal (formerly NISEI), who also continued the story started in Android: Netrunner.

because the game is maintained by a non-profit (and actually appropriately fairly anti-corporate) cooperative, playing Netrunner ranges from free to relatively cheap:

  • any recognizable proxy is valid even in tournament play with the right (opaque-backed) sleeves. this means that you can print out Nullsignal’s cards at home and sleeve them with a little bit of card stock for rigidity and be ready for tournament play. this also means you can sleeve a post-it note for the same effect, so long as both players can recognize which card you’re supposed to be playing
  • you can buy a boxed set from Nullsignal if you’d like high quality cards, and they’ve also got on-demand manufacturing set up through DriveThruCards and MakePlayingCards
  • or you can forget physical cards entirely and play on jinteki.net, a free service that lets you play an online game of Netrunner using every card ever published by Fantasy Flight and Nullsignal. the designers at Nullsignal also use Jinteki to beta test and pre-release sets, so you may also get access to cards that don’t physically exist yet

the gameplay of Netrunner is fucking great: it’s an asymmetric card game where one player is a corporation (or their sysadmin at least) and the other is a runner trying to hack and bring down that corporation. the gameplay feels a lot like a mix between a shell game, the bluffing parts of poker, the better bits of Magic (most of the rules you need are on the cards), and an aggressive cat and mouse struggle, all at once. it’s actually one of my favorite ways that decking and ICE have been translated into gameplay mechanics.

Nullsignal also does a great job on the story, art, and aesthetic of their new cards. modern Netrunner has a distinctive feel to it, but it’s clear that the folks behind it understand how to make good cyberpunk.

 

Hypnospace Outlaw is that funny meme game with the pizza dance. it’s also a leftist parody of the California Ideology and some of the factors that led to the bursting of the dot com bubble. crucially, it’s also a whole lot of fun to play — it’s a very good point and click mystery adventure that takes place on a faithfully rendered and authentic-feeling version of a networked computer in the 90s, crafted by someone who absolutely knew what they were doing with the time period and aesthetic.

above all, it’s one of the better cyberpunk games I’ve played, though I can’t really explain why without spoiling the ending. Hypnospace Outlaw can be finished fairly quickly, so I encourage anyone who hasn’t to give it a play or at least watch a playthrough from a non-annoying YouTuber. ending spoilers follow:

Hypnospace Outlaw ending spoilersit goes without saying that sleeptime computing in Hypnospace is a limited and janky but still revolutionary brain-computer interface, and in effect what you’re doing during the whole game is a precursor to netrunning. in fact, Hypnospace in general is a perfect prelude to a Gibsonian cyberpunk dystopia.

as demonstrated in the last chapter of the game, sleeptime computing tech is fatal when pushed beyond its limits, as Merchantsoft demonstrated like only a short-sighted and greedy startup in 1999 could. Dylan even spends 20 solid years blaming a hacker for the lives he took fucking with tech he barely understood. the tech behind sleeptime computing is most likely outlawed after 1999, or its use is at least heavily stigmatized.

at the same time, the promise behind Hypnospace remains alluring as fuck. in the last chapter of the game, you join up with a nostalgic effort to archive all of Hypnospace from the cache memory in your repaired moderator headband. the allure goes beyond nostalgia though: with the 90s ideas stripped away, even a janky BCI is incredibly useful. you can imagine high-frequency traders, drone pilots, and similar assholes being particularly interested in the illegal tech that replaces sleep with the ability to very efficiently do their jobs 24/7. cyberdeck tech being strictly regulated and only available to high-level corpos and obsessed hackers is a key component of classic cyberpunk.

and hey, while we’re on the topic of the worst people in the world adopting illegal tech, did you finish the (excellent) M1NX and Leaky Piping side plots? cause if you did, you’ll know that sleeptime computing doesn’t actually let you sleep — it severely limits the amount of time you spend in REM sleep, but users don’t realize that because they’re still physically resting. so those high-frequency traders, drone pilots, and other assholes who’ve adopted habitual sleeptime computing use are also slowly going insane from a lack of REM sleep, and chances are they don’t know it because all the evidence was released right before the Mindcrash

in short, these are all the precursor chemicals you need for a cyberpunk future.

the game’s author, Jay Tholen, is currently in progress on its sequel, Dreamsettler. I can’t wait for more good cyberpunk.

 

there’s an alternate universe version of this where musk’s attendant sycophants and bodyguard have to fish his electrocuted/suffocated/crushed body out from the crawlspace he wedged himself into with a pocket knife

 

404media continues to do devastatingly good tech journalism

What Kaedim’s artificial intelligence produced was of such low quality that at one point in time “it would just be an unrecognizable blob or something instead of a tree for example,” one source familiar with its process said. 404 Media granted multiple sources in this article anonymity to avoid retaliation.

this is fucking amazing. the company tries to hide it as a QA check, but they’re really just paying 3d modelers $1-$4 a pop to churn out models in 15 minutes while they pretend the work’s being done by an AI, and now I’m wondering what other AI startups have also discovered this shitty dishonest growth hack

 

this is a computer that’s almost entirely without graphical capabilities, so here’s a demo featuring animations and sound someone did last year

 

kinda glad I bounced off of the suckless ecosystem when I realized how much their config mechanism (C header files and a recompile cycle) fucking sucked

 

 

the r/SneerClub archives are finally online! this is an early v1 which contains 1,940 posts grabbed from the Reddit UI using Bulk Downloader for Reddit. this encompasses both the 1000 most recent posts on r/SneerClub as well as a set of popular historical posts

as a v1, you'll notice a lot of jank. known issues are:

  • this won't work at all on mobile because my css is garbage. it might not even work on anyone else's screen; good luck!
  • as mentioned above, only 1,940 posts are in this release. there's a full historical archive of r/SneerClub sourced from pushshift at the archive data git repo (or clone git://these.awful.systems/sneer-archive-data.git); the remaining work here is to merge the BDFR and pushshift data into the same JSON format so the archives can pull in everything
  • markdown is only rendered for posts and first-level comments; everything else just gets the raw markdown. I couldn't figure out how to make miller recursively parse JSON, so I might have to write some javascript for this
  • likewise, comments display a unix epoch instead of a rendered time
  • searching happens locally in your browser, but only post titles and authors are indexed to keep download sizes small
  • speaking of, there's a much larger r/SneerClub archive that includes the media files BDFR grabbed while archiving. it's a bit unmanageable to actually use directly, but is available for archival purposes (and could be included as part of the hosted archive if there's demand for it)

if you'd like the source code for the r/SneerClub archive static site, it lives here (or clone git://these.awful.systems/sneer-archive-site.git)

 

hey let’s see what the people who killed and buried hacker culture think should go in the jargon file!

If the spirit of the original Jargon file was to be a living document, alas, it failed to keep with the times.

Hackers at large have moved away from Lisp despite Paul Graham and other evangelists […]

Hackers also have moved away from academia at large, and 9-5 jobs at tech behemoths are more natural habitats for them, which also shaped the lingo. I mean, there’s a whole layer of slang usually pertinent to outsourcing agencies and to cubicle farms.

I can’t wait for the corporate-approved jargon file, with any hint of anti-capitalism replaced with fun words and quotes from billionaires to share as the soul leaves my body

So in order for the document to evolve, we need a system to determine consensus. Everyone who cares runs a program on their computer that joins the network and registers their intent. With each proposed change, a query goes out to the network, and it's up to everyone on the network to say yea or nay to the proposal. With enough "yea"s, the document is updated.

...this is starting to sound like a blockchain, isn't it.

for the absolute sake of fuck. coming soon: HackerDAO! collect 10xer tokens and finally prove to the junior devs why corporate gives you so many points to crunch on! vote on fun new jargon, but only if it’s crypto-related! surely you’re hacker enough to be on the pump side of this pump and dump!

 

Bevy is a fun, cozy game engine to play with if you’re looking for something very flexible that implements some surprisingly advanced features. things I like:

  • it’s all rust, which is an advantage for me and the chemical burns I have from handling the dialect of C++ a lot of older game engines used to be written in
  • it implements a flexible entity component system, which I found pretty great for specifying game and rendering logic for things like roguelikes and simulations, where multiple game systems might interact in dynamic ways
  • the API is very cozy and feels like querying an extremely fast database at times
  • it’s a lot lower level than something like Unity or Godot, but you get some pretty advanced rendering features included
  • the main developer seems to have a lot of industry experience and a solid roadmap
 

Nix is one of the few pieces of software I trust. I use it on just about every computer I work on — awful.systems is managed and deployed by just nixos-rebuild and a deployment flake, as are almost all the computers in my house (including a few embedded into the house itself). in general it makes both software development and configuring Linux a lot more fun compared with the traditional way of doing things

I often call Nix fucking incomprehensible, but it doesn’t need to be. Zero to Nix is one of the documentation projects that’s intended to be a more gentle goal-oriented introduction to Nix concepts, and it’s definitely worth following along if you’re curious about Nix and want to be able to do something useful with it right away

if you end up liking Nix and want more of it, NixOS is an entire Linux distro configured and managed by Nix, and it’s incredibly powerful and stable. I run it on a full-fat gaming PC as my primary OS and the experience of running it is surprisingly very good; feel free to ask and I’ll summarize how I run stuff like games on NixOS

 

the API is called Web Environment Integrity, and it’s a way to kill ad blockers first and a Google ecosystem lock-in mechanism second, with no other practical use case I can find

view more: ‹ prev next ›