jackbeck

I wasn’t aware that there were places that had semi-precious stones just lying around. Where are you from?

I have strongly negative connotations with rock tumblers. When I was about 8 I saw one in a store and thought it would turn regular rocks into precious stones. One of the biggest disappointments of my childhood.

I would assume that you could just search the heap by the value shown on the page to find out what the key is.

Rick Doblin recently went on a Joe Rogan podcast where he went more in depth about his experience with this.

What’s the difference between this and LogSnag?

Thanks! This sort of "deno"-fies Node, but in my opinion it's a bit smarter. With Deno, it's an all or nothing approach where 3rd party libraries still have the same access as the main application.

Hagana is still not at the stage where it's fully ready to block all attacks, there's still work to be done, but I do want to be transparent about the approach taken so that the open source community can create issues that show sandbox breakouts (as someone already has).

Eventually it'll get to the point where the security will be tight enough that having it open source won't make a difference.

Additionally, even having this rudimentary protection is still more effective at blocking generic supply chain attacks than not having any protection at all.

Thank you!

I've given this exact question some thought. I think that the only real way to make sure this doesn't happen is by not allowing any 3rd party packages into the codebase. That means any package I want to install will have to be manually copied over. Granted, that this isn't the state now in the repo since I wanted to get to a POC phase as quickly as possible, but it's something I'm going to do.

Yup, I agree with you about this. It’d be interesting to do a deep dive into a library like FingerprintJS and see what has the most weight in terms of uniqueness. Maybe getImageData is worthwhile blocking, but perhaps other APIs will increase the amount of entropy.

At the moment it’s not the default though. So people who enable this feature will, ironically be more unique and therefore more accurately fingerprintable.

The problem with a lot of these attempts at fingerprinting prevention is that they cause additional data which can be used to more accurately fingerprint users.

getImageData() is blocked - datapoint

Any detectable difference from what a “regular” browser would return is another point of entropy.

There are opinions that say that ascending is fine, but it’s fairly unanimous that descending is forbidden.

Previous discussion here: https://news.ycombinator.com/item?id=27010617

I found that on some elevators a quick double press cancels a selection.

There are sects (like the ultra orthodox) who don't use Sabbath mode specifically for this reason. They say that the added weight causes the elevator's motor to work harder thereby desecrating the Sabbath.

I haven't had an online comment resonate with me as much as this did in a very very long time.

He mentioned that the Linux-like kernel will be closed source which violates GPL

Thanks for your in depth explanation. The current structure for me is I have the main app which is responsible for previewing and making the edits to videos. This project does not include FFmpeg. I have a separate project which is the renderer. The renderer is loaded in a separate iframe which loads ffmpeg.wasm. Would this be separate enough that upon request I would only have to open source the project which includes ffmpeg.wasm?

The only way I'm making any money (very very little) is from my BuyMeACoffe page https://www.buymeacoffee.com/mastershot.

I agree with your reasoning, the issue is that it requires a fair amount of work to restructure the authentication flow. Additionally, I would have to preserve the project and migrate it to the newly created account. At the moment I have higher priority usability issues that I'm working through, but I will get to it at some point.

I'm not a lawyer, so understanding the exact implications of licensing is beyond me. My thought process behind this is that there are other (even commercial) services offering web-based video editors that use ffmpeg and are closed source. In any case I completely isolated the renderer into an iframe so in theory I could allow people to upload their own version ffmpeg.wasm if they were so inclined to.

Nothing is uploaded to the server. Everything is stored and processed locally.

No fees. No watermarks. 100% free!