justusw

Agreed, it doesn't offer a root cause analysis. Remedies are good but how do you prove that it won't happen again? Remember that these are never singular incidents but part of a bad security culture.

The author of the article linked here demoed his Onion service-based WordPress app this year at DWeb Camp:

https://onionpress.org/onionhome/

The extra trick that Brewster uses here is that by sharing your Onion service's private key with someone you trust, they can take over hosting your website when your computer goes offline.

Thanks for the reference links. I blocked RTC connections initiated on the SBI Shinsei banking log in page at bk.web.sbishinseibank.co.jp with the following custom uBlock Origin filter:

    bk.web.sbishinseibank.co.jp##+js(nowebrtc)

You can see that it works because typing `new window.RTCPeerConnection()` in the browser console prints this:

     Document tried to create an RTCPeerConnection:  undefined

Which comes from uBlock, see https://github.com/gorhill/uBlock/blob/5efb8ee4891c09720011e...

Edit: I gave a shout-out to your comment on the blog post linked in this submission. Thanks again.

Perhaps someone here knows how to make uBlock Origin block STUN/TURN connection attempts to domain names that are in its block list?

Same here with a Japanese ISP. Is this related to the AWS outage?

I've finally fixed a bug in Hugo that I've told myself to fix for a while now. The experience was pleasant and I want to share my experience with the review process with everyone.

Thank you for the link, I'm quite intrigued by myba. At least on macOS, I spend way too much time finding workarounds, even with borgmatic.

Can confirm, I've got a DKIM passing email today asking me to sell my "Illuvium". DKIM auth result header:

> Authentication-Results: spamfilter01.heinlein-hosting.de (amavisd-new); > dkim=pass (2048-bit key) header.d=autodesk.com

For this DKIM-Signature:

> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=autodesk.com; > h=from:subject:mime-version:list-unsubscribe:content-type:reply-to: > cc:content-type:from:subject:to; > s=s11; bh=...

MTA:

> Received: from ec2-3-8-140-122.eu-west-2.compute.amazonaws.com (unknown) > by geopod-ismtpd-13 (SG) with ESMTP id n5WDORJ6Taauv7FuUNA9Ug

I wonder if just their DKIM selector got stolen or someone owned their AWS accounts as well?

Chiming in to say the same.

I was there in their earlier years. Ecosia set the standard for me what an ethical company should be like.

And hey odiroot ;)

Funny that you mention it, I also went Homebrew -> MacPorts -> Nix. Homebrew had analytics and broke versions too often. MacPorts is way more stable, but some niche packages would not build well, and I had terminfo issues with tmux.

Nix allows me to override most of that, and I can share home manager config with my Debian workstation.

Thanks for your feedback. You are right. I've lowered the minimum version to Python 3.10. If you want to give it another try, the package is on PyPI now.

Good one! That's pretty much how I started and then ended up with Pomoglorbo instead. I have wanted the timer to integrate with timewarrior, and automatically time what I am working and also keep track of my breaks. Another issue is that when your computer sleeps, you'd want to keep counting seconds in the background, so time.sleep(1) will lose accuracy very quickly.

Thanks! Nice find. I've just fixed the j/k mixup and made version 2024.6.19.3 available on PyPI / codeberg (https://codeberg.org/justusw/Pomoglorbo)

This started out as a fork of pydoro and turned into a playground for dataclasses and strict mypy type checking. Some of the advanced features are

- it writes the current status into .local/state/pomoglorbo for i3status/xbar - it is very configurable, including cmd hooks to run after a Pomodoro/break finishes or starts

The layout is compact, and it runs well over SSH/Mosh/Tmux.

Apologies if this sounds completely defeatist, but wouldn’t it be better to just mostly get rid of colors in product design? That is, yes, you absolutely want to use color for branding and recognizability, but given the fact that widely deployed color models and accessibility metrics do not completely reflect the reality of human color perception, using them to convey information is just not worth the trouble.

Again, there are exceptions to everything, but WCAG 2.1 says UIs shouldn’t fully rely on color to convey information (please correct me if I am wrong), the same goes for icons.

I can see how other sectors and industries will treat this differently (think color bands on resistors or topographical maps), but for me, creating a SaaS product with a focus on accessibility, I have almost completely given up on this topic.

Charts, statistics and so on are way easier to make accessible when using good old HTML tables.

The increase in product quality is marginal when optimizing for color.

oklch.com is an absolutely fantastic resource, thank you for sharing it.

I was able to see how limited our devices are when it comes to high chroma colors and I was only able to select purple. We are fooling ourselves and our users if we keep using HSL and think it’s acceptable.

All these years using Firefox, I did not know this feature existed.

On the other hand, a few years ago I accidentally triggered PiP in mobile Safari, and it worked so inconsistently especially on YouTube when switching to another app, that I dread using it.

(Recently invidious showed how to do it properly)

Interesting. Is that the budget for only search related development or other products as well? (think Stadia, Google Plus etc)

In hindsight, the victor claiming they won because they were better than Bing et. al is exactly what I would say as well if I rigged the game.

We are so commonly assuming that Google has the secret juice that makes search work, and we are so deep in that we can’t trace our steps back and see if this statement still holds in 2023 or not!

Same goes for companies perpetuating the myth that they only hire mega-brained geniuses. That is far from the truth! Most exceptional companies are bound to regress to the mean at some point :)

As a consumer, having my freedom of choice so severely limited appears decisively anti-capitalist. Ffs Firefox please remove Google as the default.

„Competition is for losers“

Peter Thiel on WSJ https://archive.li/2014.09.12-221631/http://online.wsj.com/a...

The common advice is to negotiate prices excl tax, and that advice has been there for quite a while. Even before the new invoice system you could have your revenue taxed if it exceeds a certain amount (10mil JPY) for a certain amount of years.

What is surprising to me is how low the business side skills of most freelancers are. E.g., they don’t have a grasp of double entry bookkeeping, despite doing the blue tax declaration (青色申告). And as soon as there is a complicated payable or receivable scenario, the simple data entry freee and the like provide breaks down.

In my opinion the general skill level is pretty low. To me it is no wonder that the tax agency organizes tax lawyer led study groups, we need more of that.

Again, no surprise that people freak out over this system, but it‘s been years in the making. And the fact that sole entrepreneurs have been able to “pocket in“ the VAT so to say has always felt like a massive ripoff to me. This is especially so because the tax burden is even higher for me as a corporation here.

Being from Germany, having proper rules for VAT deduction appears as the most normal thing to me.

That sounds somewhat similar to the “I rewrote X - in Rust”, or “Why isn’t Linux rewritten in Rust?!” posts that get upvoted quite a lot, or used to.