I like to code, garden and tinker

  • 0 Posts
  • 21 Comments
Joined 5 months ago
cake
Cake day: February 9th, 2024

help-circle



  • If you are expecting a more windows-like experience, I would suggest using Ubuntu or Kubuntu (or any other distro using Gnome/KDE), as these are much closer to a modern Windows GUI. With Ubuntu, I can use the default file manager (nautilus) and do Ctrl+F and filter files via *.ext, then select these files then cut and paste to a new folder (drag and drop does not seem to work from the search results). In Kubuntu, the search doesn’t recognize * as a wildcard in KDE’s file manager (dolphin) but does support drag/drop between windows.







    • Linux Mint is based on Ubuntu, stating “Linux Mint stands on the shoulder of giants, it is based on Debian and Ubuntu.” on their homepage
    • Pop!OS is owned by System76 which is a business
    • OpenSUSE is owned by SUSE which is a quite profitable business
    • Manjaro is owned by Manjaro GmbH & Co. KG to “… to effectively engage in commercial agreements, form partnerships, and offer professional services”.

    You can dislike Canonical for whatever reasons, I would like to hear them. Saying “They are a business” is a bit disingenuous since all these distros have a business backing them and commerical interests in mind.



  • The first quote is an great demonstration of using logical fallacies to sell a point, and I am glad the article breaks down the argument. Anyone using a loaded question such as:

    Is the goal of the Fediverse to be anti-corporate/anti-commercial, or to be pro-openness?

    Doesn’t fundamentally understand the fediverse. Almost every projects goal is supporting the decentralization of these technologies. To quote the website fediverse.to:

    The fediverse is a collection of community-owned, ad-free, decentralised, and privacy-centric social networks.

    Allowing a single entity with a larger and more dominate platform, more power in the legislatures of the world, and effectively infinite times more capital to come in destroys the decentralized nature. Meta also doesn’t stand for “community-owned”, “ad-free”, nor “privacy-centric”. Meta’s goal here is pretty obviously to centralize and control the networks as much as possible, and scrap the remaining data from other instances, using the ActivityPub protocol. Meta is a corporation who’s motives are to increase shareholder value. The fact these are community ran instances is like Walmart coming in to stomp out the local grocery.







  • There seems to be a lot of FUD going around with the defederation news. The problem, as most problems seem to currently be, is the population is exploding and the tooling isn’t there to support the real growth in numbers. Beehaw has been a community for quite a while, and they were just here first so have more established communities, you can’t blame them for that. They have every right to defederate instances, especially when their main concern is being able to moderate content for their users. Each instance serves their users first, other instances lack of user moderation shouldn’t be their problem. They said they’ll open back up once they can manage the moderation work load.

    As for the fragmentation, this is really how lemmy was designed to be. There is talks of adding federated community listings and community browsers to lemmy itself to support discovery. Really, these features just weren’t needed a couple weeks ago and now they are. In my opinion, the larger communities should have communities on multiple instances. You can cross-post across instance communities as well. Hopefully in the future the fragmentation can be fixed via the use of tags and other possible organizational tools that help federation but keeps things decentralized.

    The established instances have dominance due to the first-mover advantage, which is causing the centralization at present. Overall, the experience is going to be different to a lot of reddit users due to the very nature of decentralizing things. I feel confident solutions will be found for most of these issues, and make the federated experience easier to navigate while still supporting the decentralized nature. But the fact is, this isn’t and never will be "reddit’ as it was, which was a centralized system with a single authority (the ToS and admins).


  • Often is probably a bad way to phrase it, but there is a reason TLS certificates are changed regularly. Generally this isn’t a big concern if you are the sole user and a set of known devices are used. Once you start handing passwords to others to use (such as is common in corporate environments) the problems being to show. Resetting the password is just a sure fire way to revoke access to anyone that may of had access that shouldn’t, for whatever reason.

    You are correct though, that as long as the password isn’t being used on public terminals or in areas it might be compromised, it’s generally secure.


  • This seems like someone learned about key derivation functions and applied it to passwords. So with this system, it’s stateless and no passwords are stored (encrypted or not). You need 4 things to generate passwords:

    • Your full name
    • Spectre secret
    • Site Domain
    • Master password

    This seems counter intuitive to the stateless nature, since at least one (the spectre secret) will need to be stored somewhere. For UX the full name probably would also be stored, and the site domain can be gotten via some API on password use. This leaves the master password as the only portion not stored, and on “unlocking” the database it would probably be stored on the users device for a period of time.

    This also ignores some of the requirements of websites needing passwords (some support all characters, some only a-z0-9_, etc etc). If supported, this metadata would also need to be stored somewhere. The cons of not being able to change passwords is also a huge issue, as passwords should be changed often, or replaced with keys (which you also replace often!).

    For attackers, this seems not much different than a database file. In most cases, they’ll already know two of the 4 (site domain and full name, especially in corporate environments). This leaves only the spectre secret and the master password doing the heavy lifting of security. This sounds a lot like a traditional password manager, where you have a master password, a database file, and an optional key file.

    So the process to attack a traditional database system is to acquire the needed information (database file, master password/key file) and lookup the password (site domain/description). The process to attack spectre is to acquire the needed information (full name, secret, master password) and lookup the password (site domain/description). These have the same challenges of acquiring/brute forcing the master password and key file, and are essentially the same in the eyes of an attacker.

    Overall I think passkey’s will replace passwords, or something along that line. Keys have been used for a long time in security sensitive areas, can be swapped out easily and provide much more protection than a password when large enough.