1.  

    This doesn’t address encrypted email at all. I know all the cool kids hate email and want everyone to adopt DiscordSlackJabber, but some of us think email is still importand and a crazy useful tool for all kinds of communication.

    1. 5

      Email is the only free and universaly recognised communication protocol on the internet. It has lots of problems, but is the de-facto lingua franqua of the business internet, the only way to reliably reach someone outside walled gardens.

      1.  

        Well then, we should take some of the tools mentioned, add a bit of glue, and write one! Make plugins for mutt, Thunderbird and K9, plus a client-side-only web service people can just copy-paste encrypted messages into, and people will have no excuse for not using it. :D

        1.  

          I don’t think the problem is mutt/K9 users, it’s the multitude of users using either apple, gmail, or microsoft ‘web’ email. The default way they use these services is via an android or ios app, or the provider’s web portal thing. You would need to effectively make a new client altogether, not some plugin for some proprietary interface, or convince most of them to switch to a client that allows you to make plugins/changes (mutt/K9/Thunderbird/very few others?)

        2.  

          Email is the universal internet communication protocol. PGP email is not. And the migration plan from plaintext email to PGP email, being completely manual, has also completely failed.

          I know of a couple of attempts to do automatic encrypted email. Transport layer encrypted email is actually pretty common, even GMail does it. There’s also ProtonMail’s attempt to do E2E within a webmail client, though I don’t really trust it because, you know, they could just serve me a modified client that leaked my key and I’d never know.

        1.  

          Many restaurants run reservations entirely through Web sites, using software and JavaScript that is proprietary.

          How would you fix this? Let’s say your chosen restaurant is only running the completely free and open LibreServation software. Presumably they’re not just going to give you access to modify it as you see fit.

          The freedom to study how the program works, and change it so it does your computing as you wish (freedom 1).

          I want to modify LibreServation so I always get the good table in the corner on Friday night, but I gather other users of the software will have conflicting wishes.

          1.  

            I don’t think it implies any freedom to modify someone else’s live deployment of the software. You are entitled to make a copy, modify it, and run it elsewhere, but of course the restaurant will likely just ignore that instance of it since it is not their own.

            1.  

              So, in a utopian future where nothing is wrong, how does one make a restaurant reservation?

              1.  

                It seems like you are asking why users/customers/anyone cannot modify applications at runtime that someone else is running. Allowing anyone to modify anything at runtime would allow me to, for example insert malicious code into your OS kernel whenever I wanted. This is completely different than the spirit of free software, which allows anyone to make a copy of the source code, modify it, and run it themselves/distribute it for others to copy/run. You choose what you want to run, and if you choose to run any arbitrary code on your system then that’s your choice.

                If you are speaking specifically about the javascript piece, any web developer worth their salt knows not to trust client-side code, so anything that looks bonkers would be discarded if, for example, you modified your client-side javascript thing to send “give me the best seat on the busiest day.”

                If my response is confusing or not relevant, then I have no idea what point you are trying to make, could you please rephrase it?

          1. 6

            I guess the author has not used truly horrible UIs like Collabnet. I once sent a link to a file to someone on email. It had all sorts of junk in the URL and after a while clicking on the link did not produce the intended result.

            90% of the time I’m on this page, I’m looking for the history button

            Not me. When I am on a page looking at the code, I need to see the code

            And 90% of the time, it takes me 30 seconds to find it. I would love to get a hold of the analytics for how many people star a repository after looking at a random file buried somewhere in the tree

            30 seconds is possibly an exaggeration. But it is possible that the star button is not removed because of PJAX : https://github.com/defunkt/jquery-pjax. It is probably why Github UI seems ( to me at least ) very fast

            Also missing: any way to even get back to the file

            Try the back button on your browser

            1. 8

              Try the back button on your browser

              Sad state of affairs when the back button has been practically killed off by web UIs.

              My personal banks don’t deal with it at all, though the bank I use for my company fortunately does. Lots of governmental sites break or deny when going back.

              Some sites explicitly tell you not to hit back, as if the developers never heard of idempotence.

              Wonder if this started with having html elements with a javascript call to go back?

              1. 0

                90% of the time I’m on this page, I’m looking for the history button

                Not me. When I am on a page looking at the code, I need to see the code

                You are really just saying the same thing. Both the code and the history button are under several rows of UI stuff.

                Try the back button on your browser

                Good luck. It may work on shithub for now, but many sites break catastrophically when you hit the magic destroy^W back button.

                1. 12

                  shithub

                  I don’t think you should use shithub. At best it is an annoying addition that doesn’t add anything to your statement and at worst it reduce it to a childish rant and shows you don’t want to engage in serious discussion.

                  1. 2

                    yeah let’s not do the Micro$haft stuff from the late 90s lol

                    1. 3

                      MICROS~1 is my favourite from that era. But yeah, it’s all dumb.

                      1. 3

                        I hadn’t heard that one before, and found a great explanation from a relic of an internet past… https://everything2.com/title/MICROS~1

                        1.  

                          MICROS~1

                          Ha, this one should be allowed for historic purposes.

                1. 7

                  Is there a list of rollover dates anywhere? Prior to reading this, I had known only of the 32-bit UNIX timestamp rollover in 2036 or thereabouts.

                  1. 9

                    This is the best I managed to find.

                    1. 3

                      Thank you. I added this bug to that list.

                    2. 6

                      I bet literally every firmware out there using 8 to 32-bit counters is prone to such bugs (I’ve heard people using Z80-based appliances running since late 1980’s, they just ignore the timestamp field which didn’t foresee leap years and changes in daylight savings).

                      That only happens because of the usual obsession to ship a product ASAP because “in a few years it will be either broken or out of warranty”.

                      1. 2

                        Well, Y2K was one I guess.

                      1. 1

                        That PinePhone dev kit looks strikingly similar to Purism’s Librem5 dev kit…

                        https://puri.sm/wp-content/uploads/2019/01/figure18b.png

                        1. 3

                          They’re both rectangular boards sporting a battery holder and an ARM SoC, that is about as far as the comparison goes. The rectangular shape goes with the domain of screen-dominated phones, the battery holder is just what you’d expect on a test board for which it doesn’t make sense to create a bespoke battery.

                        1. 23

                          Put me squarely in the don’t understand the webcam stickers camp. What’s on my screen is 99% more likely to be interesting than what’s in front of it. Like, why try to extort me with a video of me picking my nose when you can just remote drive my browser and empty my bank account. And then there’s the whole microphone thing. It’s hard to imagine a threat model where webcam stickers are relevant.

                          1. 48

                            I was squarely in the same camp… until WebEx started my video on a call when I didn’t want it to, and a nice view of me (and my wife!) in bed wearing pyjamas (I was dialling in from 6 timezones ahead to listen to a town hall meeting) was projected on the wall for everyone to enjoy.

                            I’m not worried about evil malware, I’m worried about WebEx ;-)

                            1. 19

                              I had that happen with google hangouts while I was listening to a call on the toilet. That was a bad moment. With “continuous deployment” this is bound to happen unpredictably.

                              1. 9

                                Yup, IMO badly-written conference calling software is a much more realistic and everyday threat than teh evil hackerz. WebEx and Hangouts and other systems seem to be constantly changing their UI and behavior, yet always seem to really want to broadcast video. And then sometimes pop up some other modal dialog blocking the buttons to stop it. It’s worth it IMO to definitely never ever send out video unless I’ve explicitly okayed it first, no matter what some marketing manager thinks would help them increase their engagement by 1%.

                                1. 6

                                  I was fortunate enough to be dressed when it happened to me. Conference software has the worst defaults.

                                2. 42

                                  My threat model isn’t malicious attackers as much as incompetence. I use webcam covers in case (1) a program that I trust has some mindblowing lapse in competence and turns on my webcam unexpectedly or (2) I fat-finger a video call button without noticing.

                                  1. 4

                                    Ah, I hadn’t thought about that too much since I rarely use such software. Also, I think this thread is the first time I’ve seen someone mention that. It’s always the evil hackers that get blamed instead.

                                    1. 2

                                      Do you use a webcam cover on your smartphone too?

                                      1. 5

                                        I removed the front camera in my phone. It was useless for me, and I didn’t like the idea of never knowing if some app was using it.

                                      2. 1

                                        But what’s the big difference compared to disabling the webcam in your BIOS settings?

                                        1. 18

                                          With a piece of electrical tape over the camera I can “re-enable” it in seconds without rebooting for the times when I do actually need it. Disabling it in the BIOS is a good option if you know you’ll really never need it though.

                                          1. 1

                                            Fair enough, but for someone who never needs it, this doesn’t really change a lot…

                                          2. 14

                                            Stickers/covers are simple in every aspect of their operation.

                                            1. 4

                                              Exactly! Most people’s understanding of stickers/covers allows them a fairly high degree of confidence that it’s working. You can hold the sticker up to the light to confirm that it’s opaque to visible light and you can see that it covers the lens. You can also run a camera application to see what it can see. By comparison, it is incredibly difficult to confirm that a BIOS setting does what it says it does.

                                        2. 14

                                          It’s hard to imagine a threat model where webcam stickers are relevant.

                                          Porn and whacking off to it. I believe one Black Mirror episode was centered on that. I think blackmail on such footage is a credible threat even if you’re not into kinky/illegal stuff. And even if not anything as sleazy as that, there’s something quite disturbing in a random person essentially being inside your house looking around with you having no clue about it.

                                          1. 4

                                            The real threat seems to be people worried about the threat, given all the “I caught you visiting a naughty site, you know which one, pay me bitcoins” spam I get.

                                            1. 4

                                              You do understand that there’s a pretty big difference between the two situations, right? Someone leaking that you visited a naughty site isn’t really comparable to someone leaking pictures or video of you.

                                              1. 0

                                                The scam threat obviously includes “I hacked your webcam” blah blah. Sorry for not posting the entire spam here.

                                                1. 1

                                                  Right, that makes sense. I’ve never actually read such a spam e-mail; if I get any, they just end up caught in the spam filter.

                                                  You would presumably take the threat more seriously if someone contacted you with some actual proof, such as showing an actual image of you naked taken from your webcam?

                                                  1. 1

                                                    I’ve had this email a few times, and they spoof the sender address to make it look like it came from your own email address. This at least gives the illusion of them having hacked you specifically.

                                              2. 2

                                                In a lot of the country, getting caught viewing porn can hurt their career or ability to run for office. It’s hypocritical given lots of people in those same areas watch porn. It’s a reality, though. This is also true for lots of other habits or alternate lifestyles cameras might reveal.

                                                1. 4

                                                  In some countries, any consumption of anything deemed immoral can have even more devastating consequences. I know a guy from a small Persian Gulf country — a son of a late imam too — who was scammed for a few thousand euros recently by a con-artist he found on Grindr.

                                                  Losing a few thousand euros is not the harsh consequence in this scenario.

                                            2. 10

                                              I mostly agree, but I don’t think you should need to choose. I’d prefer HW switches for microphone, webcam, wireless and allowing only whitelisted HID device instances being active.

                                              As I see Microsoft and Apple (even more so) have started to realize that there is a user demand for more privacy. The next windows update will notify you when there is an active microphone recording going on, for example. I think this is not a bad direction, but too little too late for my taste.

                                              Also I think it is a design flaw that in current windows versions it is still so simple to globally register every keystroke, and that in Windows UWP, and Android there are so many grouped capabilities, and still you have to allow the app to use a capability in advance, or for now and for ever to use these privileges…

                                              I don’t have much experience with Apple products.

                                              Edit: regarding webcams:

                                              You need to take into account that the line between digital and psychical life is getting thinner and blurrier. I often leave my machine running when I leave home, as it is energy efficient, and I might need to log in remotely, or a download is running in the background. A malicious actor could get information about my physical whereabouts, or about an opportunity for home invasion for example, should they deem it profitable.

                                              1. 1

                                                started to realize

                                                This is hardly new. Apple’s 2003 external webcam model, the iSight, included a manual iris shutter/switch that rotated to both disable the device and physically obstruct the camera. Fashions change.

                                              2. 4

                                                There’s a mix of bad things people are doing right now and some things they could do with it that they’ll figure out eventually. I’m not writing about the latter since I prefer them to be delayed.

                                                For now, I’m for being able to totally disable inputs, specific wireless, etc for a simple reason: no access by default until it needs it (POLA). No power by default until it needs it if available. I can try to guess every bad thing that can happen with risky peripherals. Or I can just shut them down when not using them. Covering my webcam is easy way to shut down its vision. My old laptop had a wireless switch, too. My old speakers didn’t act up when I had to turn something down quickly since the knobs actually worked. Killed power with last turn.

                                                On a related note, I also buy old, dumb appliances without smart anything. They also last longer, are cheaper, and have no smart anything for people to hack. If there’s a risk from hackers, just eliminate it where it’s easy. Then, don’t think about it again.

                                                1. 3

                                                  Funny, I had never even thought of tape over the webcam as a security measure.

                                                  For me it’s entirely there to make sure I’m not on camera when I join meetings unless I explicitly want to be.

                                                  1. 1

                                                    If you buy a new laptop there is no choice between with or without webcam. I don’t need it and never use it ergo I put it sticker on the camera, a simple and pragmatic solution.

                                                    1. 1

                                                      Well someone can take over your bank account and take your photo.

                                                    1. 5

                                                      Well that’s a title that gets right to the point.

                                                      1. 0

                                                        AKA, clickbait.

                                                        1. 2

                                                          I wouldn’t call that title clikbait. It definitely appeals to the human prurient interest in the private sex lives of famous people like Jeff Bezos, but also accurately describes the article and the article itself is solid and informative.

                                                          1. 0

                                                            The title has been changed since my comment was posted.

                                                            The original was “How Bezo’s dick pics might’ve been exposed”

                                                      1. 14

                                                        Also: never speak at a conference. People will see that you are at the conference and not in the office.

                                                        1. 7

                                                          In fact, never leave the office. People might see you in the parking lot, in the store, at home, at a concert, etc and know you aren’t in the office. If you are like the author and crawl around in the back country, don’t even do that since many national forests/parks/wilderness areas (at least in the US) require you to register at a ranger station or at the trail head, and now the Forestry Service workers/rangers know you aren’t in the office.

                                                          If you are a manager of people I implore you to enforce the “if you’re gone be gone” policy with your team.

                                                          In all seriousness, this is actually good advice.

                                                          1. 1

                                                            Yeah, which says nothing about your family life or travel plans. Yet I wouldn’t put up a billboard next to my house announcing my time at a conference three weeks from now.

                                                          1. 6

                                                            Author here. I’m here to answer any question regarding features or implementation.

                                                            1. 1

                                                              Thank you for putting this in AUR and making it easier for Arch folks to install! I was trying to use it with the shell companion example in the readme, and it as really slow indexing(?) things and displaying them. (e.g. sometimes 1-2 seconds per keystroke). I use zsh as my shell, and the disk is a really fast nvme.

                                                              1. 3

                                                                Actually the AUR package was made by me after finding the project through this post. :p

                                                                1. 1

                                                                  Ah, well thank you! (Sorry I missed that, I didn’t look too closely to see who submitted it!)

                                                              2. -1

                                                                So, why did you name your program dick? It makes me nervous about using it.

                                                                1. 1

                                                                  Well… One has to have some fun… That was by far the proposal which got most votes when I proposed it on my chat where most users are French speaking…

                                                                  But I’ll remove the “pronounced b-root” part and let people pronounce it as they feel it.

                                                                  1. 1

                                                                    broute though means browse, so it seemed quite fitting. I didn’t even think of the old fashioned “biroute” when I read “broot”.

                                                                    1. 1

                                                                      Well, the author edited it out of the Readme, and the command line help too. A Good Thing, because it’s a cool project.😎

                                                                1. 12

                                                                  That’s all well and good, but I think it goes against the usual flow of using vi, which (to me) feels optimised for opening, editing, closing, running other commands in the shell, opening again and so forth.

                                                                  Emacs, OTOH, feels much more like it’s intended to be opened once, then used for a prolonged period of time (an entire login session, perhaps). It has a rich set of buffer-manipulation commands which assist with this, as well as many interactive modes which perform tasks vi users would probably do from the shell (browse the web, say, or read email).

                                                                  There’s nothing wrong with trying to live in vi, really, but there’s a lot of programming required to bring it the features found in Emacs — and much of that work has already been done for Emacs, and if it hasn’t been, well, elisp is a much nicer language than Vimscript.

                                                                  I use vi almost every day, but I live in Emacs. For me, at least, living in vi would feel odd.

                                                                  1. 6

                                                                    Though my workflow in vim is as you described, that is merely a personal choice. Vimscript is no longer the only option in mainline vim, and, if you require even more power, the neovim fork aims to allow any language for plugins.

                                                                    And much of this usability work has already been done. I am currently in limbo between emacs and neovim; with org-mode drawing me in from one side, and all of my fuzzy-file-finding and project navigating plugin tools pulling me from the other. It’s just as much “programming” to set these things up in emacs.

                                                                    1. 2

                                                                      all of my fuzzy-file-finding and project navigating plugin tools pulling me from the other. It’s just as much “programming” to set these things up in emacs.

                                                                      Do Helm and Projectile not do the trick? Prelude packages them both up nicely.

                                                                      If you prefer the vi style, I hear excellent things about Spacemacs.

                                                                      1. 3

                                                                        I am more saying that I already have that stuff set up in neovim, and it will be just as much work to figure it out in emacs. EDIT: I have tried spacemacs, but it feels heavy-weight and gives me option paralysis.

                                                                    2. 4

                                                                      I have a friend who uses something in between: He uses ^z to get back to the shell and fg to return to vim. He has multiple vim instances in the background sometimes. Essentially he uses shell jobs instead of vim buffers.

                                                                      1. 2

                                                                        Binding ^z to fg might have been the single most impactful thing I ever put in my zshrc.

                                                                        function rebind-z() { fg }
                                                                        zle -N rebind-z
                                                                        bindkey '^Z' rebind-z
                                                                        
                                                                        1. 1

                                                                          I do this instead of using vim buffers, I think because I spend most of my time in the shell and not vim.

                                                                          Line for line, I write just as much zsh code as anything else.

                                                                        2. 3

                                                                          I’m currently a heavy vim user, and have made everything (browser, window manager, tmux, shell, etc) use vim-like bindings. This is how I ‘live in vim’ (though not actually always in vim). I’m really curious what your workflow looks like using emacs + vi though. Getting to the point I am at now with everything set up this way was not easy, but on the other hand, using emacs would require me to unlearn a ton of old muscle memory and learn a ton of new muscle memory.

                                                                          1. 4

                                                                            Take a look at Spacemacs – truly the best of both worlds, plus a mind-opening leader key menu (the “Space” part).

                                                                            1. 1

                                                                              I’m really curious what your workflow looks like using emacs + vi though.

                                                                              Honestly, I’m a bit embarrassed by it: I ought to use emacsclient instead of vi (and in fact on one of my machines I do). Instead, I tend to use Emacs to edit code, documents (LaTeX or Org mode), browse the web (ewe), read documentation (woman), interact with git (Magit), handle projects (Projectile), interact with Common Lisp (SLIME), work in a shell (Eshell) and so forth.

                                                                              Meanwhile, I use vi to do quick edits to line-oriented config files, e.g. stuff in /etc, in part because I have an old habit of typing sudo vi /etc/foo rather than editing sudo::/etc/foo with TRAMP (I keep trying to switch completely, but … old habits die hard).

                                                                              I would suggest to everyone to not do as I do, but just learn Emacs and use it for everything. If you want vi’s almost certainly better text-manipulation language, then use Viper mode, e.g. as provided by Spacemacs.

                                                                            2. 1

                                                                              As someone who uses vi for spot-editing and emacs for project work, I work like you.

                                                                              Emacs, OTOH, feels much more like it’s intended to be opened once, then used for a prolonged period of time (an entire login session, perhaps).

                                                                              With tmux, for me emacs is open until unplanned server reboot or emacs version upgrade.

                                                                            1. 5

                                                                              Regarding the hardware, what makes me hopeful is that the people behind Rasperry Pi are members of the RISC V foundation.

                                                                              1. 3

                                                                                Isn’t RISC V a competitor to ARM more or less? There don’t seem to be any complaints about ARM in the article. It’s the non-ARM cores that are problematic.

                                                                                1. 1

                                                                                  Isn’t RISC V a competitor to ARM more or less?

                                                                                  Well it’s a competitor, with the selling point that it’s had an open-source ISA, which seems to counter the point that “The real brain of the Pi is not open source”.

                                                                                  1. 6

                                                                                    “The real brain” refers to the GPU and its binary bloms, which would remain a problem even if the CPU’s ISA were switched from ARM to RISC-V.

                                                                                    1. 1

                                                                                      Not necessarily. There are GPUs that have open source support for 3D acceleration.

                                                                                      1. 2

                                                                                        What is their relationship to the RISC-V ISA?

                                                                              1. 15

                                                                                I’m at FOSDEM, and today saw a few stands with the PineBook laptop and the Rock64 SBC, including Pine64’s own stand. They have no binary blob firmware and open source bootloader. I have yet to try the hardware myself but it looks like a nice alternative that at least in part addresses the issues in this post.

                                                                                1. 8

                                                                                  I’m curious to know more about blob free Rock64. My own experience showed distributions built with blobs were the only ones with decent graphics acceleration. Maybe some progress has been made since I wrote up my experience in June 2018 and I should look again.

                                                                                  1. 2

                                                                                    I’m curious to know more about blob free Rock64

                                                                                    Looks like this, and most(?) Pine products use the Mali GPU. There’s no Mesa support for this yet, but a big patchset for adding initial (but non-functional) supprot for Mali GPUs hit the Mesa mailing list last week:

                                                                                    https://lists.freedesktop.org/archives/mesa-dev/2019-January/214282.html

                                                                                    ARM GPU support on Linux is slowly getting better.. The most promising is Etnaviv (reverse engineered Vivante GPU driver), and Librem5 will use this GPU. But most companies still seem to favor the proprietary blob approach.

                                                                                1. 4

                                                                                  Interesting as he mentions x200 being ‘too big’.

                                                                                  After doing system administration for many years I would NEVER change that X200 7-row ThinkPad keyboard to that caricature of keyboard …

                                                                                  I will stick to my T420s/x220 for YEARS … until used ThinkPad 25 will get a reasonable price for used unit.

                                                                                  1. 4

                                                                                    As someone who uses a newer ThinkPad’s keyboard daily, (X230 Tablet) I honestly have little to no complaints about it. The keys are loud and tactile; the layout is different, but I’ve gotten used to it quickly. Of the ThinkPads I have (701cs, T42, X61 Tablet, X201) I find the X61T’s to be best, but the X201 and X230T are fine as well. (The T42 and 701cs keyboards, on the other hand, are horrid. the T42 feels numb and the 701cs get stiff and otherwise age like milk.)

                                                                                    I find the hysterics X220 owners go through over the keyboard to be hilarious because it’s so overblown. The X220 and X230 are basically identical otherwise, and both are the nadir of ThinkPad build quality - my X230T definitely feels cheap compared to the X201, and some T420s I’ve tried feel the same. (From what I’ve heard, since xx40 and on, they got better build quality wise, though they’re even more controversial design wise. I suspect that to be a non-problem as well.) In retrospect, I kinda wish I got a Let’s Note, MacBook, or Surface instead of a lot of the ThinkPads I’ve bought, but used ThinkPads are both cheap and a known quantity, so that’s what I often ended up with.

                                                                                    And I do find my X201 and X230T to be a bit on the big side. I like smaller machines, but they’re hard to come by in the West.

                                                                                    1. 2

                                                                                      I modded my X230 to use a X220 keyboard. Best of both worlds.

                                                                                      1. 1

                                                                                        Any ‘howto’ on that? :)

                                                                                        1. 1

                                                                                          I followed this guide: http://www.thinkwiki.org/wiki/Install_Classic_Keyboard_on_xx30_Series_ThinkPads

                                                                                          There’s a project for building a modified EC firmware too that gets almost all the keys working as expected. If you don’t do the EC mod, most keys will still function properly. There’s a table on the wiki page that compares the two approaches.

                                                                                          1. 1

                                                                                            Thank you very much for that.

                                                                                      2. 1

                                                                                        I have used ThinkPad W530 with the ‘new’ ThinkPad layout for about 3 years daily. Still not got used entirely to the HOME END INS DEL layout … after that I got ThinkPad T520 with 7-row classic ThinkPad keyboard and finally felt like at home again, its just so natural to have the INS/DEL HOME/END PGUP/PGDOWN setup, especially if you also use large external keyboard daily.

                                                                                        I also used Macbook for about a year but their layout also not suited me at all.

                                                                                    1. 4

                                                                                      Hardware (including ‘fake’) RAID is the ultimate eater of disks/data. It might work, and it might work for a while, but almost all implementations are different. This means that if you have disks using RAID implemented on controller A, it might/will not work on controller B (even at times when both are made by the same manufacturer..)

                                                                                      Software RAID (e.g. mdraid) at least gives you far more options for recovery, and the CPU overhead isn’t that much.

                                                                                      In any case, don’t use any RAID as the primary source for backups..

                                                                                      1. 1

                                                                                        Yikes, only one backup strategy??

                                                                                        And non-native backups?

                                                                                        How could it possibly go right?

                                                                                        In the day and age of OneDrive, dropbox, google drive how could that not factor into another layer of backing up work?

                                                                                        What is wrong with the Windows backup tools that use NTFS volume snapshots creating easy to restore snapshots?

                                                                                        Use your OS’s best practices backup solutions! When you get unnecessarily complicated for no apparent reason, things are always going to go wrong.

                                                                                        Apple had it right with the whole time capsule thing, but Apple being Apple had to abandon that.

                                                                                        1. 5

                                                                                          In the day and age of OneDrive, dropbox, google drive how could that not factor into another layer of backing up work?

                                                                                          These things are expensive (per GB), require proprietary (and sometimes unreliable clients), and do not support encryption without effort on your part. That said, it doesn’t excuse OP. There are other solutions, which still require effort, but are more suited for backing up large amounts of data.

                                                                                          1. 1

                                                                                            I just setup my own nextcloud and it’s amazing how easily I moved away from Dropbox as main cloud storage (I still use it as 4th backup for certain stuff).

                                                                                          2. 2

                                                                                            Part of the problem might be the age of the initial solution. He mentioned he last designed the backups twelve years ago.

                                                                                          1. 13

                                                                                            listen to everything and ignore 90% of it

                                                                                            This is probably good advice. I’ll apply it to this article.

                                                                                            1. Avoid comments.

                                                                                            This varies heavily by language. If the language features documentation strings, as Common Lisp does, then it’s fine advice and that’s how I operate; if it lacks them but still has many first-class structures for documenting intent and whatnot, such as Ada, then I’ll write less comments, but perhaps one or two where I think it’s fine.

                                                                                            It’s just my preference, but I’ve never been fond of names such as getUserAndAPITokenFromLocalStorage and would rather read the comments, but I’d rather avoid reading JavaScript at all, so this could be seen as a superfluous aside.

                                                                                            1. “Never use a plugin you would not be able to write yourself.” (credit to Jamis Buck).

                                                                                            I don’t see any issue with this advice, amusingly. This seems like programmer common sense, perhaps, or should be. I’d prefer to use libraries for what I don’t want to write, not what I can’t, such as implementing a complex protocol I need to interact with but don’t otherwise care about.

                                                                                            1. Use simple tools.

                                                                                            Without any malice, this is the worst advice in the article and I vehemently oppose telling new programmers this. Ostensibly, the computer is a machine that is to reduce work on the human and aid in tasks; this advice runs counter to that. Firstly, Emacs is just one tool that enables one to use a remote machine with local tools with its Tramp mode; there are undoubtedly others. Secondly, I’m of the opinion that a programmer can and should gradually replace tools they use with ones they’ve written themselves, although I understand others would see differently. I’m doing this in my own way, gradually, but at least I’m making some progress.

                                                                                            I don’t in any way support the idea that whatever dumbassery the UNIX or Microsoft gods decided decades ago is the baseline and anything on top of that is superfluous. That is stagnation. That is awful.

                                                                                            About 10 years ago, I remapped Caps Lock to Ctrl on my keyboard. I like that position so much better. Now I can’t use anyone else’s computer without either getting frustrated or going into their settings and remapping the keys on their computer. Is my enjoyment worth this? Probably not.

                                                                                            Is this a work machine you’re using for hours every day or a toy? Would, in any other setting, a professional who spends years or decades of his life doing something be faulted for customizing his tools to work best for him and remove strain or friction?

                                                                                            I suggest one reads what Erik Naggum had to write about this general idea: https://www.xach.com/naggum/articles/3065048088243385@naggum.no.html

                                                                                            1. Working code is good code.

                                                                                            I’d argue that working isn’t the only qualification for good code. Good code is eventually finished and requires no further changes to accomplish its purpose elegantly.

                                                                                            1. Don’t be afraid to delete code.

                                                                                            I have no argument here, really.

                                                                                            1. Prefer data.

                                                                                            This isn’t bad advice, with how it’s phrased. I suppose I would’ve used this: ``Show me your flowcharts and conceal your tables, and I shall continue to be mystified. Show me your tables, and I won’t usually need your flowcharts; they’ll be obvious.’’ –Fred Brooks

                                                                                            1. Always do the hard thing.

                                                                                            To me, this is the most original advice in the article, but perhaps I’m simply differently read. I’d be wary of a system that is poor at the outlook, though, such as tens of thousands of lines of some poor language, or really tens of thousands of lines of anything.

                                                                                            This sums my thoughts on the article; perhaps someone will find this a pleasant read on its own or a good critique. I’d be glad for my articles I submit here to receive the same attention, certainly.

                                                                                            1. 3

                                                                                              “Never use a plugin you would not be able to write yourself.” (credit to Jamis Buck).

                                                                                              I don’t see any issue with this advice, amusingly. This seems like programmer common sense, perhaps, or should be. I’d prefer to use libraries for what I don’t want to write, not what I can’t, such as implementing a complex protocol I need to interact with but don’t otherwise care about.

                                                                                              This literally goes against human nature, this recent Human Brian podcast[0] explores why humans depend on others before them to solve/understand things that they can build upon.

                                                                                              My immediate reaction to this comment though was: if you wanted to make a new car seat, would you (or do you need to) know how to make the engine, frame, wheels, etc? I would argue “no”, and that depending on systems you don’t understand is nominally ok. Another silly example: I depend on my local grocery store to sell me food, without me knowing about how to make most of it myself..

                                                                                              1. https://www.npr.org/2019/01/11/684435633/how-science-spreads-smallpox-stomach-ulcers-and-the-vegetable-lamb-of-tartary
                                                                                              1. 2

                                                                                                To “be able to write something yourself” covers a very wide range of possibilities. Do I need to be able to write it myself in a reasonable timeframe? Do I have to already have the knowledge to write it now, or can I take time to study it when I actually need to write it? Given enough time, I should be able to learn most things, so that would actually rule very little out.

                                                                                                I think a more useful focus is “Can I fix problems in a dependency if I discover them?”. For me, this means preferring open source dependencies, as without the source you are at the mercy of the vendor (who may cease to exist). It also means preferring dependencies with simple, well designed code, which I should be able to understand with a little studying, but without necessarily having to have the expertise right now.

                                                                                              2. 2

                                                                                                I really appreciate your thoughts, even though we’re likely to disagree on many things. I only want to reply to one thing – about the keyboard. I remapped Caps Lock to Ctrl on every machine I use, including my work machine I use for hours each day. If I could go back 10 years and tell myself not to, I would. I use other people’s computers a lot more than most people, though; I pair-program with students on their computers all the time.

                                                                                                I really like your opinion that programmers should replace tools with ones they’ve written themselves. It’s bold and solid advice.

                                                                                                1. 5

                                                                                                  I pair-program with students on their computers all the time

                                                                                                  Yeah, that’s a bit of a special case. I use other people’s computers… approximately never, so I’m very happy with the Colemak layout and a CapsLock that acts as both Ctrl and Escape and shifts that act as parens on their own.

                                                                                                2. 1

                                                                                                  Upon reading blog post’s point 3. I got the “somebody is wrong on the Internet” rash.

                                                                                                  Thank you for posting a soothing response, I lathered it in generously.

                                                                                                  1. 1

                                                                                                    You are right about 3.

                                                                                                    If we would not progress with the tools the recommendation would still be “use sh instead of the fancy korn shell or crazy bash”.

                                                                                                    The key is - as always - balance. Be careful about the bleeding edge but don’t limit yourself to the largest common denominator just to be perfectly safe all the time.

                                                                                                  1. 3

                                                                                                    Very interesting write-up but the problem seems to be that the author wanted to detect keyup events over SSH.

                                                                                                    If you are doing something like controlling a robot in real-time, you probably want to setup some sort of TCP connection where you make your own tiny protocol and handle input however you want. Not too hard and actually much more flexible.

                                                                                                    1. 1

                                                                                                      I’ve seen a few robot control implementations that even use websockets.

                                                                                                    1. 1

                                                                                                      This does not seem to be associated with pycon (next US showing in Cleveland). What is this show, and 1) why should folks apply to speak, 2) why should folks attend? (I wasn’t able to easily find info about the event..)

                                                                                                      1. 7

                                                                                                        I am in total awe of this person’s free time!

                                                                                                        1. 2

                                                                                                          That, and dedication (and attention to detail for that matter)! Seems like debugging a misplaced minecraft block thing in this entire system would be beyond annoying.

                                                                                                        1. 1

                                                                                                          2FA is something harder to steal than the password right? I mean it’s really only works in theory to me.

                                                                                                          1. 6

                                                                                                            You’re misunderstanding the attack. You aren’t stealing 2fa. You are breaking into an account and registering your device for 2fa, establishing a login session and not sending the 2fA code.

                                                                                                            Then if the user resets their password, this vulnerability lets you send the 2fa code without the new password to log in.

                                                                                                            1. 2

                                                                                                              If I understood the article correctly, you would only have one opportunity to gain access to the account, in which case you would need to set up the trigger for the attack again (e.g. do something to make user reset password)?

                                                                                                              It still seems like a weak attack though, because it requires gaining access to their account in the first place. So it would only work on 1) accounts where the password was known and 2) accounts where 2FA was not already enabled. In any case, you have access to their account, so it’s basically game over already?

                                                                                                              Or, do I have it all wrong, and you would basically always trigger the attack regardless of what the user does, as long as they do not remove your 2FA device?

                                                                                                              1. 12

                                                                                                                In the real world, account theft may be game over for your threat modeling as an individual, but it’s not the end of the user’s interest in their account, nor can it be the end of the modeling for the security teams who design these precautions. An account at one of the large tech companies may have a lifetime of emails and photographs in it. It may have digital purchases and control of cloud resources attached to it. It may be the recovery email for myriad other accounts held by smaller companies whose customer service teams are non-existent or unhelpful. So it does matter that the correct user has a chance to get back in and kick the attacker out, after an account is stolen.

                                                                                                                With that background… The point of the attack is that it’s a way for an attacker who has already broken in to make sure they aren’t kicked out. Per the above, this is a real and important concern and it’s a situation that happens every day. Companies have recovery teams which try their best to make sure, after a compromise, that the real owner recovers the account. It’s difficult work to verify that it’s the real owner attempting recovery and not the thief; some portion of these recoveries succeed and some fail. If this attack finds widespread use, we can safely assume that all the recoveries will fail, at least until it’s fixed properly.

                                                                                                                The attack, as described, doesn’t even depend on whether the 2FA device is removed or not. It’s sufficient for the attacker to have been able to add it.

                                                                                                                1. 2

                                                                                                                  I appreciate the detailed explanation, I totally see how this is a much bigger deal than I originally thought after reading the blog/article.

                                                                                                                  1. 3

                                                                                                                    Very welcome. I recognize it’s not a situation everyone thinks of if it’s not pointed out.