1. 4

    I really appreciate that the misuse of “enumeration” is pointed out. See previous thread:

    https://lobste.rs/s/ach1fc/openssh_username_enumeration#c_4gcwqw

    1. 1

      The idea of enumeration, in my mind, seems to mean: emumerate all possibilities and filter out if some element is not valid. This results in an enumeration of all valid elements.

      Some might interpret it to mean: enumerate only valid elements. This is equivalent. Consider the extreme case: if there are no valid usernames (i.e. fake SSH servers that disallow any username) then the method still enumerates all possibilities but never finds out any true username. Vacously, this enumerates all valid usernames.

    1. 2

      Quote from Wikipedia:

      An enumeration is a complete, ordered listing of all the items in a collection.

      Could someone enlight me on this? What the Article describes doesn’t seem like “complete listing”.

      1. 3

        To enumerate can also mean “to build a list” which is closer to this usage, but I’d agree it was used imprecisely.

        I’d prefer calling this a username oracle attack!

        1. 4

          A couple decades late I think. Guess and check attacks have been called enumeration for quite a while.

          1. 2

            it’s never too late to tilt at windmillsencourage precise speech!

            Legitimately though - good to know this is common parlance in the security community.

          2. 2

            Given enough time (possibly heat death of the universe scales) this method could create a full enumeration.

          3. 1

            It could be seen as a complete listing, if the “collection of usernames” isn’t interpreted to be the collection of all usernames the server has, but rather all usernames the attacker cares about.

          1. 4

            The named issue (known and fixed for 5 years now) does reduce the brute-force safety of the password to md5. If your password has enough entropy, you are still safe. “Worse than Plaintext” is misleading clickbait.

              1. 4

                ActivityPub strikes me as the invention of people who believe that the internet = HTTP, and who know about JSON but not RFC822.

                Some of the example message bodies just look like JSON-ized SMTP headers, “inReplyTo” etc. It looks like it has a MIME-inspired “mediaType” attribute too, but does it allow only one media type per message?

                Can someone who is more familiar with ActivityPub give me the sales pitch about why existing protocols don’t suffice?

                1. 6

                  RFC822 is ASCII only to begin with one of the biggest limitations of email related “standards”.

                  Some 6.5 billion people around the globe use non-ascii charecters, and old standards only have layers of hacks upon them to support their usecases to some extent.

                  Why not create new standards from the ground up for the current usecases? I’m not interested in ActivityPub curently, but I have some experience with email and related technologies, and it badly needs a redesign. It won’t happen as none of the parties capable to organise it is interested in it.

                  1. 4

                    My uninformed guess is that with the slow decline of email, there are more & better JSON parsers than there are MIME or email parsers. I would have made the same choice, but my reason would have revolved around JSON’s ability to store structured data, for future flexibility.

                    1. 2

                      HTTP Headers are the same format like MIME headers, browsers already have everything one would need for mail. Multipart documents (email attachments) are the same format like HTTP file uploads via form. There is a number of headers both share.

                      1. 1

                        I think it comes down to tooling. Protocol A could be 10x as widely deployed as protocol B, but if protocol B has better libraries, I’ll give that more weight in my decision of which to use. I had to assemble a multipart MIME message for work a few weeks ago, and everything about the experience was inferior to “create a data structure and convert it to JSON”.

                        Coders are likely to pick the easiest path, if everything else is roughly equal.

                    2. 1

                      No reason, really. It’s a marketing effort, mostly.

                      1. 1

                        SMTP is forever tainted by spam. ISPs like to block ports, spam filters like to eat mail from new unknown servers, etc.

                        Giving a pitch for Webmention instead of ActivityPub: Webmention requires the sender to publish an html page that actually links to the target URL. You can be stricter and require a valid microformats2 reply/like/repost/bookmark. That already stops old school pingback spam. For stronger protection, there are clever schemes based on “this non-spam domain you linked to has linked to me”.

                    1. 9

                      You can form your own opinion here: https://github.com/xtermjs/xtermjs.org/pull/54

                      Contributors feeling entitled to have their patches merged is indeed an recurring Problem in OSS.

                      1. 10

                        This replier (not sure if he is a maintainer or not) approaches this issue perfectly, IMO. He is patient and calmly explains the reasons why projects won’t merge PR’s simply because they exist and pass all checks/tests. The person making the PR really comes off as entitled, and seems to conflate saying “no, we won’t merge this PR” with impoliteness.

                        Thanks for linking, it helps with the context of this post.

                      1. 5

                        I’d like to point out that this is done by the same person who created the Contributor Covenant, which was intended to embed feminist views into Open Source projects.

                        This is likely an push with political intentions.

                        1. 1

                          Can you please define “political”, as used here and in your previous thread about how you choose software?

                          I ask because “political” has a number of meanings. Do you mean that it has to do with ideology, or that it has to do with intra-commiunity factionalism?

                          1. 8

                            The person has specific beliefs about what thoughts and actions should be allowed in general in terms of politics. Specifically, “social justice” with all its internal contradictions, sophism, and anti-white, anti-male behavior described here. Their religious-like doctrine is to be enforced everywhere in every project, company, college, and government if they can make it happen. Even a disagreement outside the organization is grounds for being ejected from the organization. That person also shows up in FOSS projects with crowds of people trying to force them to adopt their political stance and overly-broad Codes of Conduct flinging insults at them if they don’t do it. They also do this while giving nothing in return either in terms of code or paid developers for demands such as ejecting core contributors.

                            So, that person is on a crusade to force a specific brand of politics on everyone regardless of who they are. Anyone disagreeing will be hit with labels and social pressure to be forced to conform. They might be white/male/straight, a minority member with different views… anything. It’s not allowed since they know what’s good for us all. They will also be the judge, jury, and executioner. I think not.

                            1. 0

                              So you have managed to produce a long and useless diatribe against… what? SJWism or something? in which you use the term I asked you to define several times without defining it. Thanks, that’s exactly what I was looking for /s

                              1. 3

                                I linked to an article that itself has many examples of the specific brand of politics the author of the document pushes. It would be used to silence everyone from white males to black women to trans people who disagreed in any forum on anything that was dogma to author’s group. That’s what author made a career out of doing already. I block it for that reason.

                                1. 2

                                  That article has a lot of issues. To exemplify (in other words, most of the article is wrong, but this is the part I’m using to illustrate that):

                                  Everybody is racist. And racist people deserve to lose everything they have and be hated by everyone.

                                  This is overly simplistic and the author knows it. “Everybody is racist” and similar phrases are used as an urging to examine one’s behavior and epistemology for racist influences, not an injunction to hate everyone.

                                  Also, citation needed on the author of this “manifesto” being some kind of aspiring evil dictator…

                                2. 1

                                  I linked to an article that itself has many examples of the specific brand of politics the author of the document pushes. It would be used to silence everyone from white males to black women to trans people who disagreed in any forum on anything that was dogma to author’s group. That’s what author made a career out of doing already. I block it for that reason.

                                  1. -1

                                    Duplicate.

                          1. 2

                            high cost by abstraction layers (like Nix)

                            This is the first time I read a criticism to Nix.

                            Can you elaborate what you mean?

                            1. 5

                              Nix achieves declarative definition of a system, by forcing you to do everything via the nix programming language. It abstracts the underlying package managing in an functional way.

                              With “high cost”, i mean that certain things then become significantly more difficult. Like runtime-generated configs or system secrets. I heard people complain about that config files now need to be generated from nix options, but afaik thats easy to fix.

                            1. 27

                              Agreed wholeheartedly with everything on this list (esp. Docker and Nix) except for the Code of Conduct line. Sadly, we’re living in a time where assholes need to be explicitly uninvited.

                              1. 15

                                I don’t share the concept of gender with the FreeBSD CoC. When growing up, i observed the world with my own eyes, and found that its an rather arbitrary abstraction not providing value. Should others be allowed to force me to use that concept against my conscience? I’m not rude or disrespectful towards peers (inc. actual transgender persons) because of that.

                                Does that make me an asshole that needs to be explicitly uninvited?

                                1. 20

                                  If you do the things that the FreeBSD CoC says you shouldn’t do (calling people by names they’ve explicitly said shouldn’t be used especially) then yes. Otherwise I don’t really see how it affects you?

                                  1. 10

                                    Having control over the abstractions people use also limits what those people can express. Achilles and the Tortoise is a good illustration of that.

                                    Forcing these abstractions over people is what violates their autonomy, which is why the FreeBSD CoC was so controversial in the first place. Its that the proponents argue that you have nothing to fear if you are “a good person”, equating lawfulness with being a good person. Which is fundamentally wrong. Yes, Edward Snowden violated laws, but i doubt he is a bad person because of that.

                                    1. 11

                                      Can you be more practical, less philosophical, and provide an example of something you’d say, that the CoC would consider wrong? (No bad intentions or hidden agenda in this question, just generally wondering how a real life example of the issue looks like for you).

                                      1. 12

                                        “/me hugs nullp0tr

                                        “You shouldn’t beat your children tho”

                                        “I dislike that you program killer robots for the CIA”

                                        1. 6

                                          Thanks for the examples. I understand your frustration with it a bit more now. How would you deal with someone who’s constantly hugging or backrubbing someone else after being asked to stop? and how does your view on gender affect your empathy towards people with a different view and who get offended by someone who’s constantly using the wrong pronoun?

                                          1. 11

                                            Constantly harassing another user will get you warned, kicked or even banned with our without a CoC. Worst case (if the channel moderation doesn’t care) is that you need to block/set them on your ignore list.

                                            I don’t have an generic attitude on that, and i didn’t have IRL conflicts on pronouns yet. The transgender persons i interacted with were respectable persons and individually got me to use their preferred pronoun without force.

                                            Conflict is a component of daily life. Persons who handle conflict by getting offended and expecting others to change their mind are akin to the kid in the mall throwing a tantrum because mom wont buy the gummy bears. That’s just shitty diplomacy and wont get you anywhere. Embodying such an attitude into an community law will make your community a toxic place.

                                            1. 6

                                              I don’t have an generic attitude on that, and i didn’t have IRL conflicts on pronouns yet. The transgender persons i interacted with were respectable persons and individually got me to use their preferred pronoun without force.

                                              So is it okay in your opinion to intentionally use the wrong pronoun if the persons in question were not respectable?

                                              Constantly harassing another user will get you warned, kicked or even banned with our without a CoC. Worst case (if the channel moderation doesn’t care) is that you need to block/set them on your ignore list.

                                              What’s the difference between having a written rule about what would get you banned and not having one?

                                              Conflict is a component of daily life. Persons who handle conflict by getting offended and expecting others to change their mind are akin to the kid in the mall throwing a tantrum because mom wont buy the gummy bears. That’s just shitty diplomacy and wont get you anywhere. Embodying such an attitude into an community law will make your community a toxic place.

                                              How would you handle conflicts created by racism, sexism, etc in a non toxic way?

                                              1. 9

                                                So is it okay in your opinion to intentionally use the wrong pronoun if the persons in question were not respectable?

                                                If people start interacting with me by insulting me, then i definitely wont let them tell me how to call them.

                                                What’s the difference between having a written rule about what would get you banned and not having one?

                                                Power. Rulemakers wield extraordinary power because they are the ones who interpret a situation as lawful or unlawful. Not getting in trouble with the law is, to an extent, doing good diplomacy with the rulemakers.

                                                How would you handle conflicts created by racism, sexism, etc in a non toxic way? Ideally:

                                                • Tell that i did not find it appropriate, explain why
                                                • Optional discussion, quite often its just an misunderstanding
                                                • Avoid being antagonistic, not calling them sexist or insults (burns bridges instantly)

                                                Best case is that i can base my standpoint upon their values. Using authoritative power to deploy sanctions should always be the last resort.

                                                1. 3

                                                  If people start interacting with me by insulting me

                                                  What are the ways you get insulted? What if someone does it by accident?

                                                  If people start interacting with me by insulting me, then i definitely wont let them tell me how to call them.

                                                  Didn’t you just say being diplomatic is key?

                                                  Persons who handle conflict by getting offended…

                                                  I’m confused why you would revert to being a kid in the mall by not calling someone by their preferred pronoun if they insulted you. I agree with your overall idea of being diplomatic.

                                                  1. 2

                                                    Thanks for taking the time to clarify your stand.

                                                    It seems you’d rather have an environment of mutual respect and no single/few figures that can decide on what constitutes as wrong doing selectively, and you’d rather solve the issues the FreeBSD CoC tries to address through diplomacy and listening to all parties?

                                                    How would you go about implementing your ideal conflict resolution approach in real communities? (alternatively, do you have an example of a community that already does that or something similar?)

                                                    1. 4

                                                      My preference aren’t as exotic at it seems on the first view.

                                                      I dont need to implement it on my own, its already live in such an community, an local instance of the Chaos Computer Club in germany. Hacker culture tends to be decentral and skeptical of authorities in general, probably because hackers tend to be persons that value personal autonomy high. Socially adjacent communities (alot of artists here!) and companies share alot of the mindset.

                                                      Edit: These communities are also the ones where most positive feedback about my CoC-critical stuff comes from. I think i hit a nerve there that already bothered quite some people

                                          2. 7

                                            “I think that the memo that James Damore wrote about gender diversity efforts at Google was by and large correct and that Google was wrong to fire him. He should be considered welcome to contribute in good standing to this open-source software project if he so chooses.”

                                            Any code of conduct that allowed me to say that sentence is (probably) fine; any code of conduct that treated me saying that sentence as a violation is not fine.

                                            1. 5

                                              That is a surprisingly good litmus test. Regardless of your actual view on the Damore memo or subsequent furore, a CoC that can penalize you for expressing your view about a person or situation like that is probably overstepping the mark.

                                              It’s not whether someone would agree with you that he should be welcome to contribute to a project, it’s whether you are allowed to say it. In that regard I really like it as an overreach test.

                                              1. 4

                                                I’ve read the whole memo. I think he gets some things wrong and disagree with him here and there, but I’m glad I read it. Overall he does have a lot of good points, and it does show a big problem with the “leftness” of silicon valley tech culture.

                                                Instead of trying to get more women in STEM/tech, how about we make it more socially acceptable for everyone, both men and women, to go after things they actually like to do. How many people do you know in tech, both men and women, hate their cubeville life. So many people I know, no matter how enthusiastic they might seem at times, deep down, do not like their jobs. We’ve got Dilbert, Office Space, We the Robots and so many other things in entertainment that show how awful these jobs can be. People want to escape.

                                                I feel like there is a lot of pressure on men (and I guess now more on women) to earn enough to provide for a family. We mock people with English or Philosophy degrees with their steamy piles of debt; debt the previous generation would not have had because they could pay for school by working at a grocery store. The cost of education is too high and it’s being turned into a pipeline to the industry that is in demand. The debt locks people in.

                                                Want to solve income inequality? Make everyone’s income public. Every employee knows what every other employee makes and that should be a Federal mandate. Why the fuck is there a taboo over income anyway. If you know what people are worth, you know what you should be wroth. I have a hypothesis that if you could somehow measure confidence, people’s incomes would directly correlate with their confidence level and not their genders.

                                                I think people are locked into a certain political ideology and the false left/right paradigm that they fail to see the real issues are not the issues they’re addressing. Those are symptoms of a much deeper cause.

                                                1. 4

                                                  I honestly haven’t read the memo. Is it something specific in the memo that you wanna be able to express your agreement with? or do you want to be able to express any opinion regardless of what it entails?

                                                  1. 1

                                                    I’m still overall confused by James Damore’s memo. It was mostly an incoherent mess when I read it. What part was he right about in regards to Google’s gender diversity efforts?

                                                2. 3

                                                  Ok. What do you do that violates the CoC that isn’t bad? So far all I’ve heard is weird analogies that don’t really make sense. Can you articulate your concrete concerns?

                                                  1. 9

                                                    Not fighting for moral autonomy because you agree with it is analogous to not fighting for free speech because you agree with what the state says.

                                                    I do enjoy my moral autonomy, i exercise it, and i expect other people to let me do it. And the FreeBSD CoC says, “not here”. So i avoid FreeBSD.

                                                    Like free speech, moral autonomy is an essential part of democratic society (Lawrence Kohlberg: “Moral Development”), even if not everyone needs it.

                                                    1. 7

                                                      Not fighting for moral autonomy because you agree with it is analogous to not fighting for free speech because you agree with what the state says.

                                                      This is entirely disingenuous. FreeBSD is not the state, and requiring that contributors to an open source project not express violent prejudice against other contributors in order to be allowed to contribute is not at all similar to state censorship.

                                                      I do enjoy my moral autonomy, i exercise it, and i expect other people to let me do it.

                                                      Thanks for clarifying. You should realize that this is literally the purpose of CoCs like this one. You value your ability to do whatever you like over the productivity and comfort of others, and that’s not the attitude FreeBSD, Rust etc want in their community, because it tends to decrease productivity and cause burnout, not to mention just being a pain in the ass to work with.

                                                      So, yes, I agree with the others in this thread. Please continue to avoid FreeBSD, and if possible, me as well.

                                                      1. 3

                                                        FreeBSD is not the state, and requiring that contributors to an open source project not express violent prejudice against other contributors in order to be allowed to contribute is not at all similar to state censorship.

                                                        Would you not avoid a project that required you to limit your freedom of speech simply on principle? Or, if you would not, do you at least understand why someone else might on principle?

                                                        The only difference in this example is that you at least have a reasonable choice of simply not using/contributing to FreeBSD if you disagree.

                                                        1. 5

                                                          Would you not avoid a project that required you to limit your freedom of speech simply on principle?

                                                          Assuming you don’t mean “freedom of speech” (as in, freedom from state censorship) and actually mean “freedom to say whatever you want, whenever you want, in whatever forum you want”, this question is so broad as to be meaningless. If you DO mean “freedom of speech”, then it is so narrow as to be irrelevant, since the policies of open source projects don’t affect your legal freedom of speech. In either case, you miss the point.

                                                          Community standards exist in order to prevent, in specific spaces, behavior that will adversely affect the community that creates them. All communities have standards. Codes of Conduct formalize and write down those standards, and allow people to examine them. If a community with standards by which one did not wish to abide existed and was otherwise appealing, one might join it and be unpleasantly surprised. On the other hand, a CoC allows one to see, up front, the norms and standards of a community. This is good.

                                                          Therefore, it seems like @liwakura doesn’t disagree so much with the existence of a CoC as with the community standards many of them encode - in particular, those of the Node.js and FreeBSD communities. Now comes the critical point:

                                                          Rather than engage with specific problems in the CoC (e.g., “[specific rule] is open to serious abuse and provides little protection for the accused”, et cetera), liwakura focused on the “restriction of autonomy”. Yes, community standards restrict autonomy. That is the point. They prevent behavior such as the purposeful, spiteful misgendering liwakura described as a likely outcome with a negative interaction with a trans person, or purposeful ignorance (as in, the noun form of “to ignore”, not as in lack of knowledge) of social structure of gender- and sex-based oppression. By preventing those behaviors from being displayed by liwakura in FreeBSD spaces, the CoC has succeeded.

                                                          In other words, the CoC says “If you’re going to be a jerk, such as in these specific ways, stay out”, and liwakura’s response was “How dare you tell me that you don’t want me to be a jerk in these specific ways! I’m going to do what you say and not participate in your community, but also whine about it on the Internet.”

                                                          1. 2

                                                            Community standards exist in order to prevent, in specific spaces, behavior that will adversely affect the community that creates them.

                                                            From what I’ve seen, the CoC being enforced in these specific spaces does not usually happen - they are enforced outside of those spaces as well. If I say some homophobic stuff on IRC, and it gets screencapped and posted on Twitter, do I get kicked out as a member of Project XYZ that uses a CoC which specifically prohibits that sort of language? Obviously I’ve said it, and there is public record of it - but I wasn’t saying it in context of the project, or to any member of the project, and in a (relatively) private setting. If I’m punished for something like that, then I’ve lost moral autonomy outside of the project.

                                                            1. 1

                                                              I would consider that to be a very arguable case. Is it possible that one’s external behavior will negatively impact the project and its community? Yes. Is your objection about moral autonomy outside the project valid? Also yes.

                                                  2. 0

                                                    Ok. What do you do that violates the CoC that isn’t bad? So far all I’ve heard is weird analogies that don’t really make sense. Can you articulate your concrete concerns?

                                              2. 2

                                                To be fair, I fall between the OP and the parent. Aside from one pre-COC level FreeNAS, I don’t use FreeBSD (which is the example) because of the shitty CoC. I’m not opposed to a well-structured one, but FreeBSD doesn’t appear to have one. Using a product means you condone the producer’s practices. I don’t use Facebook. I’m slowly degoogling my life, and I’m getting rid of Linux. Amazon Prime will be a hard plaster to pull off, but I’m working up to that. I see FreeBSD the same way - I don’t support their CoC implementation, ergo I won’t support the product by using it.

                                                The very fact that any online discussion quickly devolves into poisonous ad-hominem is reason enough for me to be put off by the presence of one, but they can serve a purpose when well implemented (if GNU had a well-designed CoC then the recent Glibc abort() debacle could’ve been handled through it for example). When they’re poorly implemented like with FreeBSD, it’s not properly serving it’s existing community.

                                                1. 2

                                                  Why are you getting rid of linux?

                                                  1. 5

                                                    It’s a combination of factors, some of which are due to shitshows like systemd, issues with breaking compatibility (e.g. ifconfig) and the realisation after moving to docker that for the most part, I have absolutely no idea what code is running on these systems.

                                                    I wrote about this in another comment here: https://lobste.rs/s/yxswhm/what_are_you_self_hosting#c_8reclz

                                                    To be fair, a lot of this is a result of my own poor personal choices, but I now feel like I’m fighting Linux to make it do what I want predictably, and not do things I didn’t tell it to do. It’s very reminiscent of MacOS’s shift a few years back.

                                                    I’m going to spend some time with Alpine simply because that’s what a lot of my docker containers for public systems run on, but I’m not building new systems to run docker, no longer buying raspberry pis (thanks, binary blobs) and instead of migrating to Linux, I’m migrating a lot of systems to Open and NetBSD. I would’ve chosen FreeBSD, but the CoC debacles mean I’m less comfortable supporting it. My next NAS build may well run Illumos instead.

                                              1. 11

                                                overreaching Code of Conducts.

                                                The author realizes that you don’t have to follow the code of conduct to use the software? Also 80% of the items on the freebsd code of conduct are illegal. the four that stick out to me that aren’t are these.

                                                Comments that reinforce systemic oppression related to gender, gender identity and expression, sexual orientation, disability, mental illness, neurodiversity, physical appearance, body size, age, race, or religion.

                                                Unwelcome comments regarding a person’s lifestyle choices and practices, including those related to food, health, parenting, drugs, and employment.

                                                Deliberate misgendering.

                                                Deliberate use of “dead” or rejected names.

                                                Author basically feels that if the developers can’t get intimately involved with another developer’s personal life without consent then the author does not want to use the software. Frankly it seems like you could just create a code of conduct with the line “Thinking code of conducts are bad” and you’d filter out everyone who apparently wants to get in your grill.

                                                The other rules are okayish but would rule out basically everything if applied strictly.

                                                1. 11

                                                  Also 80% of the items on the freebsd code of conduct are illegal.

                                                  Code’s of conduct don’t have anything to do with law, though. An organization can block your participation in it for any reason they see fit. There are restrictions for businesses and employers, but they don’t apply to open source projects.

                                                  1. 17

                                                    Right and if you don’t agree with those reasons you don’t have to contribute or you can create your own organization. I was saying 80% of them are illegal to do as an individual. Sexual harassment? Stalking? Threatening? A lot of the CoC is basically just “We won’t enable your criminal behavior and allow you to use the organization as a way to find targets”. The 4 here are basically, “Don’t purposely be an asshole to other members, here are four ways of being an asshole that are explicitly not allowed.”. If you think Open Source means “I get to be a dick to other people and get away with it because it’s not a job” then you’re honestly doing more harm than good and should do something else with your life.

                                                    1. 6

                                                      Oh sorry, I misunderstood what you mean by illegal. I thought you were saying much of the CoC was illegal.

                                                      1. 14

                                                        The 4 here are basically, “Don’t purposely be an asshole to other members, here are four ways of being an asshole that are explicitly not allowed.”.

                                                        That kind of playing with definitions is one of reasons I fight broad Codes of Conduct. It’s not how they play out. Instead, those promoting or enforcing will be specific groups of people having specific, political views on everything from words to identity to societal structures, expecting the entire world to comply with those views, and punishing anyone in their immediate setting who doesn’t using whatever methods are available. Those methods range from shaming to exclusion to removing their ability to pay bills.

                                                        To me, that sounds like being assholes that shove their politics down others’ throats telling them to get lost if they don’t like it. Even more so when I see plenty of people be civil without going that far in mischaracterizing or banning other groups’ means of expressing themselves. Then, a person supporting such politics shows up saying it’s just about not being an asshole. People reading that get a different impression than “no political disagreement or differences are allowed in this list of categories whose reach increases whenever we say.” I don’t expect more honesty from most promoters about the goals since subterfuge and “end justifies the means” is the norm in that group.

                                                        1. 12

                                                          What about it shoves politics? I would think all the points I mentioned are basically apolitical. There’s no rule against “political disagreement” within the CoC. You can be super hard line conservative and still follow these rules. I’m specifically talking about the FreeBSD CoC.

                                                          1. 7

                                                            It’s not really based on “politics”, but on basic respect. If you’re a conservative who is respectful of people’s preferred names and doesn’t shit all over people because of their lifestyles, you won’t have a problem. If you’re a liberal or Leftist who is super racist, anti-Semitic (hello, tankies) or constantly judges poor people overly harshly (of which there are many), you will have one.

                                                            That said, if you feel that trans people asserting that we should be called by the names we choose for ourselves is somehow a political act, then yes, the purpose of the CoC is to “shove politics down your throat”.

                                                            1. 1

                                                              if you feel that trans people asserting that we should be called by the names we choose for ourselves is somehow a political act

                                                              Isn’t it? I have no problem with calling you as you like, really.

                                                              And I’d like it would be the common ground of our international culture.

                                                              But it is Politics. I’d argue that it’s the best expression of politics at all, as it establish a kind environment where we can confront on.

                                                              On the other hand, “keep the discourse on topic or you will be banned” should be a pretty good CoC, everywhere.

                                                              Now, if we can go off-topic, and you tell on a public space (say IRC or a mailing list) you do something I consider bad, you are engadging a discourse. You can’t say “I like eating people, cannibalism improve my health” and than invoke the CoC if anyone object.

                                                              People should understanding that speaking in public implies a will to listen.
                                                              More exactly, speaking implies a will to challenge own opinions, putting them at stake in the conversation.

                                                              If you don’t want to listen any objection, if you don’t want to change your mind, why speak in the first place?
                                                              Are you doing propaganda? Marketing? If so, you are the problem, not who engage with you.

                                                              Also, if we can go off-topic, and you tell you like to hurt your children, I’ll comment on that, whatever the CoC. After the denounce obviously, with all the reference I can get to find you (including your email, ip, os, whatever I can get through my technical knowledge and tools).

                                                              So in general, the CoC is a political tool. It could be used for good or evil.

                                                              But it doesn’t fix the lack of a democratic culture of dialoge in a community.

                                                            2. 1

                                                              Without a CoC you are at the mercy of the hidden political views of the project owners. Their decisions to ban start looking arbitrary. Either way, you deal with political views. Wouldn’t you prefer to know what they are before engaging? Worst would be spending a lot of your time on a project only to find out you get banned because you said something that was in disagreement with the owners of the project.

                                                        2. 14

                                                          They are too broad (e.g. large swaths of the population would violate it by with their daily interactions), which puts selective enforcement at charge. If its selective enforcement, then its just an power instrument with the rule makers at the power end, even if the contents of the CoC are all well-meaned and good in their intentions.

                                                          Its not directly about the contents of the CoC, its about taking peoples moral autonomy.

                                                          1. 12

                                                            I think it’s reasonable to treat open source work within an organization with the same level of respect and dignity that you would expect from a job. You could get fired at a job for nearly every one of these. Using dead names even, if an employee asks you to stop and you don’t and they file a complaint against HR, HR might decide that you’re creating a hostile work environment for basically no reason. Most people don’t get fired for misconduct, so I’m going to actually say that you can’t possibly be right about that claim.

                                                            Keep in mind that the responses are

                                                            A private reprimand from the working group to the individual(s) involved.

                                                            A public reprimand.

                                                            An imposed vacation from FreeBSD Project controlled spaces (e.g. asking someone to “take a week off” from a mailing list or IRC).

                                                            A permanent or temporary ban from some or all FreeBSD Project controlled spaces (events, meetings, mailing lists, IRC, etc.)

                                                            A request for a public or private apology.

                                                            A request to engage in mediation and/or an accountability plan.

                                                            These aren’t that extreme. Sure you can be banned but that can happen in any OSS project where they can say “We won’t accept pull requests from dirt bags like you.”. In this case the things you can do wrong are at least actually laid out so that you know what behaviors to avoid and which ones to follow.

                                                            1. 16

                                                              Still, the CoC assumes moral authority over me, which is an no-go for freedom lovers and hackers like me. That people like you don’t exercise their own moral autonomy and fail to understand that others do (with different results) is the reason why CoC create unnecessary controversy and drama.

                                                              And yes, the FreeBSD CoC makes me feel violated in my moral autonomy, and yes, the FreeBSD CoC embodies political views i do not share.

                                                              1. 9

                                                                A CoC has no moral authority and frankly morality isn’t even a real thing. It’s merely a set of rules that people who work together have agreed to follow while working together. You don’t have to work with them and you don’t have to use their software, but since you wanted to be on record disagreeing, I wanted to be on record agreeing with CoC and why I feel the way I do.

                                                                1. 4

                                                                  Again, this is a strong pro-CoC statement. If they are successful in excluding people like you, they are working as intended.

                                                                  1. 10

                                                                    I was hoping to keep things civil. Perhaps there’s a more generous way you could phrase this?

                                                                    1. 5

                                                                      Not really, given that the author has emphatically stated their disagreement with either the values motivating the rules, or the rules themselves. Regardless, such a person is a real risk to the health of the community, and it’s nice that there’s such an effective repellent.

                                                                      1. 18

                                                                        I’m honest about not being a feminist. I consider the concept of gender harmful (from an philosophical standpoint), but people like you seem seem convinced that not sharing your point on that makes me an bad person.

                                                                        But thanks for determining i’m a hazard to community, it surely helped me to recognize the superiority of your standpoint.

                                                                        1. 7

                                                                          By “considering the concept of gender harmful” you are willfully ignorant to the way that society works and by effect you are a part of the problem creating inequality and fostering an environment where harassment and hate crimes can thrive.

                                                                          You don’t get to invent your own reality and pretend this one doesn’t exist.

                                                                          1. 16

                                                                            Yeah also you can consider gender harmful without refusing to respect how other people would like to be referred to. For example I will now out of respect for your disdain for the concept of gender refer to you strictly in non-gendered nouns. Notice how I disagreed with your viewpoint but didn’t invalidate your identity.

                                                                          2. 1

                                                                            I don’t care about your honesty. I don’t care to have you recognize the superiority of my viewpoint; I know nothing I can say will sway you. I care to prevent you from contaminating the spaces I care about.

                                                                            1. 22

                                                                              You’ve and @liwakura have both explained well how you differ fundamentally, and I appreciate that. This comment is pulling that discussion into a dark place, please don’t continue on this theme casting someone as an unredeemable danger who must be eradicated. Lobsters is not good at being “Tinder, but for finding a nemesis”.

                                                                            2. 2

                                                                              You don’t fight the concept of gender by standing on the sidelines watching those that do have the concept of gender dominate half the population. Just because you believe there isn’t gender, doesn’t mean people who consider themselves women aren’t getting the short end of the stick in our society.

                                                                            3. 3

                                                                              thanks, that’s much clearer. :)

                                                                      2. 6

                                                                        You could get fired at a job for nearly every one of these.

                                                                        Depends on the job. Many employers won’t punish people who have political differences. Especially in Mid-South where we’re quite a diverse bunch of liberals, conservatives, white, black, latino, etc. The rule is that we either avoid those topics entirely to keep things civil or you better be able to take the kind of discussion you were dishing out. Essentially, we recognize those claiming disagreement is “offensive” to just be silencing their opposition. They’re trying to attack and control the other person. People still try that but don’t get far.

                                                                        So, in such a truly, inclusive environment, people will be saying things that bother others since there’s conflict on a deep level. My relatives and I have worked in many such places. They’ll have heated arguments sometimes. It almost always ends up “agree to disagree” with them making up for it being nice to each other later. Sometimes people figure out who each other are underneath, permanently dislike each other, work together just enough to get the job done, and avoid one another otherwise.

                                                                        People almost never quit over this sort of thing. It’s also not what most gripe about. Those griping or quitting over assholes bring up people who folks in every group agree are assholes. We wouldn’t need a CoC to deal with them. Just decent managers or owners that respond to employee complaints. If managers or owners aren’t decent, then no policies or CoC’s are going to make the work environment better.

                                                                        1. 13

                                                                          I really don’t understand how you got this from the CoC mentioned. There is no rule in the CoC that you must conform politically. I would be very shocked to hear that the entire FreeBSD team is not conservative. The rule is merely that you treat other people with dignity. I live in the south and every single one of my workplaces would fit this CoC save for maybe the rules around transgendered folks. Frankly even when I was a deeply religious and hardline conservative I would have no trouble following these rules. I never treated anyone less than human because they had different views than me. Furthermore that “rule” you gave is a kind of CoC and CoC’s matter once the size of the organization grows. Its very easy to fall into a tyranny of structurelessness as an organization gets larger. This is because nobody can agree on what is right or wrong or what the response should be to a problem. By having a CoC you can agree as an org what actions are against the group and what a good response looks like. If you don’t have any response strategy mob mentality kicks in and things can escalate to threats and violence. After all if someone is a huge asshole and nobody is doing anything about it it would seem natural to find a way to make them stop.

                                                                          Frankly there’s nothing in this CoC that has any bias against conservatives whatsoever. Nothing in the CoC says you have to be a liberal, and it specifically protects people from false claims. Your micro-CoC actually fails to protect individuals from false claims.

                                                                          Publication of non-harassing private communication without consent.

                                                                          Publication of non-harassing private communication with consent but in a way that intentionally misrepresents the communication (e.g., removes context that changes the meaning).

                                                                          Knowingly making harmful false claims about a person.

                                                                          1. 11

                                                                            Depends on the job. Many employers won’t punish people who have political differences.

                                                                            This is such a disingenuous frame shift of the issue that it invalidates everything else about your argument. Being respectful is not political. Enforcing consent in interactions is not political. Being gay or tolerant of same is not political. Asserting that any effort to shift culture away from the status quo is an out-of-bounds “political” act is a cowardly way to attempt to silence those that you disagree with. You are personally guilty, to an incredibly advanced degree, of every evil thing you claim to be against.

                                                                            “Politics” is the process by which humans come to consensus for shared interests. Shitting on the less powerful and providing moral or intellectual cover for those that seek to do the same is not politics; it’s craven thuggery disguised as keeping things peaceful.

                                                                            1. 0

                                                                              Politics is whatever action affects the polis, and by extension any group of humans.

                                                                              Thus being respectful is political.
                                                                              Enforcing consent in interactions is political.
                                                                              Being tolerant of anything is political.

                                                                              In Italy we have the same kind of differences that @nickpsecurity describes, and we are used to joke about our differences a lot. And we debate harshly about many things, but usually these debates grow our relations.

                                                                              As an example, I had a girlfriend that was a deeply religious Catholic when I was atheist (and rather angry at Church). And we talked a lot about religion and politics back then, without that affecting negatively the relation.

                                                                              One of the best engineer I worked with voted for the worst political party we had in Italy for decades. I had the opposite view. We debated a lot. We debated so much about politics that when we had to design a framework together to under a huge pressure, we keep debating with the same style. And after 10 years in production, the framework still rocks the customers are satisfied and we can’t find anything remotely on par with it around.
                                                                              Why? Because we were used to listen deeply and respectfully the other’s opinion.

                                                                              1. 2

                                                                                I grant that being tolerant is political, and so it follows that everything is political. Which means that my point is still relevant: it’s disingenuous to dismiss concerns about behavior as “political”, as though that made it irrelevant.

                                                                                In Italy, you are allowed to have those debates because the stakes are much lower: you’re less likely to die from poverty, your livelihood is less contingent upon social approval, etc.

                                                                                In the United States, it’s not like that. If you lose your job, you could die. If you are systematically excluded from high-paying industries, like digital technology, your quality of life massively suffers in comparison to those who are welcomed by that industry. All policies must be considered in the context of an entrenched and reactionary old guard that dominates all other effects. Any overt attempt to improve the lives of the marginalized is treated as a threat to the old order, and rightfully so. The stakes are literally life and death.

                                                                                Mr. P. Security doesn’t work in the the industry, and largely speaks from a position of willful ignorance about these issues.

                                                                                1. 0

                                                                                  In Italy, you are allowed to have those debates because the stakes are much lower

                                                                                  I do not know United States enough for a comparison, but sadly we have poverty here too. Our livelihood is not based on social approval, but it’s often strongly based on social relationships.

                                                                                  We just know we are all on the same boat.

                                                                                  So I don’t know if we are free to talk because we have lower stakes, or we have lower stakes because we are free to talk.

                                                                                  In any case, an international project should not be ruled according to the issues of a single country.

                                                                                  1. 1

                                                                                    In any case, an international project should not be ruled according to the issues of a single country.

                                                                                    I don’t understand what this is in reference to, or what it could possibly mean in terms of what kind of governance structure or details. I was pointing out that there are cultural differences that make it easier or harder for people who are forced together to have disagreements about their values, or be able to set aside those differences in order to do something together.

                                                                            2. 10

                                                                              The CoC is about civility, not politics. And I can’t believe you don’t know that. So what is your purpose? Are you standing up for the right to humiliate people or be rude to them? That’s a principle for you?

                                                                              1. 0

                                                                                Just decent managers or owners that respond to employee complaints…

                                                                                Poor employees, at the mercy of their benevolent dictators.

                                                                            3. 3

                                                                              Wait, you believe without a CoC, owners of a project have less power? An owner of a project already has views of what kind of behavior they think is good and what they think is bad. If they don’t write it down in CoC, you are still at their mercy, but now you have to guess what the hell they are thinking.

                                                                              I’m not sure how a CoC increases any power they already have. You still don’t have moral agency because we live in a society where there are owners and non-owners. There is still a power differential. If you want democratic rule, then you need to fight against ownership by paper.

                                                                              1. 2

                                                                                Even without a CoC the project owners selectively enforce hidden rules. I’m not sure how making the rules hidden is better than making them explicit.

                                                                            1. 5

                                                                              unable to be built from sources

                                                                              This is mostly up to person who compiles. I hate seeing issues similar to “I can’t compile”.

                                                                              If you were to wrote >not properly documented compilation process<, I could understand your struggles.

                                                                              1. 5

                                                                                That is correct, i adjusted the article.

                                                                              1. 2

                                                                                That’s because “best” is relative to ones goals. Seeing it as something absolute is harmful, especially in contact with humans with different views. I strongly recommend to keep an eye on what something is best for.

                                                                                1. [Comment removed by author]

                                                                                  1. 13

                                                                                    You realize it’s OK to agree with someone on one topic and disagree with them on another? A single opinion cannot invalidate everything a person has to contribute. I see a lot of people doing that these days. It’s dangerous and unhealthy.

                                                                                    1. 5

                                                                                      Sean Blanchfield and Johnny Ryan are the same person? Could you elaborate on that?

                                                                                      1. 4

                                                                                        It’s a conspiracy I tell you.

                                                                                    1. 3

                                                                                      currently 1 developer and 2 community managers

                                                                                      Am i the only one who is bothered by this? Its understandable for commercial projects, but i can’t imagine what a manager for an open source community is doing.

                                                                                      1. 4

                                                                                        Manager and community manager are very different roles. A community manager is anyone who manages the community through interaction. That can mean writing news posts, writing release notes, publishing a roadmap, responding to user questions on forums or IRC, moderating, and more. I can easily see how a Linux distribution could use two part time people to do all of those things.

                                                                                        1. 2

                                                                                          Not sure why you think this is problematic. The concept of forum moderators, though not quite the same, has been around since forever.

                                                                                        1. 1

                                                                                          Cool. I wasn’t aware of PRoot, rootless and the rootless-container project in general. Since there is no mention of fakeroot and fakechroot, do you know how this compares?

                                                                                          1. 2

                                                                                            fake{root,chroot} is based on an LD_PRELOAD-like syscall interception. It has the advantage of not depending on the kernels namespace implementation, but the disadvantage of having a performance penalty.

                                                                                            proot is an frontend for linux namespaces.

                                                                                            1. 1

                                                                                              Thank you for your response, I see. So it’s not possible to run it inside a cointainer then? fakeroot with ldpreload is a pain, you basically can’t debootstrap Jessie on Stretch because of this.

                                                                                              1. 1

                                                                                                I thought one of them did LD_PRELOAD interception, which was fast enough that you don’t notice the performance penalty, but doesn’t work for things (e.g. Go binaries?) that make syscalls directly rather than going through libc’s wrappers. and the other did ptrace() interception, which works on everything, but makes syscalls much slower (though compilers spend a large proportion of their time doing things which aren’t syscalls, so it’s like a 20% perf hit for random C programs last time I tried).

                                                                                                1. 2

                                                                                                  Both are using LD_PRELOAD. What you are thinking of is fakeroot-ng(1), which is ptrace(2)-based.

                                                                                                  1. 1

                                                                                                    Thank you.

                                                                                            1. 4

                                                                                              Reading such articles makes me question… am the the only one who reads manpages? ssh_config(5) and ssh-keygen(1) are my favourite.

                                                                                              1. 12

                                                                                                Hi,

                                                                                                It’s my personal opinion (I haven’t synced with @pushcx about this) that allowing image embeds was a bad idea - I’d go so far as to say irresponsible, as several of you have. It opened the way to privacy violations of the type @liwakura’s post exemplifies, as well as wasting people’s bandwidth. I’m actually a bit surprised that the bandwidth is the bigger concern for most of you, but that’s my personal bias.

                                                                                                With that said, as somebody who reviews a lot of launches, I know that it’s always easy to miss things. It’s always about asking myself “what’s missing from this picture” - what part of the implications isn’t part of the write-up, which is going to be a surprise later. I wasn’t in the loop about the April Fools theme change, but I don’t blame @pushcx for not thinking about the implications of allowing embeds. It was one small detail in a much bigger effort, and it’s a lot more obvious in hindsight than it would have been while writing it.

                                                                                                Catching every negative consequence of a new feature is a lot of work, and I imagine it was overshadowed by the work of building something meant to be fun - it must have been a significant amount of engineering work to build. I hope some of you did enjoy it. I personally didn’t like the UX, but I thought it was hilarious, and I probably would have agreed with the general concept if I’d been asked.

                                                                                                I ask everyone to try not to argue with each other. Yes, mistakes were made. We’ll have to talk through what action is appropriate as mods, if any. Meanwhile, I ask people to show empathy for each other and not let this devolve into arguments. I promise that your concerns have been heard.

                                                                                                Thanks,

                                                                                                Irene

                                                                                                1. 8

                                                                                                  This is a solid roundup. I’m sorry I didn’t think to proxy the images, I missed the privacy issue. @liwakura missed the consequences of his prank and has apologized and, no, I’m not going to ban him for it.

                                                                                                  1. 7

                                                                                                    In addition to what Irene said, i want to apologize for the harm i caused to several users. Mistakes were made, forgetting about mobile crustaceans was one of it.

                                                                                                    For the people worrying about the data: My logs are stripped of the last 8 bits of IPv4 and last 64 bits of IPv6 addresses. The data points i have are thus not traceable to your home or phone.

                                                                                                    I also want to encourage the community to keep calm, i’ll be cooperating with the staff to address open concerns.

                                                                                                    1. 2

                                                                                                      Thanks for taking time to address this. I’ll leave it to yall as to how.

                                                                                                      Far as you wondering about data used vs stolen, many folks (me included) assume about anything online might get hit by hackers at some point. Double true if it’s not designed for security like a forum software. We just hope to be notified so we can change passwords, tell friends why they’re getting odd emails, etc. Whereas, data use on mobile is something that might cost us money directly or even cut off our ability to receive important communications.

                                                                                                      So, at least for those like me, we’d find a data leak (esp non-malicious) to be eyerolling or irritating with its hypotheticals whereas massive data use might do real damage. This time I was lucky enough to have a good plan. :)

                                                                                                      1. 2

                                                                                                        That explanation makes sense. Thank you.

                                                                                                      2. 2

                                                                                                        I get your point, but maybe we did not need the “launch” in question at all. I personally find all these Aprils fools things super annoying. Maybe less is more and next year lobste.rs is not participating. That would be great.

                                                                                                        1. 3

                                                                                                          I definitely consider that a valid option. I feel bad telling other people not to have fun, but I’m not really a fan of April Fool’s.

                                                                                                          I can promise your view is noted and will be weighed for next year.

                                                                                                      1. [Comment removed by author]

                                                                                                        1. 9

                                                                                                          If the forum allows it, anyone who can link an image in their signature is “tracking” users and has access to this information.

                                                                                                          The 600MB file, I’d agree with, though.

                                                                                                          1. 0

                                                                                                            By the way, it was pushcx himself who replaced the big image with an humerous remark. Might not have been the brightest idea to put it there in the first place.

                                                                                                          2. 4

                                                                                                            The lack of response or action from @pushcx is sad to say the least.

                                                                                                            1. 3

                                                                                                              He was there when it happened. They saw the picture, people joked on it, pushcx removed it, put his own comment on it into my signature, i liked it, other people liked it, i kept it. Some people had a good laugh. At this point, i was still assuming that most lobste.rs users were on desktop.

                                                                                                              After compiling the statistics, i felt like, “Oh shit”. Mistakes were made. I can’t turn that back now.

                                                                                                              You should have been there when it happened, then maybe you would have an different perspective on it. I dont want that pushcx now gets shit from people missing context. Mistakes were made.

                                                                                                              1. 1

                                                                                                                Just because @pushcx was “there” when it happened doesn’t mean that it’s OK. You abused the trust we all have in this website and I’m starting to feel like @pushcx is abusing my trust in him as the sysop to act fairly across the board. Not only did you pry into the privacy of users you wasted their time, money and energy doing so.

                                                                                                                1. 2

                                                                                                                  users weren’t required to download his tracking pixel. they chose to run software that would download it by default. i consider this a lesson about the state of our software ecosystem.

                                                                                                                  1. 5

                                                                                                                    This is a strawman. Every browser behaves this way. What is the lesson supposed to be? Do not trust lobste.rs and move to a better community?

                                                                                                                    1. 2

                                                                                                                      are you using the term strawman to refer to any argument you disagree with? or did i actually construct some sort of strawman?

                                                                                                                      lynx doesn’t behave this way. firefox doesn’t behave this way, with 3rd party images disabled in matrix. the tor browser would not leak data this way. the lesson is that the web is a hostile environment because we allow it to be. if we all used more secure browsers, sites that are broken by the security features would lose traffic. but we allow it to happen.

                                                                                                                      1. 0

                                                                                                                        No, the lesson should be do not trust the browser.

                                                                                                                        1. 3

                                                                                                                          so you have a whitelist of domains that you trust or how do you use the www?

                                                                                                                          1. 1

                                                                                                                            I try to use it as little as possible and when I use it, I consider it a hostile attacker that I don’t trust.

                                                                                                                            If at some point there will be a bitcoin miner on the site, I won’t consider myself betrayed by anyone, as nobody made any promise to me, nor I expected anything from anyone. I will simply move on with my life. If I am concerned about blowing through my data allowance, I won’t visit radom websites in the first place.

                                                                                                                            It seems that currently there aren’t any javascript bitcoin miners here on this site, but I have no expectations that there won’t be any tomorrow or some other day.

                                                                                                              2. 2

                                                                                                                Probably worth probation for a week or two.

                                                                                                                Hey, if we are doing the 2000s BB thing, let’s go all in! ;)

                                                                                                              1. 8

                                                                                                                What was the reason behind the 600MB tracking pixel?

                                                                                                                1. 5

                                                                                                                  Protest against lobste.rs april fools theme, intentionally abusing the new functionality.

                                                                                                                  Somehow nobody is bothered that i shouldn’t have been able to get the visitor information in the first place.

                                                                                                                  1. 8

                                                                                                                    I hated the AF joke too, but now I’m more irritated at you for taking it out on us other victims though cell fees instead of directing your lack of gruntle at the admins.

                                                                                                                    1. 7

                                                                                                                      Protesting by harming the visitors of the page is very odd. You are not abusing new functionality, you are abusing peoples trust into the website. Also, you haven’t harmed lobste.rs, but its visitors.

                                                                                                                      Maybe people protest because tracking doesn’t make lobste.rs worse then any other page they visit, but burning mobile bandwidth of that size is rather unusual? That’s a direct economic damage and people on visit outside of their country might suddenly be caught with no data. Just sayin’.

                                                                                                                      1. 0

                                                                                                                        Honestly, i thought mobile users were a small minority. So, the data plan drain wasn’t intended.

                                                                                                                        1. 6

                                                                                                                          Intention is an very bad defense. Maybe think stuff through next time.

                                                                                                                          A “sorry”, for example, would go a long way.

                                                                                                                      2. 6

                                                                                                                        Embedding a big hotlinked animated gif in your sig, which you then grep Apache logs for to get traffic info, does feel very 2002.

                                                                                                                        1. 3

                                                                                                                          Somehow nobody is bothered that i shouldn’t have been able to get the visitor information in the first place.

                                                                                                                          I’m very surprised at the lack of reaction about this, too. This was my first thought when I realized you weren’t an admin.

                                                                                                                          1. 2

                                                                                                                            I added an clarification note to the top of the post… i think people did miss im just a regular user.

                                                                                                                          2. 2

                                                                                                                            Gotcha, I thought you were an admin/mod when I read the blog entry.

                                                                                                                            How did you get the visitor information? Was that from requests to pull your tracking pixel?

                                                                                                                            1. 2

                                                                                                                              The AF joke enabled a privacy vulnerability via hotlinked images which allows for third-party tracking.

                                                                                                                              1. 2

                                                                                                                                Exactly. All pictures in the signatures caused GET requests to user-chosen urls.

                                                                                                                              2. [Comment removed by author]

                                                                                                                                1. 1

                                                                                                                                  Context you are missing: It was him who removed it.

                                                                                                                                  1. [Comment removed by author]

                                                                                                                                    1. 1

                                                                                                                                      And that changes things? It’s an obvious and reasonable first response, not precluding anything else.

                                                                                                                                    2. 1

                                                                                                                                      I’d agree 100% – the fact that it’s an abuse of trust makes me vote for a perma-ban.

                                                                                                                                1. 2

                                                                                                                                  How many OpenBSD users? Note that the user-agent for chromium on OpenBSD contains (X11; OpenBSD amd64; Linux x86_64) because of sites that serve degraded pages when they don’t recognise the OS.

                                                                                                                                  1. 2

                                                                                                                                    TIL! Seems to be 12 unique IP addresses (10 unique user agents) that have both Linux and OpenBSD in their agents, another one with FreeBSD.

                                                                                                                                  1. 2

                                                                                                                                    I’d love to know how many Seamonkey users there were, in the shallow hope of beating the Opera users.

                                                                                                                                    Is @liwakura == nero?

                                                                                                                                    1. 2

                                                                                                                                      Seamonkey 4, Opera 7.

                                                                                                                                      Yes. I checked the box that im the author of the submitted story, so my nick should be light-blue.

                                                                                                                                      1. 1

                                                                                                                                        Thanks liwakura. I still see that as a small victory :)

                                                                                                                                      2. 2

                                                                                                                                        Used to use seamonkey, but latest firefox was just too damn fast so i switched. When seamonkey get’s the latest engine, maybe i’ll switch back.

                                                                                                                                        1. 2

                                                                                                                                          I don’t know if that will ever happen. I’m not sure there is the man-power.

                                                                                                                                          Seamonkey has always been “Firefox but more sane”. Whilst it’s slipping, I think there’s still a need for a project that does this (but uses the quantum- code).

                                                                                                                                        2. 1

                                                                                                                                          I’d really like to use anything that isn’t Firefox, but addons seem to be a problem with Seamonkey - how do people get around that?

                                                                                                                                          1. 2

                                                                                                                                            There’s an extension that adds an ‘addon history’ thingamabob to the addons site, so you can select older versions of addons:

                                                                                                                                            https://github.com/lemon-juice/AMO-Browsing-for-SeaMonkey

                                                                                                                                            It’s really imperfect and I have older addons breaking. My heart may soon follow.