Skip Navigation
Roast the security of my app
  • Marvellous!

  • Roast the security of my app
  • history which may or may not be relevant to you: https://en.wikipedia.org/wiki/Cryptocat

  • apps .. repo or not
  • A name I've seen in connection with this issue is Obtainium. From a cursory look, it appears this just streamlines checking for and getting apk's from GitHub release pages and other project-specific sources, rather than adding any trust. So maybe it just greases the slippery slope :)

    Security guidelines for mobile phones, and therefore policies enforced by large organizations (think Bring-Your-Own-Device), are likely to say that one may only install apps from the platform-provided official source, such as the Play Store for Android or the Apple App Store for iOS. You might say it's an institutionalized form of "put[ting] too much trust in claims of authority." Or you might say that it's a formal cession of the job of establishing software trustworthiness to the platform vendors, at the mere expense of agency for users on those platforms.

    People are not taught how to verify the authenticity and legitimacy of software

    Rant: Mobile computing as we know it is founded on the rounding off of the rough corner of user agency, in order to reduce the amount users need to know in order to be successful, and to provide the assurances other players need, such as device vendors, employers, banks, advertisers, governments, and copyright holders. See The Coming War on General Computation, Cory Doctorow, 2011. Within such a framework, the user is not a trustworthy party, so the user's opinion of authenticity and legitimacy, however well informed, doesn't matter.

  • Using vintage laptops in 2024: How do you make it work?
  • No, I have not tried that. But I might now. :)

  • Using vintage laptops in 2024: How do you make it work?
  • I've got a Thinkpad 600X (Pentium III, 256MB RAM). I put Debian 12 on it, and the OS is not quite small enough. (NetBSD couldn't drive my particular CardBus Wifi card, sadly, and 9front couldn't drive the NeoMagic video properly.) Just Emacs on the console, no X, and eww for web browsing (to your question) and elpher for poking around Gemini. I'm not familiar enough with Thinkpads to know if that's a useful data point for you.

    Nobody's mentioned https://www.haiku-os.org/ yet, so I will. I can't remember what happened with it on my Thinkpad. There are several graphical browsers there, with a range of capabilities, as well as a port of Emacs.

    I guess my real answer is: don't handle today's internet with all of its heavy websites? Use the web for documents, and use native applications rather than web apps for other purposes, such as chatting and email.

  • [Discussion thread] Did you solder your keyboard yourself or did you get it prebuilt?
  • I got a Keeb.io kit and soldered it myself, and then I've handwired a Dactyl Manuform and (halfway) a Splaytyl. I love how many people can build you a 3d-printed keyboard these days, but I'm already equipped and experienced to do it all myself.

  • Is there a precedent for a really delay-tolerant command line interface? (A bit off-topic)
  • I would pull on that thread. That is, in your shoes

    Directions unclear; shoelaces tangled

  • Musk’s X Risks Fine as EU Steps Up Crackdown on Big Tech
  • Musk's X risks. Musk's X risks. Muck's eck ricks. Dangit

  • Is there a precedent for a really delay-tolerant command line interface? (A bit off-topic)
  • Secure Scuttlebutt is (was?) a protocol for high-latency communication between occasionally-networked humans. Pro: https://scuttlebutt.nz/; con (not read in detail): https://derctuo.github.io/notes/secure-scuttlebutt.html. I think it was supposed to be able to spread messages over Bluetooth, assuming a sufficiently connected web of nodes between person A and person B. Public keys were identities, and were bound to devices; unfortunately people may have multiple devices, or change devices over time, so this was a hindrance.

    IPFS was supposed to be the Interplanetary File System. I think that was just because whatever pieces of content you ask for, you also cache, as part of the design: you keep a copy on the near side of the small high-latency pipe. But that's mostly about file transfer, not interactivity.

    UUCP was definitely made in a time where a latency of days for delivery of email or netnews was common.

    In the early days of CGI, the Web was just one way people imagined interacting with applications; another way was email. RFC 3834 has some recommendations for people who are going to automate email responses. There used to be services you could email a URL to, and receive the web page back as an email.

    Using ed (in my experience) involves looking up the screen, or up the roll of paper on your teletype, to see what the lines of your file were, and imagine what they are now, given the changes you've wrought to them since they were printed, and then turn them into what they should be. With Mars rovers you have a simulation that you issue your command to, before sending it off to Mars. With correspondence chess you might keep a physical chessboard for each game you have going, and/or send a form back and forth that keeps track of several moves.

    People used to do computation at universities and businesses by writing programs at their desks, submitting them to be typed on punchcards, and receiving printouts some time later. They would "desk check" their programs before sending them in, because each compute job took a couple days to come back.

    I mention all these because, in an extreme censorship environment, any local state (session history on paper, an app on a smartphone, an odd device) might not be good to have around. So usability may require reducing the total amount of state that a command carries. The current working directory at the time a command is run changes the meaning and outcome of the command; you may not remember that directory in a day or two. The vocabulary and syntax of command-line switches are easy to look up in online manuals - but are there offline manuals? I don't know if this avenue of inquiry helps you, but it's interesting to think about for a moment.

  • Long term ergo-mech keyboards reviews
  • I've been using a tshort dactyl manuform 4x6 for 5 years now, having never planned to use it for even 1 year. I only commonly use the two innermost thumb keys; I didn't think I would like the thumb cluster from watching a video of someone typing on it, and I indeed don't like the thumb cluster. The switches are Kailh Brown; one of them started to stutter and I replaced it with ... a TTC Brown or some such.

    I've printed, but not finished, a Splaytyl. I think it's going to feel nice, but it's only 4x5, and I'm nervous about not having Tab and Enter on the base layer.

  • Long term ergo-mech keyboards reviews
  • Colemak DH represent!

  • easy 6502 or Z80 emulation
  • CollapseOS used to emulate the Z80 using... libz80, i think it was called? lib6502 is also a thing.

  • tiled-wallpaper-archive
  • Sure, go ahead :)

  • tiled-wallpaper-archive
  • The Gemini capsule is yet to be done, but the wallpapers are available at https://j.agrue.info/wallpapers/

  • tiled-wallpaper-archive
  • This post inspired me to go find the tiling wallpapers I made 20 years ago. I almost made a pull request about it, but then decided not to, because it's GitHub. My wallpapers used to be on my own website, and now I'm going to make a Gemini capsule and put them up on that.

  • Carrying Case?
  • Yeah, I did one for my Dactyl Manuform and just oversized it by a couple millimeters and stuck Amazon bubbly envelopes on the inside. The bottom of each half is flat, the same shape, and rubberized, so the covers just go over the top, I clap the bottoms together (tee hee?), and chunk the whole thing in a lunch bag that barely fits. It stays together without slipping and without any attachment between the two cover halves. Janky but it's worked for years.

  • Carrying Case?
  • That's beautiful!

  • Carrying Case?
  • I 3d-printed a hard box for my Fourier. https://gitlab.com/jaredjennings/fourier-box. (wince, there is no photo nor even an STL in that repository.) I wanted it to fit in my backpack with a laptop and books, so it holds the two halves side by side, not stacked. I had to print it in two pieces and friction-weld them together. That sounds fancy, but it just means you take a piece of filament, put it in a Dremel chuck, and draw on your model. Wherever you push down, the friction makes the end of the filament melt. Then I put on some Sci-Grip 4 (dichloromethane), which further solvent-welded the joint.

    If you wanted to make one like this for your cepstrum, you'd need to do it in more pieces because that's larger than a Fourier. Your case would end up to be the size of a laptop. You might not want that.

  • Security Control Frameworks
  • They are made (I think) to be implementable - even, to give implementors some flexibility. Then everybody goes and buys a tool to do it, and not that well. I thought 15 years ago that security configuration was a (voluminous) subset of system configuration and system administration, ripe for automation and rigorous documentation - not something to pay a different vendor for. But the market says otherwise. When you can split some work across a whole team, or even into a separate company, instead of glomming it into one job, that's worth money to businesspeople.

  • 8 bit era but with 3.5" floppy drive?
  • The C128 has a Z80 too ;) I don't reckon there was an SX128 though

  • jaredj jaredj @infosec.pub
    Posts 0
    Comments 33