Creat

@Creat@discuss.tchncs.de

• ⁨Comment⁩ on ⁨A decline in arable land⁩ ⁨⁨3⁩ ⁨weeks⁩ ago⁩:

  Germany looks like a dead straight line, yet the text says it could see a large drop by 2030. Sure, it could also see a large rise in arable land, no reason or context is given.

• ⁨Comment⁩ on ⁨Microsoft retires WordPad after 28 years — app no longer available as of Windows 11 24H2⁩ ⁨⁨1⁩ ⁨month⁩ ago⁩:

  I’ve used windows since the 90s. Not once have I intentionally used WordPad.

  It did open by default for some file types for a long time (.doc), usually mangling the content cause it couldn’t actually handle them properly. I think it was also the default for .txt files at some point, causing many curse words when editing plain text files, that invisibly weren’t so plain any more after… Programs expecting a configuration fine really don’t like that sort of thing.

  So: I’m very ok with this. Just install LibreOffice or something if you needa Word-like experience. Install notepad++ for anything “plain”.

• ⁨Comment⁩ on ⁨Is this an accurate diagram?⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  The “key” of an m.2 defines what the pins mean, basically what signal they carry (PCIe, USB, …). There’s a nice table here, if you scroll down a bit. Some are extensions to others, and are pin compatible (meaning the things they have in common are on the same pins).

  A key and E key are very similar, while E just provides a few more interfaces, but importantly A doesn’t provide anything the E doesn’t. So any card that can work in A can also work in E. This is why A+E is so common: they don’t require the Mainboard to provide E, only A, but both will work so both notches are present.

• ⁨Comment⁩ on ⁨Apple relents and approves Spotify app with EU pricing⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  So it’s fully on brand for Apple then?

• ⁨Comment⁩ on ⁨AI Music Generator Suno Admits It Was Trained on ‘Essentially All Music Files on the Internet’⁩ ⁨⁨3⁩ ⁨months⁩ ago⁩:

  Are you taking about patents? Cause a works without copyright doesn’t sound very fun to me. Or anyone in a remotely creative job.

  Ever for patents: There’s a reason innovations are protected literally anywhere in the world, but the durations being ever longer is a real problem (5 years would probably be fine). The basic concept is still just straight up necessary.

• ⁨Comment⁩ on ⁨Sonos CEO apologizes for disastrous rollout of new app⁩ ⁨⁨3⁩ ⁨months⁩ ago⁩:

  And that is why we don’t buy things that depend on proprietary apps and/or cloud connectivity. Can’t break my shit if it’s local only.

• ⁨Comment⁩ on ⁨How ordinary failure could have a seismic effect on an industrial giant⁩ ⁨⁨3⁩ ⁨months⁩ ago⁩:

  This is still not an ordinary failure by your definition of it being a single point that failed. It’s was like half a dozen “things” that went wrong for that plane to get into the air without those bolts. From not putting them in, to missing inspections, missing cross-checks. Sounds extraordinary to me. Which is the whole point of why it’s a deeper issue, showing systematic problems at Boeing and it’s partners, and the FAA not doing it’s job, too.

• ⁨Comment⁩ on ⁨[Gamers Nexus] Intel Needs to Say Something: Oxidation Claims, New Microcode, & Benchmark Challenges⁩ ⁨⁨3⁩ ⁨months⁩ ago⁩:

  It’s also numbers. YouTube has given creators tools to literally benchmark thumbnails. You can just see which one does better. The vast majority of people unfortunately are susceptible to the same patterns. In the end, you need people to click on your video or they can’t watch it (which is the point here, to inform people). So here we are.

  For example, thumbnails with faces work much better than without (doesn’t really matter what or who the face is). I find that monumentally stupid and weird, it just is what it is.

• ⁨Comment⁩ on ⁨Why haven't car manufacturers standardized automatic brake lights when a built in accelerometer detects deceleration?⁩ ⁨⁨4⁩ ⁨months⁩ ago⁩:

  That is indeed US-specific. I’m in the EU, and here it’s defined by when and how it’s switched. Specifically, it is required to be tied to the brake pedal (i.e. then intention to brake) and/or the hand brake being pulled. It is not allowed to illuminate otherwise. But the exact specifics probably also vary by country here. That’s why I emphasized that part.

• ⁨Comment⁩ on ⁨Why haven't car manufacturers standardized automatic brake lights when a built in accelerometer detects deceleration?⁩ ⁨⁨4⁩ ⁨months⁩ ago⁩:

  Oh yes, that sounds right. Thanks!

• ⁨Comment⁩ on ⁨Why haven't car manufacturers standardized automatic brake lights when a built in accelerometer detects deceleration?⁩ ⁨⁨4⁩ ⁨months⁩ ago⁩:

  Because there are laws that specify when the brake light has to come on, and it isn’t when the car shows down (slightly). You could be starting to go up hill, or a list of other reasons. The point of brake lights isn’t too signify the car slowing, but that the driver intends to slow down. Which is also why it doesn’t come on if you’re motor breaking" (is that the right term?).

  This obviously varies wildly depending on where you are in the world. I’m also sure there are some places where it would be allowed.

• ⁨Comment⁩ on ⁨China building two-thirds of world’s wind and solar projects⁩ ⁨⁨4⁩ ⁨months⁩ ago⁩:

  Doesn’t China have like 95% of the world’s solar production by volume it something? Not sure if that changes anything about the statistic though.

• ⁨Comment⁩ on ⁨Authy got hacked, and 33 million user phone numbers were stolen⁩ ⁨⁨4⁩ ⁨months⁩ ago⁩:

  As far as I’m aware, the aegis database format is only used by them. You also can’t do an automatic import (only export), so keeping multiple systems in sync (particularly more than 2) can only be tedious.

  If that’s what you’re after, just use a KeePass database, in particular if you’re already using one anyway. Most clients can sync with a remote storage (like Keepass2Android or KeePassXC on multiple platforms), and I do mean real sync: Both sides can have modifications, and it’ll consolidate them correctly (of course unless both have modified the same entry, then you’ll be prompted). Just throw the database onto a nextcloud or something, as the clients can also usually talk to that directly without another app doing the file transfer (at least Keepass2Android can).

  BitWarden has a pretty good reputation, and is a frequent recommendation as well. But then again, so was Authy… With your own VaultWarden as the backend (if you can easily host that yourself) it would be a no brainer as a near universal solution. And this would probably also be “secure enough” for normal, everyday purposes. It can import and export a KeePass database btw, if that helps.

  Since I haven’t actually said anything about how I’m handling this, here’s a quick summary: Critical accounts use a complex password (stored in my password manager) and the 2FA is only stored in Aegis. There are generally backup codes on paper stored “somwhere safe”, if this is supported by the service (google does, steam does, …). On any account that just happens to require 2FA, but I don’t use it for anything critical, the TOTP is just stored inside my password manager, for convenient auto-filling. Examples are a Twitch account (I don’t stream, I just happen to have an account for chat and stuff). My password manager is also KeePass-based and used on multiple systems, sync’d via nextcloud and with a mf’er of a password (plus an additional factor). I generally don’t reuse passwords anymore, at all, ever: They are generated, at least 24 characters long (usually longer) unless the service prohibits passwords of that length (yes, this happens, surprisignly often actually). The password database is of course backed up in like 3+ different locations, and some are located somewhere physically different (i.e. not at home).

• ⁨Comment⁩ on ⁨Authy got hacked, and 33 million user phone numbers were stolen⁩ ⁨⁨4⁩ ⁨months⁩ ago⁩:

  Well to be frank, the fact that you’re asking this shows you haven’t really understood what makes something secure or insecure, or it isn’t as important to you as you claim. If you want your stuff to be secure, your phone is the only “thing” that generates the 2nd factor. Especially things that are critical shouldn’t have duplicate devices being able to also generate codes. If you do want to generate codes for less critical accounts somewhere else, you should register a 2nd TOTP generator with that service and use one each per other machine. That way, if something gets compromised, you can just revoke those devices preventing any damage without having to re-setup existing 2fa again for the devices that weren’t compromised.

  Now aegis is Android only, like you said. It also has no way of syncing with another instance (by design). It’s local only, it can just do backups. Having it send the highly critical information anywhere kind of defeats the security-purpose of it being local only. It adds a whole communications protocol that has to be secured, and somehow you have to authenticate the other side and so on. This also probably doubles the complexity (or at least size of the codebase) for the project, which then makes audits harder et cetera.

  Now for an actual answer: Most password-managers can also generate TOTP codes, like KeePass or KeePassXC to name two open source ones. But it’s their secondary purpose, with the primary obviously being storing the passwords. I’m not going to get into the implications of storing a TOTP code generator secret together with the password of the account it protects, let’s just say there are some. Since the actual secrets are stored in a (secured) database, you can sync these between devices. Or you can just create multiple TOTP generators for a single service and keep them separate.

  Or we circle back to something server based, like BitWarden, which is primarily a password manager but also does TOTP. It’s a commercial, server based solution that is free for individuals. I’m not sure what the current limitations are for those accounts, like number of entries or just who you can share stuff with and so on. There is a open source implementation of their protocol called VaultWarden, where you can self-host the back end and not rely on the company securing their servers properly (and/or not being collateral damage in a breach of some kind). Again, combining password + TOTP-storage in the same service that is accessible online should be done with considerable thought to how it’s secured, but you could use this to only store the 2fa aspect as well.

• ⁨Comment⁩ on ⁨Authy got hacked, and 33 million user phone numbers were stolen⁩ ⁨⁨4⁩ ⁨months⁩ ago⁩:

  2a. No 2fa, so this is a reduction in my current security

  That’s open to interpretation. Your current solution you thought was secure, but you used a service that as it turned out had bad security practices, which you just didn’t know (arguably couldn’t know). ANY online/cloud service that you don’t host yourself has this issue with being a black box of unkown quality. Any online service you do host has to be secured by you (or you need to trust that the base setup of that tool is “sufficiently secure”), and is in essence limited by your knowledge of the tool and technology used. Also if you’re reusing any passwords, anywhere, just stopping that practice is likely more secure in practice compared to 2fa in isolation.

  2fa in general isn’t just plaing “better” than not having it, security is rarely this black and white. It also depends on what is allowed to be the “second factor”, and since yours included SMS, it really wasn’t secure at all (like others have also mentioned in this thread). And it depends on the password of course. For example if you use a really secure password (30+ characters), and don’t reuse it, it will in practice be more secure than a short(ish) password and a 2nd factor that allows SMS. Generally 2 factor is used as a term for 2 categorically different athentication methods: one thing you know (password, pin) and one thing you own (phone, physical device/key, or a file works too). The problem is that SMS doesn’t require your phone. It’s incredibly easy to get the SMS without having your phone (even easier with physical proximity) or flat out faking owning your phone number (dpends on a lot of factors how easy or hard that is in practice, doesn’t require physical proximity). Basically, if someone actively targets you and/or that account secured by SMS 2fa, it isn’t overly hard, but it’s good enough at preventing giving access through a data leak for example.

  So, back to the security of “solution 2a”: how would someone get access to a long password you don’t use anywhere else, that isn’t written down anywhere (or nowhere accessible), and where you essentially never need to use/access the account in the first place? Nobody would even know that whole account exists unless you specifically tell them, let alone knowing how to get in. Note that this can also be combined with the concept in solution 4, so you’re then using it to only restore a single 2fa code. So that “safety net fallback account” very rarely needs to be updated with a newer Aegis-Backup, making it even more obscure/unknown. That 2fa code then lets you access your normal account and backups, and you restore the full suite of 2fa you need.

  It boils down to this: local 2fa with a backup means you need to get access to a single file to securely restore full access to everything. That file can be transmitted insecurely (due to strong cryptography and hopefully a good password not used anywhere else), but I wouldn’t store it out in the open either. On the other hand, any cloud based solution is an inherent black box. You trust them to properly do things, and you only know they didn’t once it’s too late (like Authy). It also means they are, by nature of what they do (storing account access information), a target and if the attacker is successful, you’re the collateral without having been explicitly targeted. Maybe there are sevices out there that let third parties audit their security and publish the results, but I don’t know of any and it would probably increase the price by an prohibitive amount for most people.

• ⁨Comment⁩ on ⁨Authy got hacked, and 33 million user phone numbers were stolen⁩ ⁨⁨4⁩ ⁨months⁩ ago⁩:

  Well I thought this was kinda obvious what I meant, but I guess not. What you say is a requirement (sms recovery of a cloud account) is just one of many solutions to your specific problem. I’ll just list off a few solutions below that involve neither SMS (the most insecure communication method in common use today) and only optionally a cloud account. For cimplicity sake I’ll stick to Aegis, where you can create password-protected local backups you can then put wherever you want. This password needs to be very strong for obvious reasons: I would recommend a long sentence (40 characters or more) that you can just remember, like a quote from a movie/tv show/book/poem or something, including normal punctuation as a sentence for example.

  Solution 0: This is more of a trivial solution I wouldn’t actually recommend. You can allow account recovery via eMail and have your eMail not use 2fa, but a long/good password so you can login from memory (see above). This is probably more secure than SMS for the recovery-case, but less secure for the everyday use case of eMail, therefore “not recommended”.

  Solution 1: USB Sticks are tiny, as in the size of a USB port (slightly longer but slimmer for USB-C). If you want to have a backup “on you”, I’m sure you can find a place where it wouldn’t get robbed with the phone/wallet. A tiny pocket somewhere, a string around your ankle, make a compartment in your shoe, or just have it with your luggage at the hotel. I’m sure you get the point. You get your new phone, you plug in the USB, you install Aegis and restore the backup.

  Solution 2a: Dedicated “online” storage. This can be self hosted, or a free account of any cloud provider, but the important part is that it does NOT require 2FA and you do NOT use it for anything else. You have the backup in there. It also needs a very secure password (again: long, but easy to remember, no garbled letter nonsense), but obviously not the same as the Aegis-Backup. So you now need to remember 2 long passwords. You get your new phone, you log in, get the backup and proceed as usual.

  Solution 2b: If not having 2FA is not an option for the solution above, you can have a friend/family store the 2FA on his phone. To log in, you go to the login page and enter your password (which your friend doesn’t need to know), and you ask him over the phone for the current 2FA-Code, which he tells you and you can log in, download the backup and proceed as above. I assume such a high security isn’t that critical, since you have been using something involving SMS. Restore then goes as per usual.

  Solution 3: Store the whole backup with a friend and when you need it he just temporarily puts it somwhere you can access, and removes it again after. Since the backup is protected by a monster of a password, and the accessibility is temporary anyway, this isn’t security critical.

  Solution 4: If you absolutely must, you can find a cloud-provider for 2FA, and use it only as the “first stage”. The only 2FA code in there is the one you need to get access to your main online storage/account where you then have your real Aegis-Backup and/or other files. Obviously this service would need to allow you to login without 2FA, and the usual password rules resulting fom that apply. You can just add the 2FA of your primary service to more than 1 app or service, or if it allows for this, you can generate multiple authenticators so you can also revoke them serperately if needed.

• ⁨Comment⁩ on ⁨Authy got hacked, and 33 million user phone numbers were stolen⁩ ⁨⁨4⁩ ⁨months⁩ ago⁩:

  The point is you physically and locally back up the database. Put it on your computer, or a flash drive or whatever. You can set a different, longer password for backups, and I would recommend you do that. When you get your new phone, you just copy the database into it and load it into a freshly installed Aegis. You don’t even need to self host anything, there is nothing to host.

  Not everything needs to be “in the cloud”. I think this event illustrates nicely why.

• ⁨Comment⁩ on ⁨Anyone had success with RepRap projects?⁩ ⁨⁨4⁩ ⁨months⁩ ago⁩:

  I think the typical recommendation would be “the 100” (Link to GitHub). There are a few other projects like it. I think that should be a good starting point for a search though if that particular one is not your cup of tea.

  We’re in the age of easily accessible, great quality hardware though. Just from a performance point, 3d printing will be worse in most respects comparatively (still “good enough” though if using a modem design). Look at a Voron V0 kit as an example (or one of the other printers for ants, if you’re looking for more complexity). Uses nothing but readily accessible parts, reasonably priced and incredible performance.

• ⁨Comment⁩ on ⁨Anyone had success with RepRap projects?⁩ ⁨⁨4⁩ ⁨months⁩ ago⁩:

  Any particular reason? That’s a 10 (ish) year old design. Outside of nostalgia or deliberately checking out designs from that era, I see very little reason to pick this as a project.

• ⁨Comment⁩ on ⁨domains on internal network⁩ ⁨⁨4⁩ ⁨months⁩ ago⁩:

  Another name, depending on the exact context, is “hairpin NAT”. Should make googling with the specific router OP has easier.

• ⁨Comment⁩ on ⁨Question about printing times⁩ ⁨⁨6⁩ ⁨months⁩ ago⁩:

  I’m sure the official slicer will have a good profile, maybe the speed for outer walls accidentally got changed to 1 mm/s? I don’t usually use Cura (that is what their slicer is based on), but I think to change speeds at all you need to hit “show advanced” or something? So if you didn’t change anything, that is even less likely.

  When I get back home I can try with your settings, probably just resetting everything should also work for you though.

• ⁨Comment⁩ on ⁨Question about printing times⁩ ⁨⁨6⁩ ⁨months⁩ ago⁩:

  Can you give us your basic info:

  • Which printer
  • Which slicer
  • What kind of profile
  • Which preset (if any)
  • What filament is selecte
  • did you change any settings

  and just posta screenshot of the sliced model that the slicer should show you, makes it much easier to recognize trivial errors like wrong orientation.

• ⁨Comment⁩ on ⁨Question about printing times⁩ ⁨⁨6⁩ ⁨months⁩ ago⁩:

  A good rule of thumb is to just always use 0.2mm layers unless you have a very good reason not to.

  That being said, this doesn’t explain your truly nonsensical time prediction. It would just be double, since you have twice the layers to print. Like someone said, a few hours would be reasonable, certainly less than a day even with very fine detail.

• ⁨Comment⁩ on ⁨27 Unhelpful Facts About Category Theory⁩ ⁨⁨6⁩ ⁨months⁩ ago⁩:

  Hehe no problem, I was just rather confused when I opened the video and it started at the end (or rather didn’t start, obviously).

• ⁨Comment⁩ on ⁨27 Unhelpful Facts About Category Theory⁩ ⁨⁨6⁩ ⁨months⁩ ago⁩:

  You posted a link with a timestamp, which points to the end of the video. Weird…

• ⁨Comment⁩ on ⁨Microsoft won't fix Windows 0x80070643 errors, manual fix required⁩ ⁨⁨6⁩ ⁨months⁩ ago⁩:

  Or you just runs the ps script provided by Microsoft. 1 line. No clue why they can’t do that themselves for affected systems…

• ⁨Comment⁩ on ⁨Why there are 861 roguelike deckbuilders on Steam all of a sudden⁩ ⁨⁨7⁩ ⁨months⁩ ago⁩:

  You know you can turn off the music, right? Just play your own or none at all.

• ⁨Comment⁩ on ⁨Google to shut down Keen, its experimental Pinterest-like social media platform⁩ ⁨⁨8⁩ ⁨months⁩ ago⁩:

  Literally never heard of it, which is probably the reason and kinda makes it a good call?

• ⁨Comment⁩ on ⁨Pager Lives Again Thanks To Python And Mastodon⁩ ⁨⁨8⁩ ⁨months⁩ ago⁩:

  Might want to look into LoraWan and similar.

• ⁨Comment⁩ on ⁨First game you played⁩ ⁨⁨9⁩ ⁨months⁩ ago⁩:

  Probably “ports of call” on PC. Still haven’t found an actual modern version of it. There were some half assed attempts in recent years, all with such huge flaws that they still haven’t managed to be considered “playable”.