LedgeDrop
@LedgeDrop@lemm.ee
- Comment on Java at 30: How a language designed for a failed gadget became a global powerhouse 1 week ago:
Preach it! 🙌⛪
- Comment on Google is going ‘all in’ on AI. It’s part of a troubling trend in big tech 2 weeks ago:
In regard to Linux users being left out in the cold… how so? Do you think that distros are going to start enforcing attestation? I doubt that it will be a hard requirement for most, even in the next decade or two. It’s an option, yes, but mandatory?
It does not matter if Linux supports attestation or not, because ultimately the application (or website) will determine if it wants to run on Linux. It’s up to the company developing it’s application or website to determine if they want to support more than windows/Mac.
Graphene has its own variation of attestation (they cryptographically sign requests with their own key - and not googles), but it requires additional hoops for each application - few companies are willing to do this.
Attestation is a wet dream for companies. You don’t need DRM (as the OS will enforce it) and you can be certain your competitors/hackers cannot reverse engineer/pirate your code or run the application in an emulator. And the implementation effort to support it, is as simple as “make function call and check the response”.
Linux will still exist (especially on the server side) and developers will still use it as a desktop machine. However, (as I implied) non-Linux games will stop working, accessing you banks website from linux will be rejected, emulation will cease - it’ll be a corporate paradise… the stocks will go up.
FWIW, all of my banking apps work just fine with compatibility mode enabled on Graphene.
Revolut explicitly goes out of their way to not work on Graphene.
I’ve complained, they don’t care. The bean counters have done their risk calculations and decided that the personal data they collect/mine (and the integrity of that data) is worth more than losing a few graphene users.
Also, I’m not sure saying it’s inevitable is the right way to go, it certainly won’t make others care about their privacy and security.
You do have a valid point: giving up after trying nothing won’t help. However, I fear there will need to be “government intervention” to allow hardware and software to be “open for everyone”. I’ll admit my bias in wonder how well governments (of late) are representing the best interests of the people. But, these topics are complicated for even technically inclined people - let alone politicians. And the strawman argument against intervention is always going to be “in the name of security”.
From my perspective, the writing is on the wall. This apocalyptic future won’t happen over night, but it will be a slow boil over the next 10 years (or so).
If you’ve got ideas for how to avoid this, I’m all ears.
- Comment on Google is going ‘all in’ on AI. It’s part of a troubling trend in big tech 2 weeks ago:
Nothing I can do to resist?
I admire your optimism, but we are pissing in the wind.
Microsoft is shoving this copilot in all its products? Alright, Linux and open source it is.
Windows 11 is forcing people to throw away functional computers that Microsoft seems “not secure enough” (it’s lacking TMP 2.0)
This means you can get a great deal on one of these “inscure pc”… but in the long run your pc now and tomorrow will have TPM. As time progresses, the use of TPM/attestation will become more and more entrenched in application, web pages, everything. … and Linux, with its 4% user base, will be left out in cold.
Google is bugging with its spyware? Well, I only use a Pixel phone, and ironically, its the best phone to put GrapheneOS on it.
Currently, many banking apps won’t run on Graphene (or any custom firmware) due to attestation.
Graphene issued calls for help, because Google is restricting public access to the latest android source code (I cannot find the links atm).
Gmail? I don’t remember when I opened mine the last time…
Today things like “email reputation” make it difficult to host your own mail server, so your stuck paying someone who has a better “reputation”.
My point is: today, you and I can resist with some (minor) success, but our days are numbered.
- Comment on Forced E-Waste PCs And The Case Of Windows 11’s Trusted Platform 2 weeks ago:
I suspect they may not try to pull the entire trap closed all at once and that Windows 11 may continue to more or less function as we’ve seen past iterations
Microsoft will be taking a page from Google playbook. Google has be gradually reducing the “openness” of their android platform. They now have these “security checks” enforced on android. Meaning that it’s trivial for an application to determine if the phone a “genuine android” or not.
This’ll trickle into webbrowser too (if it’s not already in browsers like chrome). It’s only a matter of time before web pages will be able to determine if they’re running on a “secure OS” and fail to run. It’ll start out with your banking website, then expand to shopping websites, ultimately every page will enforce it (“oh, I see you have an unauthorized browser plug in installed. We care about your security, therefore we won’t run. Please restore your device to it’s secure defaults.”)
This future is so horrible and Linux with its 4% market share won’t change anything.
- Comment on Windows 10 LTSC – the version that won't expire for years 1 month ago:
Well, unless this is an offer to buy me a replacement Quest or Pico (all of which, work on Linux) “yes, I’m going to stay with Windows 10” (and/or maybe dual boot).
- Comment on Windows 10 LTSC – the version that won't expire for years 1 month ago:
… because I have a Samsung Odyssey+ VR headsets, which needs “Windows Mixed Reality” (Windows VR) and was gutted/removed from Windows 11 (and doesn’t work on Linux).
- Comment on TLS Certificate Lifetimes Will Officially Reduce to 47 Days 1 month ago:
I have mixed feelings about this.
On one hand, I agree with the technical merits. Having an automated process to renew short lived tls certs is “a good thing” and I think services like Let’s Encrypt have demonstrated such automation is viable (at large scale).
But, there are reasons why people pay money for tls Certs rather than use free (short lived) Certs. For example, there’s a mom-and-pop webhosting company that allows you to upload your tls Certs (they cost < $25 / year) or you can pay them $95 / year to use their Certs (and they just use Let’s Encrypt - lol)
The nearly 4x markup is their “convenience fee” or “dumb tax”. Regardless, once the 45 day tls Certs are enforced, I’ll have no choice in either paying their 4x markup or migrating to another platform.
… Having a choice is not always a bad thing…
- Comment on Internet forums are disappearing because now everything is Reddit and Discord. And that's worrying. 2 months ago:
Yeah, bring back Usenet! (rabble, rabble, rabble) /s
- Comment on Microsoft Outlook servers down, reports say 3 months ago:
I just laughed and said oh well that’s what you get when you moved from on prem to cloud.
Our Techs said that you couldn’t buy on-perm exchange anymore. You needed to go with the cloud subscription, which “includes” all the crap you don’t want: like Teams.
Atleast, they said didn’t make financial sense to pay for Google Workspace + Slack + Cloud Exchange, when MS offered their (lesser) services as a bundle (but the human suffering is real) :(
- Comment on Linux royalty backs adoption of Rust for kernel code 3 months ago:
What?!? Actually, read the article? What is this, Reddit? /s
Seriously, though - let me spin the question around: what, in your mind, overlaps with what Greg said?
(plus, OP was just interested in people opinions - not whether they align/contradict with Greg, Linus, etc)
- Comment on Linux royalty backs adoption of Rust for kernel code 3 months ago:
Oh absolutely, but you could argue the same for learning lisp or mastering any functional programming language (list comprehensions, etc). It will improve your design patterns when you go back to an object oriented language with some elements of functional programming.
- Comment on Linux royalty backs adoption of Rust for kernel code 3 months ago:
In my mind, introducing Rust would only make sense if:
- There was a serious lack of current kernel developers (which I don’t think there is)
- New hardware and tech was evolving at a rate that the Linux Kernel could not keep up (again, I don’t think this is am issue)
- The end goal is to migrate the entire Kernel to Rust.
Regarding point 3, having both C and Rust really only makes sense as a transition phase (measured in years) - as it would require kernel developers to be savvy in both C and Rust, or would force developers to stay within whatever domains were implemented in C or Rust.
- Comment on LemmyLink - A Reddit to Lemmy Bridge Bot 4 months ago:
How about have the bot detect community posts and try to funnel the conversations into one post.
I fear, this “to be created” “sync feature” is going to create a lot of noise.
- Comment on Let's Encrypt Ending Support for Expiration Notification Emails 4 months ago:
It’s more than needing a reminder: Let’s Encrypt Certs are valid for a maximum of 90 days before they need to be reissued. Doing this 4 times (or more) a year, for years on end will be tedious and error prone.
Most tools that request and install Let’s Encrypt Certs automatically do this without the need for human interaction (30 days prior to the expiration) . Actually, they work so well you don’t notice the “behind the scenes work” that’s happening.
The problem is when this renewal process “stop working”. I’d been using Let’s Encrypt for years w/o problems, but eventually the client I was using wasn’t updating and it was using a deprecated Let’s Encrypt API. Ultimately, the cert stopped updating, but I got the email reminder from Let’s Encrypt and I was able to fix it w/o a disruption.
Now, this was just a server for personal use. So if the SSL cert expired, it would not be the end of the world. Plus, I would have gotten a bunch of SSL errors the next time my client was trying to sync data, and I probably would have dropped everything to fix it. But the email reminder was a convenient feature, which allowed me to fix it whenever I had time.
That said, if Let’s Encrypt wants to save some money for their free service, I’m certainly not going to complain (although I will miss it).
- Comment on Making a Blocklist to Remove Spam from Search Engines 4 months ago:
Fantastic! Thank you for sharing this.
I have it installed, I’m curious how effective it will be.
Lately, I’ve been reporting AI generated cruft as “spam” to duckduckgo. In fact, it’s not really spam - as there are some nuggets of useful information, but so sparse, I’d rather of skipped the article/website entirely. I hope these kind of Blocklists will evolve to include this kind of quasi-spam.
- Comment on Half-Life 2 is currently 100% off for its 20th anniversary, plus a major update 6 months ago:
There’s also the “Unofficial Half Life 2 VR - unleashed”, which looks really exciting (I haven’t tried it yet).
- Comment on Broken thumbnails in lemm.ee? 7 months ago:
I think it’s related to this issue (re: lemm.ee is fetching and caching images (to improve performance) , but often get is throttled (because the Lemmy’s cache implementation was not designed to work with larger Lemmy instances ), which results users seeing broken images).
- Comment on Google Will Pause Ads Related To Elections After Polls Close On November 5th. 7 months ago:
Facebook, now it’s your turn…
- Comment on Concerns Raised Over Bitwarden Moving Further Away From Open-Source 7 months ago:
It’s the “stringing it all together” that could be problematic.
If you have multiple clients (desktop/cellphone) modifying the same entry (or even different entries in the same “database” ). You need something smart enough to gracefully handle this or atleast tell you about it.
I did the whole “syncing” KeePass and it was functional, but it also meant I needed to handle conflicts - which was annoying. I switched and really appreciate the whole “it just works” with self-hosted bitwarden.
- Comment on Seeking feedback: how should lemm.ee move forward with external images? (related to frequent broken images) 7 months ago:
It’s sad, but I think you’re right.
I assumed/hoped that Lemmy’s architecture was more decoupled.
According to the ChangeLog, it hints that the image reverse proxy is built-in, maybe using Pict-rs.
Which certainly reeks of Not Invented Here Syndrome, as image uploading/storing, reverse proxies, and caching is a well understood problem.
- Comment on Seeking feedback: how should lemm.ee move forward with external images? (related to frequent broken images) 7 months ago:
Wow, thanks for the full transparency. You are awesome!
My opinion would be option 2 (proxy requests) , but with a higher cache TTL or simple a LRU (Least Recently Used) Cache.
If you’re getting throttled, it could be mitigated by increasing the cache retention period (or improving the cache hits).
Another improvement : Would it be possible to change the proxy, so that if the proxied requests are throttled, it simply sends the user a http-302 to the origin (instead of a broken image)?
Regarding option 1 (full cache) : I greatly appreciate your desire to hide/protect your users ip, but it is outside the scope of what I expect from a Lemmy server. Maybe you could market and upsell this increased privacy as a subscription based feature. However, if I want privacy - I’ll use a VPN.
Regarding option 3 (User fetches content from origin) : From a users perspective, I really don’t want my Lemmy experience to be based on hitting a bunch of (potentially) unreliable services. When I, as a lemm.ee User, request a post from Lemmy.world (for example), lemm.ee will proxy and cache that post and the comments. This is the distributed nature of Lemmy (as far as I understand). Why restrict this caching to just posts/threads/comments and not include images (which, let’s face it, are as meaningful as pure text - especially wrt memes).