Skip Navigation
Signal under fire for storing encryption keys in plaintext
  • If your computer is compromised to the point someone can read the key, read words 2-5 again.

    This is FUD. Even if Signal encrypted the local data, at the point someone can run a process on your system, there's nothing to stop the attacker from adding a modified version of the Signal app, updating your path, shortcuts, etc to point to the malicious version, and waiting for you to supply the pin/password. They can siphon the data off then.

    Anyone with actual need for concern should probably only be using their phone anyway, because it cuts your attack surface by half (more than half if you have multiple computers), and you can expect to be in possession/control of your phone at all times, vs a computer that is often left unattended.

  • Regex flavors
  • it doesn't unravel the underlying complexity of what it does... these alternative syntaxes tend to make some easy cases easy, but they have no idea what to do with more complicated cases

    This can be said of any higher-level language, or API. There is always a cost to abstraction. Binary -> Assembly -> C -> Python. As you go up that chain, many things get easier, but some things become impossible. You always have the option to drop down, though, and these regex tools are no different. Software development, sysops, devops, etc are full of compromises like this.

  • frame.work Introducing a new RISC-V Mainboard from DeepComputing

    We’re excited to share a preview of a Framework Laptop 13 Mainboard with a new CPU architecture.

    cross-posted from: https://lemmy.ml/post/17020181

    > Introducing a new RISC-V Mainboard from DeepComputing

    0
    frame.work Introducing a new RISC-V Mainboard from DeepComputing

    We’re excited to share a preview of a Framework Laptop 13 Mainboard with a new CPU architecture.

    Introducing a new RISC-V Mainboard from DeepComputing
    0

    I found the portion about studying people with this disorder leading to better understanding of visual processing in general pretty fascinating. Especially the part about the left/right processing and stitching.

    1
    Does the Google Ecosystem Actually Work? Pixel Fold + Pixel Watch + Chromebook Plus
  • I think this conflates "ecosystem" with "closed ecosystem" or "walled garden."

    I agree that closed ecosystems are frustrating lock-in tactics. But open ecosystems exist - KDE connect actually shows a good example. It was built for the KDE ecosystem (desktop environment, apps, and services that integrate and work well with each other), but makes the protocol open, so clients can exist for Gnome, and other platforms.

    I recognize this is mostly semantics, but wanted to call it out because I think the integration and interoperability afforded by an "ecosystem" is extremely user friendly in general. It only becomes a problem when it is weaponized to lock you in.

  • A fresh install of Signal takes up 410MB, blowing both Firefox and Chromium out of the water
  • "They" is the browser/browser maker. The browser, acting as the client, would have access to the keys and data. The browser maker could do whatever they want with it.

    To be clear, I'm not saying they would, only that it defeats the purpose of an E2E chat, where your goal is to minimize/eliminate the possibility of snooping.

  • A fresh install of Signal takes up 410MB, blowing both Firefox and Chromium out of the water
  • Using an E2E chat app in your browser necessarily makes the keys and decrypted messages available to your browser. They would have the ability to read messages, impersonate users, alter messages, etc. It would defeat the purpose of a secure messaging platform.

  • A fresh install of Signal takes up 410MB, blowing both Firefox and Chromium out of the water
  • This is not entirely correct. Messages are stored on their servers temporarily (last I saw, for up to 30 days), so that even if your device is offline for a while, you still get all your messages.

    In theory, you could have messages waiting in your queue for device A, when you add device B, but device B will still not get the messages, even though the encrypted message is still on their servers.

    This is because messages are encrypted per device, rather than per user. So if you have a friend who uses a phone and computer, and you also use a phone and computer, the client sending the message encrypts it three times, and sends each encrypted copy to the server. Each client then pulls its copy, and decrypts it. If a device does not exist when the message is encrypted and sent, it is never encrypted for that device, so that new device cannot pull the message down and decrypt it.

    For more details: https://signal.org/docs/specifications/sesame/

  • A good video to share with those who refuse to leave their bubble.

    3
    Photo Album Software (request)
  • "Desktop publishing" is the category of software you want. I've not used it, but I believe Scribus is the standard FOSS tool for this. If you want a simple graphical way to make your album, this is the way.

    Many people have metnioned LaTex - I would not recommend it for this purpose. LaTex, while powerful, will have a steep learning curve, and isn't really made for artistic tasks - its purpose is for writing technical papers. From literally the first two sentences on the project site:

    LaTeX is a high-quality typesetting system; it includes features designed for the production of technical and scientific documentation. LaTeX is the de facto standard for the communication and publication of scientific documents.

    It's probably possible to make a beautiful photo album with LaTex, but without a lot of work, it's more likely to come out looking like a calculator manual.

  • Black Kansas City teen Ralph Yarl sues white man who shot him for ringing the doorbell
  • Not to justify the actions of the shooter, but ringing the doorbell before breaking in is definitely a thing. It's a means of checking if the house is occupied - if you're just trying to steal things, an unoccupied house is ideal, and if someone answers when you ring, it's easy enough to make up an excuse and walk away.

    A much better solution than a gun, though, is a security door (similar to a screen door, but more kick proof).

  • Dell is so frustrating
  • Considering that you are not using their software, was the laptop worth the premium you paid for it, vs buying from Clevo directly?

    I figured the hardware and software coming from the same vendor would yield the best results, and wanted to support a company that supports right-to-repair, and Linux in general. But ultimately I found Pop!_OS buggy and had performance issues, so I'm not using their OS, and their firmware is causing issues with my SSD, so I'd like to be off of it as well (but was told "there's no process for reverting to the proprietary firmware“ for the specific model I have). I could have bought a Clevo directly, saving hundreds of dollars, and probably had a better working machine.

  • Dell is so frustrating
  • Would not recommend System76. I've had many issues with my machine (primarily software, related to their buggy custom firmware, and Pop!_OS, until I ditched that for stock Ubuntu). Their support has been terrible - rather similar to OP's, actually. I've had the laptop for about 2.5 years, and I'm checking practically daily for something to replace it.

  • Vivaldi explains why they will not embed LLM functionality in their browser
  • You are falling into a common trap. LLMs do not have understanding - asking it to do things like convert dates and put them on a number line may yield correct results sometimes, but since the LLM does not understand what it's doing, it may "hallucinate" dates that look correct, but don't actually align with the source.

  • Laptop companies: which one?
  • You might get lucky. Based on https://support.system76.com/articles/system-firmware/, it doesn't seem to be all models. Note however that the list is out-of-date; my galp5 is not listed, but does not work. Fortunately, I found this out doing a RAM check, and not a firmware upgrade.

  • Laptop companies: which one?
  • My usb-c ports can be a little touchy, too. The SD card slot is also really bad - the card has to be positioned perfectly to slide in, or it jams. I'm also upset that the usb-c port can only be used for charging after a full boot. It cannot be used to perform firmware updates, or even to do a ram test. This means day-to-day, usb-c can be used, but I have to keep track of the barrel charger, just in case. This, of course, was not specified on the product details page (nor, I think, that only one of the two usb-c ports could be used for charging - it's possible I overlooked that, but still frustrating on an expensive laptop that lists usb-c charging as a feature).

  • Laptop companies: which one?
  • I currently have a System76 laptop, and sincerely regret my purchase. When I purchased it, the Framework was not out yet - I wanted to support a company that supports right-to-repair, and figured since they controlled the hardware, firmware, and software (Pop!_OS), it would be a good, stable experience. It has not been, and support has generally been poor. I know other people have had better experiences than I have, but personally, I won't be buying from them again.

    I haven't personally used Purism, but former co-workers spoke really poorly of them. They were trying to buy a big batch for work, and said the build quality was awful. Additionally: https://youtu.be/wKegmu0V75s

  • Tips for getting contract work

    cross-posted from: https://lemmy.ml/post/11175824

    > Tips for getting contract work > > I'm looking for part-time and/or short term contract work, but having a hard time because all the major job sites have either no ability to filter, or the posters just select every option so their post shows up in every search. > > Does anyone have any tips on how to find this kind of work? Is it best to source it on my own, or are there good agencies to work with? > > I'm looking for any kind of developer roll (I've done backend and full stack), and am open to mentoring/tutoring as well.

    5
    Tips for getting contract work

    I'm looking for part-time and/or short term contract work, but having a hard time because all the major job sites have either no ability to filter, or the posters just select every option so their post shows up in every search.

    Does anyone have any tips on how to find this kind of work? Is it best to source it on my own, or are there good agencies to work with?

    I'm looking for any kind of developer roll (I've done backend and full stack), and am open to mentoring/tutoring as well.

    4
    Liftoff alternative
  • Not sure what landscape features you're looking for, but I've been pretty happy with Voyager. I switched from liftoff/jerboa after lemmy.ml took the 0.19 update and they broke. It's been good enough that I think even if the others hadn't broken, I'd still choose Voyager over them.

  • How do I "ls -R | cat | grep print" ?
  • grep -r string .

    The flag should go before the pattern.

    -r to search recursively, . refers to the current directory.

    Why use . instead of *? Because on it's own, * will (typically) not match hidden files. See the last paragraph of the 'Origin' section of: https://en.m.wikipedia.org/wiki/Glob_(programming). Technically your ls command (lacking the -a) flag would also skip hidden files, but since your comment mentions finding the string in 'any files,' I figured hidden files should also be covered (the find commands listed would also find the hidden files).

    EDIT: Should have mentioned that -R is also recursive, but will follow symlinks, where -r will ignore them.

  • First RISC-V mini laptops emerge
    www.notebookcheck.net First RISC-V mini laptops emerge: Sipeed Lichee Console 4A available for pre-order

    Sipeed's new Lichee Console 4A mini laptop features a 7-inch IPS touchscreen with 1280 x 800 resolution and is powered by a RISC-V CPU with 4 cores produced by Alibaba. It also supports up to 16 GB LPDDR4x RAM plus up to 2 GB NVMe SSD and 128 GB eMMC storage.

    First RISC-V mini laptops emerge: Sipeed Lichee Console 4A available for pre-order
    0
    Excellent channel for learning to train and use computer vision models

    I think this community is more LLM focused than computer vision, but I'm hoping it's ok to post this here.

    I struggled my way through getting tensorflow setup, and getting a model trained - it took about 10 hours over a few days, cross referencing different articles and videos, fighting to get protobufs compiled, and images/annotations converted to TFRecords. I finally got a basic model, but it was a nightmare, and I'm not sure I could figure it out again if I needed to.

    Then I stumbled on this guy's yolov8 object detection video. It was so easy. I had a trained model in less than an hour. I would highly recommend.

    Also worth noting - the ultralytics folks have been very helpful on their discord server.

    I'm not affiliated with the guy making the videos or the ultralytics team, I just wanted to plug them since they've been very helpful to me.

    If you want you dip your feet in, and you have any basic questions, feel free to ask them here. I'll answer any that i can.

    Edit:

    A quick note: In the video he uses an online tool for labeling - it looks like it can be installed locally, but it looks like a fair bit of work. I use label-studio which can be easily installed with pip.

    0
    InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)JO
    JoeyJoeJoeJr @lemmy.ml
    Posts 8
    Comments 71