My current rig:
- old android phone with GPS disabled
- external GPS device (NMEA over bluetooth)
- OSMand from f-droid for offline maps and navigation
- BlueGPS to connect to the bluetooth GPS device, grab the NMEA signal, and feed it as a mock location
- developer options » mock locations enabled
The idea is to save on phone battery so I can navigate more than an hour. The phone’s internal GPS is energy intensive because of all the GPS calculations. By offloading the GPS work to an external bluetooth GPS, the phone’s battery can be somewhat devoted to the screen because bluetooth uses much less energy than GPS. And NMEA carries lat/long so the phone need not do the calculations.
Not sure it actually works though.. been waiting for satellites for a while now. Anyway, I would like to know if this config can work on any FOSS platforms, like pmOS. Can OSMand run on pmOS or is there a better option? IIUC, Android apps are a huge CPU hog on pmOS because of emulation.
Ideally I would like to buy something 2nd-hand like a BQ Aquaris X5 and put pmOS on it. I’ll need a quite lean mapping and nav app that runs on pmOS, and also has the ability to use an external GPS.
For the first 15 minutes when satellites are taking forever to appear, I would like to use something like WiGLE WiFi Wardriving which makes use of wifi APs and cell towers the same way Google location does, but without feeding Google. Is there anything like that on pmOS, or any other FOSS phone platform?
Updates
Every mobile FOSS platform listed by the OSM project have been abandoned as far as I can tell. But perhaps OSM is just poorly tracking this because osmin and pure maps apparently both run on Postmarket OS:
- https://wiki.postmarketos.org/wiki/Osmin
- https://wiki.postmarketos.org/wiki/Pure_Maps
There is a network-dependent nav app called Mepo, but that would not interest me.
There is also Organic Maps which comes as a flatpak for aarch64. It requires the whole KDE framework which is fat in terms of size but probably not relying on emulation so it could perform well enough.
In principle the ideal archive would contain the JavaScript for forensic (and similar) use cases, as there is both a document (HTML) and an app (JS) involved. But then we would want the choice whether to run the app (or at least inspect it), while also having the option to offline faithfully restore the original rendering. You seem to imply that saving JS is an option. I wonder if you choose to save the JS, does it then save the stock skeleton of the HTML, or the result in that case?
wget has a --load-cookies file option. It wants the original Netscape cookie file format. Depending on your GUI browser you may have to convert it. I recall in one case I had to parse the session ID out of a cookie file then build the expected format around it. I don’t recall the circumstances.
Another problem: some anti-bot mechanisms crudely look at user-agent headers and block curl attempts on that basis alone.
(edit) when cookies are not an issue, wkhtmltopdf is a good way to get a PDF of a webpage. So you could have a script do a wget to get the HTML faithfully, and wkhtmltopdf to get a PDF, then pdfattach to put the HTML inside the PDF.
(edit2) It’s worth noting there is a project called curl-impersonate which makes curl look more like a GUI browser to get more equal treatment. I think they go as far as adding a javascript engine or something.
It’s perhaps the best way for someone that has a good handle on it. Docs say it “sets infinite recursion depth and keeps FTP directory listings. It is currently equivalent to -r -N -l inf --no-remove-listing.” So you would need to tune it so that it’s not grabbing objects that are irrelevent to the view, and probably exclude some file types like videos and audio. If you get a well-tuned command worked out, that would be quite useful. But I do see a couple shortcomings nonetheless:
- If you’re on a page that required you to login to and do some interactive things to get there, then I think passing the cookie from the gui browser to wget would be non-trivial.
- If you’re on a capped internet connection, you might want to save from the brower’s cache rather that refetch everything.
But those issues aside I like the fact that wget does not rely on a plugin.
The other thing is, what about JavaScript? JS changes the presentation.
Markdown is probably ideal when saving an article, like a news story. It might even be quite useful to get it into a Gemini-compatible language. But what if you are saving the receipt for a purchase? A tax auditor would suspect shenanigans. So the idea with archival is generally to closely (faithfully) preserve the doc.
IIUC you are referring to this extension, which is Firefox-only (likeunlike the save page WE, which has a Chromium version).
Indeed the beauty of ZIP is stability. But the contents are not. HTML changes so rapidly, I bet if I unzip an old MAFF file it would not have stood the test of time well. That’s why I like the PDF wrapper. Nonetheless, this WebScrapBook could stand in place of the MHTML from the save page WE extension. In fact, save page WE usually fails to save all objects for some reason. So WebScrapBook is probably more complete.
(edit) Apparently webscrapbook gives a choice between htz and maff. I like that it timestamps the content, which is a good idea for archived docs.
(edit2) Do you know what happens with JavaScript? I think JS can be quite disruptive to archival. If webscrapbook saves the JS, it’s saving an app, in effect, and that language changes. The JS also may depend on being able to access the web, which makes a shitshow of archival because obviously you must be online and all the same external URLs must still be reachable. OTOH, saving the JS is probably desirable if doing the hybrid PDF save because the PDF version would always contain the static result, not the JS. Yet the JS could still be useful to have a copy of.
(edit3) I installed webscrapbook but it had no effect. Right-clicking does not give any new functions.
MAFF (a shit-show, unsustained)
Firefox used to have an in-house format called MAFF (Mozilla Archive File Format), which boiled down to a zip file that had HTML and a tree of media. I saved several web pages that way. It worked well. Then Mozilla dropped the ball and completely abandoned their own format. WTF. Did not even give people a MAFF→mhtml conversion tool. Just abandoned people while failing to realize the meaning and purpose of archival. Now Firefox today has no replacement. No MHTML. Choices are:
- HTML only
- HTML complete (but not as a single file but a tree of files)
MHTML (shit-show due to non-portable browser-dependency)
Chromium-based browsers can save a whole complete web page to a single MHTML file. Seems like a good move but then if you open Chromium-generated MHTML files in Firefox, you just get an ascii text dump of the contents which resembles a fake email header, MIME, and encoded (probably base64). So that’s a show-stopper.
exceptionally portable approach: A plugin adds a right-click option called “Save page WE” (available in both Firefox and Chromium). That extension produces an MHTML file that both Chromium and Firefox can open.
PDF (lossy)
Saving or printing a web page to PDF mostly guarantees that the content and representation can reasonably be reproduced well into the future. The problem is that PDF inherently forces the content to be arranged on a fixed width that matches a physical paper geometry (A4, US letter, etc). So you lose some data. You lose information about how to re-render it on different devices with different widths. You might save on A4 paper then later need to print it to US letter paper, which is a bit sloppy and messy.
PDF+MHTML hybrid
First use Firefox with the “Save page WE” plugin to produce an MHTML file. But relying on this alone is foolish considering how unstable HTML specs are even still today in 2024 with a duopoly of browser makers doing whatever the fuck they want - abusing their power. So you should also print the webpage to a PDF file. The PDF will ensure you have a reliable way to reproduce the content in the future. Then embed the MHTML file in the PDF (because PDF is a container format). Use this command:
$ pdfattach webpage.pdf webpage.mhtml webpage_with_HTML.pdf
The PDF will just work as you expect a PDF to, but you also have the option to extract the MHTML file using pdfdetach webpage_with_HTML.pdf if the need arises to re-render the content on a different device.
The downside is duplication. Every image is has one copy stored in the MTHML file and another copy separately stored in the PDF next to it. So it’s shitty from a storage space standpoint. The other downside is plugin dependency. Mozilla has proven browser extensions are unsustainable when they kicked some of them out of their protectionist official repository and made it painful for exiled projects to reach their users. Also the mere fact that plugins are less likely to be maintained than a browser builtin function.
We need to evolve
What we need is a way to save the webpage as a sprawled out tree of files the way Firefox does, then a way to stuff that whole tree of files into a PDF, while also producing a PDF vector graphic that references those other embedded images. I think it’s theoretically possible but no tool exists like this. PDF has no concept of directories AFAIK, so the HTML tree would likely have to be flattened before stuffing into the PDF.
Other approaches I have overlooked? I’m not up to speed on all the ereader formats but I think they are made for variable widths. So saving a webpage to an ereader format of some kind might be more sensible than PDF, if possible.
(update) The goals
- Capture the webpage as a static snapshot in time which requires no network to render. Must have a simple and stable format whereby future viewers are unlikely to change their treatment of the archive. PDF comes close to this.
- Record the raw original web content in a non-lossy way. This is to enable us to re-render the content on different devices with different widths. Future-proofness of the raw content is likely impossible because we cannot stop the unstable web standards from changing. But capturing a timestamp and web browser user-agent string would facilitate installation of the original browser. A snapshot of audio, video, and the code (JavaScript) which makes the page dynamic is also needed both for forensic purposes (suitable for court) and for being able to faithfully reproduce the dynamic elements if needed. This is to faithfully capture what’s more of an application than a document.
wget -mpossibly satisfies this. But perhaps tricky to capture 3rd party JS without recursing too far on other links. - A raw code-free (thus partially lossy) snapshot for offline rendering is also needed if goal 1 leads to a width-constrained format. Save page WE and WebScrapBook apparently satisfies this.
PDF satisfies goal 1; wget satisfies goal 2; maff/mhtml satisfies goal 3. There is likely no single format that does all of the above, AFAIK. But I still need to explore these suggestions.
If you visit: https://12ft.io/$URL_to_pdf.pdf using a GUI browser, the raw PDF binary is dumped to the screen. There is no way to capture this. If you use wget it just gets an HTML wrapper. If you hit F12»inspect»element, you can derive a proper URL to a PDF and use wget on that. E.g.
wget 'https://12ft.io/api/proxy?q=https://mswista.files.wordpress.com/2015/04/typesofmemory_updated.pdf'
But the PDF is corrupt. There is no user-side hack here. The service is broken. Apparently the server is doing a character set conversion as if it’s ascii text.
(BTW, that sample URL above works fine without 12ft.io. It’s just an example to demo the 12ft.io problem. Of course when a PDF is walled off and I am forced to use 12ft.io, then I’m hosed)
The admin is only reachable in Twitter and Gmail, nethier of which work for me. The is a Mastodon bot at @thmsmlr@bird.makeup but that’s only good for following him. No way to report it to him AFAIK. Hence why I am posting this here.
I would never use the typical kind of shared bike that you can just leave anywhere because AFAIK those are exclusively for Google pawns. But the kind that have stations do not need an app. So I scraped all the bicycle station locations into a db & used an openstreetmaps API to grab the elevation of each station. If the destination station was a higher elevation than the source station, my lazy ass would take the tram. Hey, gimme a break.. these shared bikes are heavy as fuck because they’re made to take abuse from the general public.
It was fun to just cruise these muscle bikes downhill. I was probably a big contributor of high bicycle availability at low elevations and shortages in high places. The bike org then started a policy to give people a bonus credit if they park in a high station to try to incentivize more people going uphill.
Yeah I’m with you.. it was more of an attempt at humor. Although if you search around it’s actually common for people to ask how to check if their spouse is on dating sites.. which may be inspired by the whole Ashley Madison databreach.
I recall an inspirational story where a woman tried many dating sites and they all lacked the filters and features she needed to find the right guy. So she wrote a scraper bot to harvest profiles and wrote software that narrowed down the selection and propose a candidate. She ended up marrying him.
It’s a great story. I have no link ATM, and search came up dry but I found this story:
https://www.ted.com/talks/amy_webb_how_i_hacked_online_dating/transcript?subtitle=en
I can’t watch videos right now. It could even be the right story but I can’t verify.
I wonder if she made a version 2.0 which would periodically scrape new profiles and check whether her husband re-appears on a dating site, which could then alert her about the anomaly.
Anyway, the point in this new community is to showcase beneficial bots and demonstrate that there is a need to get people off the flawed idea that all bots are malicious. We need more advocacy for beneficial bots.
Does pdfinfo give any indication of the application used to create the document?
Oracle Documaker PDF Driver
PDF version: 1.3
If it chokes on the Java bit up front, can you extract just the PDF from the file and look at that?
Not sure how to do that but I did just try pdfimages -all which was not useful since it’s a vector PDF. pdfdetach -list shows 0 attachments. It just occurred to me that pdftocairo could be useful as far as a CLI way to neuter the doc and make it useable, but that’s a kind of a lossy meat-grinder option that doesn’t help with analysis.
You might also dig through the PDF a bit using Dider Stevens 's Tools,
Thanks for the tip. I might have to look into that. No readme.. I guess this is a /use the source, Luke/ scenario. (edit: found this).
I appreciate all the tips. I might be tempted to dig into some of those options.
Your assertion that the document is malicious without any evidence is what I’m concerned about.
I did not assert malice. I asked questions. I’m open to evidence proving or disproving malice.
At some point you have to decide to trust someone. The comment above gave you reason to trust that the document was in a standard, non-malicious format. But you outright rejected their advice in a hostile tone. You base your hostility on a youtube video.
There was too much uncertainty there to inspire trust. Getoffmylan had no idea why the data was organised as serialised java.
You should read the essay “on trusting trust” and then make a decision on whether you are going to participate in digital society or live under a bridge with a tinfoil hat.
I’ll need a more direct reference because that phrase gives copious references. Do you mean this study? Judging from the abstract:
To what extent should one trust a statement that a program is free of Trojan horses? Perhaps it is more important to trust the people who wrote the software.
I seem to have received software pretending to be a document. Trust would naturally not be a sensible reaction to that. In the infosec discipline we would be incompetent fools to loosely trust whatever comes at us. We make it a point to avoid trust and when trust cannot be avoided we seek justfiication for trust. We have a zero-trust principle. We also have the rule of leaste privilige which means not to extend trust/permissions where it’s not necessary for the mission. Why would I trust a PDF when I can take steps to access the PDF in a way that does not need excessive trust?
The masses (security naive folks) operate in the reverse-- they trust by default and look for reasons to distrust. That’s not wise.
In Canada, and elsewhere, insurance companies know everything about you before you even apply, and it’s likely true elsewhere too.
When you move, how do they find out if you don’t tell them? Tracking would be one way.
Privacy is about control. When you call it paranoia, the concept of agency has escaped you. If you have privacy, you can choose what you disclose. What would be good rationale for giving up control?
Even if they don’t have personally identifiable information, you’ll be in a data bucket with your neighbours, with risk profiles based on neighbourhood, items being insuring, claim rates for people with similar profiles, etc. Very likely every interaction you have with them has been going into a LLM even prior to the advent of ChatGPT, and they will have scored those interactions against a model.
If we assume that’s true, what do you gain by giving them more solid data to reinforce surreptitious snooping? You can’t control everything but It’s not in your interest to sacrifice control for nothing.
But what you will end up doing instead is triggering fraudulent behaviour flags. There’s something called “address fraud”, where people go out of their way to disguise their location, because some lower risk address has better rates or whatever.
Indeed for some types of insurance policies the insurer has a legitimate need to know where you reside. But that’s the insurer’s problem. This does not rationalize a consumer who recklessly feeds surreptitious surveillance. Street wise consumers protect themselves of surveillance. Of course they can (and should) disclose their new address if they move via proper channels.
Why? Because someone might take a vacation somewhere and interact from another state. How long is a vacation? It’s for the consumer to declare where they intend to live, e.g. via “declaration of domicile”. Insurance companies will harrass people if their intel has an inconsistency. Where is that trust you were talking about? There is no reciprocity here.
When you do everything you can to scrub your location, this itself is a signal that you are operating as a highly paranoid individual and that might put you in a bucket.
Sure, you could end up in that bucket if you are in a strong minority of street wise consumers. If the insurer wants to waste their time chasing false positives, the time waste is on them. I would rather laugh at that than join the street unwise club that makes the street wise consumers stand out more.
It’s interesting to note that some research “discovered thousands of vulnerabilities in 693 banking apps, which indicates these apps are not as secure as we expected.”
Don’t Canadian insurance companies want to know where their customers are? Or are the Canadian privacy safeguards good on this?
In the US, Europe (despite the GDPR), and other places, banks and insurance companies snoop on their customers to track their whereabouts as a normal common way of doing business. They insert surreptitious tracker pixels in email to not only track the fact that you read their msg but also when you read the msg and your IP (which gives whereabouts). If they suspect you are not where they expect you to be, they take action. They modify your policy. It’s perfectly legal in the US to use sneaky underhanded tracking techniques rather than the transparent mechanism described in RFC 2298. If your suppliers are using RFC 2298 and not involuntary tracking mechanisms, lucky you.
You’re kind of freaking out about nothing.
I highly recommend Youtube video l6eaiBIQH8k, if you can track it down. You seem to have no general idea about PDF security problems.
And I’m not sure why an application would output a pdf this way. But there’s nothing harmful going on.
If you can’t explain it, then you don’t understand it. Thus you don’t have answers.
It’s a bad practice to just open a PDF you did not produce without safeguards. Shame on me for doing it.. I got sloppy but it won’t happen again.
cross-posted from: https://lemmy.sdf.org/post/24645301
> They emailed me a PDF. It opened fine with evince and looked like a simple doc at first. Then I clicked on a field in the form. Strangely, instead of simply populating the field with my text, a PDF note window popped up so my text entry went into a PDF note, which many viewers present as a sticky note icon.
>
> If I were to fax this PDF, the PDF comments would just get lost. So to fill out the form I fed it to LaTeX and used the overpic pkg to write text wherever I choose. LaTeX rejected the file.. could not handle this PDF. Then I used the file command to see what I am dealing with:
> > $ file signature_page.pdf > signature_page.pdf: Java serialization data, version 5 >
> WTF is that? I know PDF supports JavaScript (shitty indeed). Is that what this is? “Java” is not JavaScript, so I’m baffled. Why is java in a PDF? (edit: explainer on java serialization, and some analysis)
>
> My workaround was to use evince to print the PDF to PDF (using a PDF-building printer driver or whatever evince uses), then feed that into LaTeX. That worked.
>
> My question is, how common is this? Is it going to become a mechanism to embed a tracking pixel like corporate assholes do with HTML email?
>
> I probably need to change my habits. I know PDF docs can serve as carriers of copious malware anyway. Some people go to the extreme of creating a one-time use virtual machine with PDF viewer which then prints a PDF to a PDF before destroying the VM which is assumed to be compromised.
>
> My temptation is to take a less tedious approach. E.g. something like:
> > $ firejail --net=none evince untrusted.pdf >
> I should be able to improve on that by doing something non-interactive. My first guess:
> > $ firejail --net=none gs -sDEVICE=pdfwrite -q -dFIXEDMEDIA -dSCALE=1 -o is_this_output_safe.pdf -- /usr/share/ghostscript/*/lib/viewpbm.ps untrusted_input.pdf >
> output:
> > Error: /invalidfileaccess in --file-- > Operand stack: > (untrusted_input.pdf) (r) > Execution stack: > %interp_exit .runexec2 --nostringval-- --nostringval-- --nostringval-- 2 %stopped_push --nostringval-- --nostringval-- --nostringval-- false 1 %stopped_push 1990 1 3 %oparray_pop 1989 1 3 %oparray_pop 1977 1 3 %oparray_pop 1833 1 3 %oparray_pop --nostringval-- %errorexec_pop .runexec2 --nostringval-- --nostringval-- --nostringval-- 2 %stopped_push --nostringval-- --nostringval-- --nostringval-- %array_continue --nostringval-- > Dictionary stack: > --dict:769/1123(ro)(G)-- --dict:0/20(G)-- --dict:87/200(L)-- --dict:0/20(L)-- > Current allocation mode is local > Last OS error: Permission denied > Current file position is 10479 > GPL Ghostscript 10.00.0: Unrecoverable error, exit code 1 >
> What’s my problem? Better ideas? I would love it if attempts to reach the cloud could be trapped and recorded to a log file in the course of neutering the PDF.
>
> (note: I also wonder what happens when Firefox opens this PDF considering Mozilla is happy to blindly execute whatever code it receives no matter the context.)
They emailed me a PDF. It opened fine with evince and looked like a simple doc at first. Then I clicked on a field in the form. Strangely, instead of simply populating the field with my text, a PDF note window popped up so my text entry went into a PDF note, which many viewers present as a sticky note icon.
If I were to fax this PDF, the PDF comments would just get lost. So to fill out the form I fed it to LaTeX and used the overpic pkg to write text wherever I choose. LaTeX rejected the file.. could not handle this PDF. Then I used the file command to see what I am dealing with:
$ file signature_page.pdf signature_page.pdf: Java serialization data, version 5
WTF is that? I know PDF supports JavaScript (shitty indeed). Is that what this is? “Java” is not JavaScript, so I’m baffled. Why is java in a PDF? (edit: explainer on java serialization, and some analysis)
My workaround was to use evince to print the PDF to PDF (using a PDF-building printer driver or whatever evince uses), then feed that into LaTeX. That worked.
My question is, how common is this? Is it going to become a mechanism to embed a tracking pixel like corporate assholes do with HTML email?
I probably need to change my habits. I know PDF docs can serve as carriers of copious malware anyway. Some people go to the extreme of creating a one-time use virtual machine with PDF viewer which then prints a PDF to a PDF before destroying the VM which is assumed to be compromised.
My temptation is to take a less tedious approach. E.g. something like:
$ firejail --net=none evince untrusted.pdf
I should be able to improve on that by doing something non-interactive. My first guess:
$ firejail --net=none gs -sDEVICE=pdfwrite -q -dFIXEDMEDIA -dSCALE=1 -o is_this_output_safe.pdf -- /usr/share/ghostscript/*/lib/viewpbm.ps untrusted_input.pdf
output:
Error: /invalidfileaccess in --file-- Operand stack: (untrusted_input.pdf) (r) Execution stack: %interp_exit .runexec2 --nostringval-- --nostringval-- --nostringval-- 2 %stopped_push --nostringval-- --nostringval-- --nostringval-- false 1 %stopped_push 1990 1 3 %oparray_pop 1989 1 3 %oparray_pop 1977 1 3 %oparray_pop 1833 1 3 %oparray_pop --nostringval-- %errorexec_pop .runexec2 --nostringval-- --nostringval-- --nostringval-- 2 %stopped_push --nostringval-- --nostringval-- --nostringval-- %array_continue --nostringval-- Dictionary stack: --dict:769/1123(ro)(G)-- --dict:0/20(G)-- --dict:87/200(L)-- --dict:0/20(L)-- Current allocation mode is local Last OS error: Permission denied Current file position is 10479 GPL Ghostscript 10.00.0: Unrecoverable error, exit code 1
What’s my problem? Better ideas? I would love it if attempts to reach the cloud could be trapped and recorded to a log file in the course of neutering the PDF.
(note: I also wonder what happens when Firefox opens this PDF, because Mozilla is happy to blindly execute whatever code it receives no matter the context.)
Not sure if this is relevant, but service manuals for cars older than 2014 can be found here: charm.li (no cost and enshification-free).
Also worth noting Brother uses that trick where empty cartridges are detected by a laser which is exactly not positioned as low on the cartridge as it could be, forcing people to toss not-so-empty cartridges.
BTW, regarding the trackers dots I’ll drop a link here for anyone who wants to verify Brother’s role in it:
https://www.eff.org/pages/list-printers-which-do-or-do-not-display-tracking-dots
Another reason to use inkjets: GHG footprint. Inkjets use far less energy than lasers. It’s a shame we have to choose between ecocide and tricks and traps.
The only no-compromise path I see is to pull an inkjet from the dumpster, fix it, and refill the cartridges with homemade “ink” from spent coffee grounds and tea.
A month ago you would have been wrong. But indeed apparently this just changed:
“Election bets were approved legally just weeks ago, as the 2024 race headed into its home sprint.”
Critics fear the change could scare people away from hospitals in Texas, even though patients are not required to answer the questions to receive medical care.
So here’s a repugnant move by right-wing assholes. Taxans: you can counter that shit. If a hospital asks you whether you are in the country legally, instead of saying “yes” the right answer is “I decline to answer”. Don’t give the dicks their stats.
According to BBC World News, the stocks in the US that are expected to do well under Trump are surging. I think those stocks are surely over-valued. Their value will be corrected after Trump loses.
In the US it’s illegal to bet on elections(see update), but betting on the stock market is fair game. I would love it if the some short-sellers would exploit this situation.
(update) It’s now legal to bet on elections in the US, as of a few weeks ago
I’ve noticed this problem on infosec.pub as well. If I edit a post and submit, the form is accepted but then the edits are simply scrapped. When I re-review my msg, the edits did not stick. This is a very old Lemmy bug I think going back over a year, but it’s bizarre how it’s non-reproducable. Some instances never have this problem but sdf and infosec trigger this bug unpredictably.
0.19.3 is currently the best Lemmy version but it still has this bug (just as 0.19.5 does). A good remedy would be to install an alternative front end, like alexandrite.
Political parties around the world have flocked to nationbuilder.com for some reason. This tor-hostile Cloudflare site is blocking Tor users from accessing election info. This kind of sloppy lazy web administration is common.
But what’s a bit disturbing is that when I contact a political party to say I cannot reach their page because of the nationbuilder block page, they sound surprised, like it’s the first time they are hearing about web problems. So Tor users are lazy too. That’s the problem.
Question answered in the parent thread:
https://lemmy.sdf.org/comment/15364720
when a server pushes a 403, it still sees the full URL that was attempted.
That’s interesting. It sounds like browsers could be designed smarter. I get “403 Forbidden” chronically in the normal course of web browsing. In principle if a server is going to refuse to serve me, then I want to give the server as little as possible. Shouldn’t Tor browser attempt to reach the landing page of the host first just to check the headers for a 403, then if no 403 proceed to the full URL?
#dataMinimization
I suppose you could even say text-based clients are at a disadvantage because when we opt to render the HTML graphically, a full-blown browser is launched which is likely less hardened than something like whatever profile and engine Thunderbird embeds.
In my case I created a firejailed browser with --net=none so I could hit a certain key binding to launch the neutered browser to render an HTML attachment in a forced-offline context--- but I was too fucking lazy to dig up what keys I bound to that which is why I (almost?) got burnt.
Indeed, but what what was logged? Suppose the tracker pixel is something like:
https://www.website.com/uniqueDirForTracking/b1946ac92492d2347c6235b4d2611184.gif
and I visit that URL from Tor. The server at www.website.com can easily log the (useless) Tor IP and timestamp, but does it log the b1946ac92492d2347c6235b4d2611184? I’m not an expert on this which is why I am asking, but with my rough understanding I suspect that transaction might break down to multiple steps:
- a TLS negotiation just with the
www.website.comhost - if successful, a session cookie may or may not be sent.
- the “document” (“image”) is fetched by an HTTPGET req (using the cookie, if given).
If the negotiation is blocked by the firewall, does the server ever even see the request for b1946ac92492d2347c6235b4d2611184.gif?
Tracker pixels are surprisingly commonly used by legitimate senders… your bank, your insurance company, any company you patronize. These assholes hide a 1-pixel image in HTML that tracks when you open your email and your IP (thus whereabouts). I use a text-based mail client in part for this reason. ...
cross-posted from: https://lemmy.sdf.org/post/24375297
> Tracker pixels are surprisingly commonly used by legitimate senders.. your bank, your insurance company, any company you patronize. These assholes hide a 1-pixel image in HTML that tracks when you open your email and your IP (thus whereabouts). > > I use a text-based mail client in part for this reason. But I got sloppy and opened an HTML attachment in a GUI browser without first inspecting the HTML. I inspected the code afterwards. Fuck me, I thought.. a tracker pixel. Then I visited just the hostname in my browser. Got a 403 Forbidden. I was happy to see that. Can I assume these idiots shot themselves in the foot with a firewall Tor blanket block? Or would the anti-tor firewall be smart enough to make an exception for tracker pixel URLs?
Tracker pixels are surprisingly commonly used by legitimate senders.. your bank, your insurance company, any company you patronize. These assholes hide a 1-pixel image in HTML that tracks when you open your email and your IP (thus whereabouts).
I use a text-based mail client in part for this reason. But I got sloppy and opened an HTML attachment in a GUI browser without first inspecting the HTML. I inspected the code afterwards. Fuck me, I thought.. a tracker pixel. Then I visited just the hostname in my browser. Got a 403 Forbidden. I was happy to see that.
Can I assume these idiots shot themselves in the foot with a firewall Tor blanket block? Or would the anti-tor firewall be smart enough to make an exception for tracker pixel URLs?
A home insurance policy offers a discount to AAA members. The discount is the same amount as the cost of membership. I so rarely use a car or motorcycle that I would not benefit significantly from a roadside assistence plan. I cycle. But there are other discounts for AAA membership, like restaurant discounts. So my knee-jerk thought was: this is a no-brainer… I’m getting some benefits for free, in effect, so it just makes sense to get the membership.
Then I dug into AAA a bit more. The wiki shows beneficial and harmful things AAA has done. From the wiki, these points stand out to me:
AAA blamed pedestrians for safety problems
“As summarized by historian Peter Norton, "[AAA] and other members of motordom were crafting a new kind of traffic safety effort[. ...] It claimed that pedestrians were just as responsible as motorists for injuries and accidents. It ignored claims defending the historic rights of pedestrians to the streets—in the new motor age, historic precedents were obsolete.”
AAA fights gasoline tax
“Skyrocketing gas prices led AAA to testify before three Congressional committees regarding increased gasoline prices in 2000, and to lobby to prevent Congress from repealing parts of the federal gasoline tax, which would have reduced Highway Trust Fund revenue without guaranteeing consumers any relief from high gas prices.”
AAA fights mass transit
“Despite its work promoting environmental responsibility in the automotive and transportation arenas, AAA's lobbying positions have sometimes been perceived to be hostile to mass transit and environmental interests. In 2006, the Automobile Club of Southern California worked against Prop. 87. The proposition would have established a "$4 billion program to reduce petroleum consumption (in California) by 25 percent, with research and production incentives for alternative energy, alternative energy vehicles, energy efficient technologies, and for education and training."”
(edit) AAA fights for more roads and fought against the Clean Air Act
Daniel Becker, director of Sierra Club's global warming and energy program, described AAA as "a lobbyist for more roads, more pollution, and more gas guzzling."[86] He observed that among other lobbying activities, AAA issued a press release critical of the Clean Air Act, stating that it would "threaten the personal mobility of millions of Americans and jeopardize needed funds for new highway construction and safety improvements."[86] "AAA spokespeople have criticized open-space measures and opposed U.S. EPA restrictions on smog, soot, and tailpipe emissions."[87] "The club spent years battling stricter vehicle-emissions standards in Maryland, whose air, because of emissions and pollution from states upwind, is among the nation's worst."[88] As of 2017, AAA continues to lobby against public transportation projects.
Even though the roadside assistence is useless to me, the AAA membership comes with 2 more memberships. So I could give memberships to 2 family members and they would benefit from it. But it seems I need to drop this idea. AAA seems overall doing more harm than good.
AAA is a *federation*:
It’s interesting to realize that AAA is not a single org. It is a federation of many clubs. Some states have more than one AAA club. This complicates the decision a bit because who is to say that specific club X in state Y spent money fighting the gas tax or fighting mass transit? Is it fair to say all clubs feed money to the top where federal lobbying happens?
(edit) And doesn’t it seem foolish to oppose mass transit even from the selfish car driver standpoint? If you drive a car, other cars are in your way slowing you down and also increasing your chances of simultaneously occupying the same space (crash). Surely you would benefit from others switching from car to public transport to give you more road space. It seems to me the anti mass transit move is AAA looking after it’s own interest in having more members paying dues.
Will AAA go the direction of the NRA?
Most people know the NRA today as an evil anti gun control anti safety right wing org. It was not always that way. The NRA used to be a genuine force of good. It used to truly advocate for gun safety. Then they became hyper politicized and perversely fought for gun owner rights to the extreme extent of opposing gun safety. I wonder if AAA might take the same extreme direction as NRA, as urban planners increasingly come to their senses and start to realize cars are not good for us. Instead of being a force of saftey, AAA will likely evolve into an anti safety org in the face of safer-than-cars means of transport. (Maybe someone should start a counter org called “Safer than Cars Alliance” or “Better than Cars Alliance”)
I also noticed most AAA club’s websites block Tor. So the lack of privacy respect just made my decision to nix them even easier.
An insurance agent who I called on the phone for a quote demanded my email address. I resisted, said he could have my fax number instead. He said the form he is filling out in order to get me a quote will not move forward without an email address. I got the impression this was not a requirement of the agent but rather the underwriting company, which means no matter which agent sells me the policy it’s impossible to get insurance from that underwriter without an email address. I would be denied insurance with this underwriter had I not supplied an email address in a phone conversation. They assume if you have access to a phone line, you have email.
So I gave him a disposable. This is still not an okay solution. The quote he sent by email traversed Microsoft servers and contained sensitive information without encryption. It doesn’t matter that MS did not get my real email address considering they still got lots of personal info about me from the quote.
It’s also interesting to note that mortgage lenders require borrowers to always have homeowner’s insurance. So I will dream about pulling this activist move: drop the insurance after securing a mortgage, tell the bank “I cannot get insurance because I don’t have an email address”. Insurance companies tend to refuse to sell policies to someone who is not the beneficiary of the policy, so the bank would not be able to insure the home on their side. I would just love to see that shitshow play out. If anyone wants to drop their homeowners insurance for any reason, this might be your best defense for doing so.
Funnily enough, the insurer offers a “paperless discount”, which means they actually have a paper-sending service for those who are not paperless. Yet everyone must have an email address before they even get a quote.
OSMand used to only crash 1 or 2 times per trip. It was usable enough. Now recently something changed with my config somehow and it shows extreme detail no matter how zoomed out I am. Every tiny street is being rendered. This is killing the app. It crashes so chronically it’s unusable.
Anyone know how to control this?
In “configure map” I have disabled everything except cycling routes. The “details” shows 0/9, which apparently only configures objects, not street details.
(edit) I think the “map magnifier” might be the issue. It was at 25% (the lowest), which I would intuitively think means less road detail. But it’s apparently counter-intuitive. I chose 100% and I seem to get less map detail -- which is what I need because the more detail, the more crashes. So I might have solved this.. need to experiment.
Disney has asked a Florida court to dismiss a wrongful death lawsuit filed earlier this year regarding a woman who passed away due to anaphylaxis after a meal at Disney Springs, citing an arbitration waiver in the terms and conditions for Disney+. Disney Springs Wrongful Death Lawsuit Update
This is crazy. Disney is claiming that a wrongful death lawsuit cannot go forward (paraphrasing):
“sorry, your husband signed up to a Disney+ trial a couple of years ago, hence they accepted T&Cs that clearly stated that any dispute about our products should go through arbitration rather than through courts”.
Even if a consumer carefully reads the terms and conditions, how could they reasonably expect the ToS for a video game would affect the terms they are under at a Disney restaurant? That’s fucking nuts.
Future parents: “sorry kids, you cannot play that video game because there is an arbitration clause and one day you might want to visit Disney’s amusement parks.”
I’ve boycotted Disney for over a decade because of how conservative the corp is and how right-wing extremist they are with politics. IIRC Disney financed the campaign of a politician looking to eliminate background checks on firearms. Indeed, the company who entertains kids is happy to fight against basic gun control. So when Disney pulls a dick move like this arbitration clause it just reinforces the idea that boycotting Disney is the right move.
(edit) wow the ups and downs of the votes are interesting. ATM 9 up & 9 down. Can’t help but wonder who are these anti-human people who are happy to lick the corporate boots of Disney.. capitalist fanatics disappointed that people would object to arbitration clauses perversely applied so broadly? I have to wonder if loyal Disney employees are following this thread.
This is what my fetchmail log looks like today (UIDs and domains obfuscated): fetchmail: starting fetchmail 6.4.37 daemon fetchmail: Server certificate verification error: self-signed certificate in certificate chain fetchmail: Missing trust anchor certificate: /C=US/O=Let's Encrypt/CN=R3 fetchmail:...
This is what my fetchmail log looks like today (UIDs and domains obfuscated):
fetchmail: starting fetchmail 6.4.37 daemon fetchmail: Server certificate verification error: self-signed certificate in certificate chain fetchmail: Missing trust anchor certificate: /C=US/O=Let's Encrypt/CN=R3 fetchmail: This could mean that the root CA's signing certificate is not in the trusted CA certificate location, or that c_rehash needs to be run on the certificate directory. For details, please see the documentation of --sslcertpath and --sslcertfile in the manual page. See README.SSL for details. fetchmail: OpenSSL reported: error:0A000086:SSL routines::certificate verify failed fetchmail: server4.com: SSL connection failed. fetchmail: socket error while fetching from user4@server4.com@server4.com fetchmail: Query status=2 (SOCKET) fetchmail: Server certificate verification error: self-signed certificate in certificate chain fetchmail: Missing trust anchor certificate: /C=US/O=Let's Encrypt/CN=R3 fetchmail: This could mean that the root CA's signing certificate is not in the trusted CA certificate location, or that c_rehash needs to be run on the certificate directory. For details, please see the documentation of --sslcertpath and --sslcertfile in the manual page. See README.SSL for details. fetchmail: OpenSSL reported: error:0A000086:SSL routines::certificate verify failed fetchmail: server3.com: SSL connection failed. fetchmail: socket error while fetching from user3@server3.com@server3.com fetchmail: Server certificate verification error: self-signed certificate in certificate chain fetchmail: Missing trust anchor certificate: /C=US/O=Let's Encrypt/CN=R3 fetchmail: This could mean that the root CA's signing certificate is not in the trusted CA certificate location, or that c_rehash needs to be run on the certificate directory. For details, please see the documentation of --sslcertpath and --sslcertfile in the manual page. See README.SSL for details. fetchmail: OpenSSL reported: error:0A000086:SSL routines::certificate verify failed fetchmail: server2.com: SSL connection failed. fetchmail: socket error while fetching from user2@server2.com@server2.com fetchmail: Query status=2 (SOCKET) fetchmail: Server certificate verification error: self-signed certificate in certificate chain fetchmail: Missing trust anchor certificate: /C=US/O=Let's Encrypt/CN=R3 fetchmail: This could mean that the root CA's signing certificate is not in the trusted CA certificate location, or that c_rehash needs to be run on the certificate directory. For details, please see the documentation of --sslcertpath and --sslcertfile in the manual page. See README.SSL for details. fetchmail: OpenSSL reported: error:0A000086:SSL routines::certificate verify failed fetchmail: server1.com: SSL connection failed. fetchmail: socket error while fetching from user1@server1.com@server1.com fetchmail: Query status=2 (SOCKET)
In principle I should be able to report the exit node somewhere. But I don’t even know how I can determine which exit node is the culprit. Running nyx just shows some of the circuits (guard, middle, exit) but I seem to have no way of associating those circuits with fetchmail’s traffic.
Anyone know how to track which exit node is used for various sessions? I could of course pin an exit node to a domain, then I would know it, but that loses the benefit of random selection.
And if you try to visit the archive¹, that’s also fucked.
Not sure who these people are.. maybe they are actually watchdogs in opposition to open data.
¹ https://web.archive.org/web/20240925081816/https://www.opendatawatch.com/