schizo @ schizo @forum.uncomfortable.business

Posts

11

Comments

1,437

Joined

1 yr. ago

But again, most people aren’t running Linux

Exactly. This is bad, for the 0.3% of the computing population that use Linux AND have CUPS installed AND actually print things.

Not exactly a prime target, compared to literally almost anything else. If I were going all-in on something after having gained access to someone's local network, I'm 100% in on any exploit that lets me use an infostealer trojan to steal your session cookies, not fiddling around and hoping you print something.

(Patch your shit anyways, but there's no need to freak out.)

That's a very rosy picture, but they skipped a very important detail, alas. Or well, a few.

First, selling your power to the power companies in Texas is great! Except the amount they pay you is always going to be substantially less than the price you're going to pay later to import a kwh.

We have the Freedom(TM) to pay two seperate charges for power: the delivery cost, and the power cost. This is a great Freedom(TM) because it lets the power company pay you the power cost for your exported power, but you get to pay both halves when you no longer have that kwh in your batteries later.

Also this is just an attempt to get someone else to pay their CapEx to catch extreme usage events, and the incentives being paid out to people who have spent tens of thousands of dollars is still tilted in the power company's favor. The article itself even says it's helping them make a bigger profit: if it was a fair set of incentives, well, then that wouldn't be what's actually happening, would it?

And, worse, any non-Texans might not catch how unlivable shit gets if your A/C starts screwing with the set temperature when it's 110F outside. The article says it turns it 'off', but the impact I've seen from some friends who have one of these plans setup is that it simply sets the temperature to something like 86; high enough to stop the usage, but not quite enough to kill you or your pets if you're not aware it's done it. Still, not the most pleasant.

Still, it's a good idea and a step in the right direction, but we need (lol, lmao) actual real regulation around this and the incentives to be a little less... lame. They're very much structured around the 'well, what else are you going to do with your excess?', rather than with a real intent of fair dealing.

I used to print on glass, until I nearly cut a finger off.

Make sure you're using glass that can either handle the thermal cycling (that is not anything you can find at a Home Depot), or is tempered so it won't have giant sharp shards when it does finally break due to the heating -> cooling -> heating -> cooling cycles of 3d printing.

Mine did that in my hands, and the shards it broke into were sharp enough to cut down to the bone on two of my fingers, requiring a hospital trip.

....I use textured PEI now, which probably won't try to remove any digits.

You have your coworkers on an unmanaged machine with a foreign OS on the guest WiFi with custom networking.

Which, at any of my last few corporate jobs, would be grounds for termination, if not immediately throwing you out of the building and telling you if you come back we're calling the cops.

You really don't bypass controls in a corporate environment like this if you like working there.

(And yes, not EVERY job will react that way, but any that's got any compliance requirements absolutely will.)

A 3 day old kernel build? Will that have support for my hardware? Feels like it might be a little outdated.

Yeah, and at that point your network should be enforcing client isolation too, which is also a mitigation for this specific issue in large, shared networks like a college campus, or office, or public Wi-Fi at wherever.

It's that Simpsons episode where Mr. Burns is only alive because all the things that would kill him are cancelling each other out, but in PHP form.

I tend to use Squarespace because uh, they have a marketing budget and everyone tends to already know (or at least one of the people in the meeting anyways) who they are, which makes things an easier sell.

I don't particularly think they're the best or whatever, but they at least do what they say at a price that's reasonable enough and I've yet to be burned by suggesting them, sooooo.....

The FTC commissioner opened her Fruit Loops and a Zuckerbot fell out, probably.

Not quite: it'll drop a v2 captcha for you to solve when a v3 one can't clearly classify you one way or another.

So if v3 isn't entirely sure you're human, it'll make you do a v2.

It’s serious, but seems like a wonky attack vector for most.

Yeah, it's super trivially exploited, BUT it requires you to do a series of dumb things or let an attacker have access to your LAN which is one of those you-have-bigger-problems moments anyways.

And then you have to use their added printer (though there's an exploit path that may be usable to over-write the printer you already have configured, if the attacker knows what that might be) to print something before anything happens.

Dude who found it seems to have overhyped it just a little bit (while being a huge dick about it), but I could see how you might exploit this in certain circumstances.

It's still mindboggling that Kia sells any cars without immobilizers.

I get they're cheap cars and the way they're cheap is to skimp on everything but uh, maybe that's not the right place to skimp?

I've been pushing Squarespace for most people who come to me asking about setting up a small store or just simple business website.

Yeah, it's closed source and blah blah blah, but the end of the day, it's not about my opinions on software, it's about the most cost-effective, simple, usable option for the client who is asking me for my expertise, which is almost always not something they're going to have to keep paying me to maintain.

Like if you really really want Wordpress, I'll get you set up, and then quote you a couple thousand a year for maintenance.

Unshockprisingly, very few people think that's the right choice once they see what the keep-it-from-being-exploited cost is.

(And for anyone who thinks that's an unreasonable amount, okay cool. But maintaining a staging environment and testing updates and then pushing everything into production assuming there's no regressions you have to address takes a lot of time.)

I'm somewhat surprised that there aren't a lot of good alternatives but uh, yeah, there doesn't seem to be.

I would have expected there to be at least one or two good TTS engines but I guess that assumption is quite wrong.

As to your other post, it's less that I care in any specific sense that Microsoft knows what I'm reading and more of a (admittedly irrational) dislike of providing anything that an ad company could maybe later use to sell me shit.

Depends on if you need a CMS, or if you can use a static site generator.

For a CMS, I'm still a fan of Ghost and it has (mostly) not enshittified to the point it's unpleasant to use.

If you don't need the whole CMS thing, there's an awful lot of options. (And hosting them is super simplified since you can just stuff the output into a S3 bucket/Cloudflare Pages/Github Pages/a dozen other providers for basically free.)

Well, given how torrents work, yes, because you have to.

When you're downloading, you know the IP of everyone you're downloading from, and they know yours because that's how the internet works.

If an anti-piracy corpo hops on the swarm, they'll be able to see the IPs from all the peers as well.

So, TLDR: yeah, public anything is stupid when simply knowing the swarm exists and being able to connect to it is sufficient to provide enough documentation for everyone involved to get screwed.

Correct me if I'm wrong, but wouldn't you also end up exposing the IP of every peer on that torrent to anyone who joins the swarm, even if you masked the tracker and stats or whatever?

Like, IIRC that's kind a requirement for how torrents work in general, and so this idea would be making all activity on private trackers public, and I'd have to say that seems like a really, really stupid thing to want to do given the current situation where corpos are going after infringers again.

Neat idea, but the send-your-text-to-Microsoft bit of it is uh, well, no thank you.

Seems like a strange choice, personally, but I'm not a fan of sending tech corporations anything avoidable.

Wordpress is not a good fit for their complex web application

Seriously. People want to shove everything into Wordpress then get cranky when you can't make Wordpress into a ecommerce store, marketing platform, personal blog, file sharing service, and NFT marketplace.

And then it gets hacked because they needed 14 SEO plugins, 2 different form plugins, and were not going to pay for managed updates because that's easy they can do it themselves.