The ocean of shitty websites is rising (much more aggressively than the real oceans). To help in the de-shitification, this bookmarklet is quite useful:

javascript:void window.open("https://web.archivep75mbjunhxc6x4j5mwjmomyxb573v42baldlqu56ruil2oiad.onion/web/"+encodeURIComponent(location.href));

You simply create a bookmark on your bookmarks bar and paste that text in, in place of the URL. If you are visiting a website that gives you problems, simply clicking that bookmarklet will prefix the Internet Archive Wayback Machine in front of the current URL. It’s a notable time-saver, as opposed to copy-paste that text every time.

There is a flaw: if the target website simply drops packets (i.e. it’s a tor-hostile site), then the URL is malformed. It attempts to visit archive.org/…/about: Or more often, it just does nothing.

Any JS folks know how to fix that so it works on sites that time out?

(edit) bonus points--

Some shitty sites (Siteground?) redirect to:

https://$original_host/.well-known/captcha/?y=ipr:$IPaddy:$random_real_number&r=$original_path

So it would help if the bookmarklet would strip out the garbage that was added before visiting archive.org.

faxzero.com has been indispensible because (AFAIK) it is the only way to send a gratis fax to US numbers. Today it quit working. UMatrix now shows there are ~120+ different JavaScript pushers.

In the past I worked hard doing a lot of trial-and-error to work out which JS needs to be enabled to function. The magic combination I had was working fine for years, but now the “send free fax now” button is broken. It animates when hovered but clicking does nothing.

I tried enabling all JavaScript, cookies, etc for the pink-colored entities (minus GAFAM and yahoo), and excluded the red rows (assuming the red color marks confirmed anti-user entities). It was not enough. Can any JavaScript experts see what makes that submit button function?

(edit) I’m not opposed to paying but fuck that $3.29 per fax price. Makes me wonder if the gratis ad-enshitified option manages to sell your data for that much money.

If anyone knows of a pay-as-you-go fax service that’s at least cheaper than postal mail and not on cloudflare, I would be interested.

There is a dark pattern whereby websites maliciously use a JavaScript confirm() to deceive users into believing a “problem” has been detected by the browser. It’s often triggered using setTimeout(), so it does not appear to be in response to any action that would be attributed to the visited website (background and related).

This site demonstrates the assault if you have a sufficiently defensive browser:

https://www.repairwin.com/

Often I can get around it by doing torsocks lynx "$URL", but not this time. The website is also hostile toward text browsing users. This site is extra obnoxious because if you give no answer to the popup it enters an endless loop of reloading the page -- which likely hammers their server too (the morons).

The fix: I fetched the webpage using HTtrack. Then I was able to view the page in peace. But then I noticed my hard drive working hard non-stop. Ran top, and a “program” called file:// Content (literally) was hogging CPU, memory, and putting the hard drive to work. I killed the process, at which point the browser tab that was showing the webpage as a local file crashed.

So while HTtrack at least got me access to the page, I was forced to hurry up and read the page and close it because of how hard my system had to work just to display some text. Perhaps the local copy needs to be viewed this way: firejail --net=none firefox file://$myindex/. Or maybe I should run wkhtmltopdf on the local copy and then just read the PDF.

Promo'd !deshittification@thebrainbin.org in !newcommunities@lemmy.world and was informed this community exists. Probably should talk about if we want to keep them separate, or consolidate. And if we want to consolidate, to this lemmy.cafe community or to thebrainbin.org.

paging @auster@thebrainbin.com, the mod over there, and @cloudless@piefed.social @cloudless@lemmy.cafe, the mod here

If you have a properly defensive browser when visiting an NY Times page, you will get: “Please enable JS and disable any ad blocker”

It used to be possible to replace the NY Times host portion of the URL with this:

https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/

That would give a deshitified UX, and strangely I think NY Times hosted that onion. Perhaps they figured the small number of Tor users did not warrant using extra force to push ads. But now the site is dead.

Normally archive.org is a refuge. But NY Times is also hostile toward IAWM:

“This page is unavailable for archiving, because: access is forbidden.”

cross-posted from !netneutrality@sopuli.xyz

12ft.io was a clever service that exploited the fact that paywalls allowed Google to crawl their articles. By licking the boots of Google’s crawler, paywalls pollute the search index with their exclusive/closed content. Enshitification culminates by getting paywalls in our search results.

12ft.io gave people direct access to Google’s caches, so we could read the text that feeds Google’s index.

☠ 12ft.io is apparently dead now. “404 page not found”. wtf. We just lost an important disenshification mechanism. The linked news hit ~½ a year ago, but seems to have taken some time to actually play out.

cross-posted from !foss_requests@libretechni.ca

In light of this news, we need a browser that looks like a search engine crawler.

This would equalise the problem of websites giving preferential treatment to crawlers and lousy treatment to the rest.

My question is: assuming all hearders could mimick a crawler, would that be sufficient? Or do paywalls take IP address into account? And if so, would it work to subscribe to Google Cloud just to get an IP address in Google’s ranges and use that for crawling?

(crossposted from !exclusive_public_resources) Musk’s changes to Twitter:

must register as a member to get read access to content members no longer see a non-biased chronological linear timeline; an opaque algorithm decides what to prioritise on the timelines, subject to Elon’s hard-right manipulation

It’s perhaps fair enough that boot-licking pawns decide to subject themselves to quasi-brainwashing manipulation. But when GOVERNMENTS use Twitter, people with a legitimate interest in gov communication are forced to register on an exclusive walled garden where they will come under influence of the extreme right (and thus climate denial among other garbage; hence the crosspost to !climate_action_individual). How to fix this using open data laws: Public content published on Twitter legally must be openly accessible to all people. Perhaps not by default but certainly by request. This means individuals can submit an open data request to gov agencies who use Twitter, requesting a copy of all content they publish on Twitter. The gov legally must satisfy the request. All tweets must be in an open machine-readable format (csv, json, or xml). The dataset is “dynamic”, so I believe future updates must be added to the open data. But what I’ve seen in practice is the gov is not diligent about pushing the updates. They may need to be nagged. If they are nagged enough, perhaps they will decide Twitter is not worth it. BTW, all of this applies to Facebook as well, noting that Cambridge Analytica is why Trump took power in 2016.

cross-posted from: https://slrpnk.net/post/31247084

In the early web days there was a service where you email an URL to a certain email address and it responded with an email with the webpage attached.

We need that back. We need it to escape arbitrary anti-Tor anti-VPN forms of enshitification.

archive.org is very useful but we cannot rely on it.

Email has also become enshitified and it’s rightfully distrusted and even abandoned by the few true resisters who exist. So ideally it would be an onion email address that takes in the requests. Perhaps an onion activitypub UI as well.

cross-posted from: https://slrpnk.net/post/30993218

Copious access points are deployed by naïve admins who are oblivious to the fact that not everyone runs the latest gear. The shitty practice of pushing wi-fi in an arbitrarily exclusive way needs pushback. The first step is exposure. We need to enumerate the various ways demographics of people are being excluded and collect a DB on it.

The wi-fi protocol is the first point of failure. E.g. 802.11b vs 802.11a/g/n.. All new hardware is backwards compatible with older protocols. When an 802.11b device cannot see a signal, it’s because some asshat proactively disabled 802.11b.

Most exclusivity occurs with shitty captive portals. There are countless ways to fuckup a website to make it exclusive. E.g.

• to impose SSL, which inherently imposes recent certs and CAs that exclude old devices. It’s essentially rock stupid when the captive portal is nothing more than a button that says “I accept the ToS”.
• to impose JavaScript, which encapsulates a whole industry of poorly trained people who have no concept of stability of standards and interoperability.
• to impose SMS confirmation, which makes the ignorant assumption that every single user has a mobile phone, that they carry it with them, and that they are willing to share their number willy nilly.

🌱environmental impact🚮

The brain dead practice of deploying public Internet access using needlessly exclusive tech is a form of forced obsolscence. It’s one of the factors that pushes people to throw away working devices in order to overcome these ecocidal Internet access deployments.

🔧the fix💾

An app that records SSIDs, their location, and all the detectable exclusivity characteristics. It should also take human input with notes to record exclusivity that is not auto-detectable. Ideally the local DB would sync with a central DB. It should also be possible to extract a GPX file for a given region which could then be imported into OSMand or Organic Maps.

cross-posted from: https://slrpnk.net/post/30992984

We are drowning in enshitified websites. Cloudflare automatically enshitifies ⅓ of the worlds websites. On top of that, there are countless shitty anti-human features that plague the web. Some of them just annoy, and some actually make the website unreachable or unusable to various demographics of people (such as Tor users).

Most infuriating is when a GOVERNMENT website intended to serve the public uses access restrictions (like Cloudflare) or does something else to exclude demographics of people who are entitled access. The Tor community can no longer access most websites of the EU.

What we need

We need an app that will:

• attempt to visit a webpage from multiple different networks (VPN, Tor, residential clearnet, and a variety of different geographic regions).
• try a variety of different user agent strings (cURL, wget, firefox, lynx).
• compare the content between non-erroneous payloads. A significant difference should raise flags. If there is much less content, it could perhaps be regarded as an access denial without error. (e.g. a page simply says: “we don’t serve .. (your kind of people)”). Some common phrases could be searched for.
• detect exclusive walled gardens like Cloudflare and Sucuri
• accessibility¹/enshitification check: whether the contact page imposes a GUI or Google CAPTCHA (¹in terms of people with impairments)
• open data check: whether the contact page discloses a street address or phone number.
• check whether the page functions with uMatrix (maybe this is not possible).
• check whether a privacy policy exists.
• check whether there is a popup blocker blocker (that blocks those who block popups/ads).

In the end, the app produces a checklist and concludes with a final result:

• ✔👍🎉 ❝The website under test is publicly accessible❞
• 🤷🫤 ❝The website under test is publicly accessible but dark patterns or similarly unsuitable/inappropriate anti-user mechanisms were detected. The website should be avoided.❞
• ❌ ❝The website under test is access-restricted or not entirely publicly accessible❞

The report could perhaps be timestamped, digitally signed by the entity running the app, and centrally recorded. Then concerned people among the public could use the report as an independent/authoritative source for claiming that a “public” resource is not actually public.

Stop letting your streaming service take the reins and start listening with intention.

cross-posted from !newrules@slrpnk.net : https://slrpnk.net/post/30020824

FTP servers always just worked. No bullshit, garbage, or hoops to go through. Governments are now distributing documents that should be public access to everyone, but just like the private sector web-distributed docs bring in an infinite number of enshitification possibilities which make document access limited and exclusive.

For example, see the 1st item on this post. HTML PDFs are sometimes not even real PDFs anymore.

Some people have lost access to legal statutes because some foolish backroom jackass working for the gov decided to proxy gov websites via Cloudflare.

The EU has an “open data” law and an “accessibility” law. It’s a good start but these laws are vague and easy to disregard and weasel-word out of enforcement. It’s likely impossible to define a law that captures all possible varieties of enshitification, dark patterns, and exclusivity of access.

I do not think there are many ways to fuckup anonymous FTP. An IP firewall is perhaps the only variety of shenanigan we might expect.

So new rule:

All government distributed docs must have an FTP distribution. Outsourced distribution still carries with it the FTP requirement. If the gov wants to also do an HTTP distro, fine. They can do whatever Cloudflare enshitified shenanigans they want and exploit the fact that countless pushovers will dance and solve CAPTCHAs. But there still must be an FTP pathway to all docs.

Future review:

Three years after enactment of this policy we will review and possibly consider allowing Gemini to be used in lieu of FTP.

cross-posted from: https://slrpnk.net/post/27305158

Just as Facebook wields and abuses disproportionate power over social media, Cloudflare wields and abuses disproportionate power over the web and threadiverse. Richard Stallman prescribes guidance for FB enablers who are at least willing to take some marginal action against FB’s power. I highly suggest Facebook users read his guidance.

I would never use FB but RMS’s guide conveys basic ideas that can generically be transposed in the centralised fedi context. For years I have practiced a workflow in the threadiverse analogous to RMS’s anti-FB advice to at least do my part in disempowering centralisation. This entails limiting the excessive power of Cloudflare centralised instances, as well as instances centralised by sheer uncontrolled size. Activitypub tries to facilitate decentralised infra, but the Lemmy web UI is actually designed to exacerbate centralisation and the network effect. User diligence is required to counteract it.

1. Target your initial post in a decentralised community that merits promotion.

Lemmy cross-posts are designed to link the original community, thus giving more exposure to the first place you post. So avoid putting your initial post in places like LemmyWorld.

2. Cross-post incrementally over time. And delay cross-posting to a centralised community like L/W or sh.itjust.works as long as possible.

Cross-posting in many places all in the same hour may be tempting but it fails to exploit the fact that readers are in different timezones worldwide. Your decentralisation-respecting OP gets more exposure if the cross-posts are time-scattered.

Since your OP was placed in the decentralised community most deserving of promotion, a delay in posting to other places gives the original place a rightful advantage. This would be comparable to downgrading Facebook by feeding FB older content.

Ideally you reach a level of discipline of never posting in Cloudflare centralised platforms. But if you lack that kind of resolve, try at least to exercise enough self-control to wait a few days and only resort to posting in a place like LW if the engagement is really insufficient. A middle step would be to post in lemmy.ml or lemmy.dbzer0.com which are disproportionately sized but at least not in Cloudflare’s walled-garden.

3. (Lemmy stock web client) In the profile settings, block these centralised instances:

• lemmy.world
• lemmynsfw.com
• sh.itjust.works
• lemmy.ca
• programming.dev
• lemmy.one
• lemmy.zip
• reddthat.com
• lemmy.eco.br
• aussie.zone
• lemdro.id
• pawb.social
• ani.social
• thelemmy.club
• leminal.space
• lemmy.nz
• yiffit.net
• r.nf
• literature.cafe

That list is ordered by user count. The Lemmy UI is sadly unable to take a whole list as input and they must be entered one by one. Hence why the list above is ordered - so you can start at the top with the most power hungry and work down.

What that does and how it helps

Blocking Cloudflare nodes helps in 2 important ways:

• Your main timeline will show more decentralised posts. It exposes more content under more balanced power and encourages engagement with contributors who respect that. Your timeline will no longer be 99% posts from centralised venues of concentrated power.
• When searching within the Lemmy UI for a community, the first 15 or so results are the most important slots. In some circumstances like cross-posting, only the first dozen or so communities are even reachable and those slots are mostly hogged by centralised power mongers where you should try not to post. This is due to a poor design of the Lemmy UI but using the block feature mitigates the effects.

It’s very important to realise that the instance blocks do not block people. You will still see posts from LW users. And you can still even reach LW communities and even subscribe to them if you want. The only effect these blocks have is to prioritise decentralised communities in searches and in the timeline.

4. (m/kbin stock web client) Block communities on centralised instances.

This is like guideline 3, but sadly more tedious because there is no mechanism for blocking an instance and there is no way to do it in the profile settings either. It’s more ad hoc. You must visit the community and click “block”. The problem is LW has thousands of communities and you don’t want to spend all day playing whack-a-mole. OTOH, you need not block every community; only the ones for which someone on your node has subscribed. The easiest approach is when viewing the main timeline, click the community of a post from a centralised node and then click block. If you do a bit of that every time you browse the timeline, the timeline will gradually become more decentralised over time. The block list is accessible in your profile as far as removal. That is, you can unblock in your profile.

5. Exploit the fedi datasets for searching.

If you have a chosen a good (decentralised) host without a disproportionately high number of users, then community searches are going to have overly limited results. Lemmyverse.net remedies that as it searches a large DB that covers communities not federated to your instance.

Lemmyverse even tracks Cloudflare nodes so you can filter them out. But sadly, that filtering only works when searching for nodes, not communities. You have to fetch the dataset and code your own SQL statements to filter Cloudflared communities out of the search.