[–] [S] 1 point 1 week ago

Thanks! Codeberg.org gives my browser problems, but I was able to shallow clone that over Tor using git.

My first hack was to add a --socks4a parameter to all the curl calls to force it over Tor.

It did not work out of the box. I could see that it sources config.sh. The example file shows API keys. The instances_list.json file shows {"error":{"message":"Invalid Authorization header."}}, which implies that I need an API key. If I simply run this:

curl --socks4a 127.0.0.1:9050 -o "${filename}" 'https://fediseer.com/api/v1/all_instances'

there is no problem. I suppose you have hard-coded an API key to do operations that submit data, which is then used for getting data as well. Anyway, the script works for checking a single instance.

I wrote a script that uses Cloudflare’s ASNs to grab all its IP ranges. Then the script checks without even connecting to the target just by resolving the IP and checking if it matches CF’s range. It’s still just a messy workaround. It’s really something that should be in the fediseer dataset.

  • source
  • parent
  • context
  • [–] [S] 2 points 1 week ago* (last edited 1 week ago)

    but rather to ensure the instance is cushioned against unforeseen events and cost increases.

    100% availability would be nice, but there are trade-offs. Concentrated power on LW is a bad trade. Defeats the problem activitypub was meant to address.

    Instances that can be expected to last beyond the short-term to medium-term should be backed by a non-profit organization with commitments to users to remove key man risk.

    Sure, stability is good, so long as the instance does not sell souls to Cloudflare or grow disproportionately big.

    Even under the scenario of full data portability, switching instances creates confusion (particularly for casual users who just want to create an account and not worry about whether it will still exist in a year) and breaks @ mention links, so safeguards to reduce the risk of instance failure outweigh the downsides of reduced decentralization.

    Data portability is not at odds with decentralization. It’s the other way around. A good degree of data portability promotes decentralization precisely because disaster can be mitigated when small intances fall.

    Or are you calling centralization the “safeguard”? What a horrible trade to make. The right answer is better software, not centralization.

    Given that the software is being developed by literal communists and isn’t in the hands of the Lemmy.world operators, I don’t think limited centralization is likely to lead to user base exploitation or a particularly strong network effect.

    Look at the numbers. Network effect is in full force. Lemmy.world (Cloudflare centralized) is huge, an order of magnitude bigger than the 2nd biggest (sh.itjust.works IIRC, also Cloudflare). Dev.lemmy.ml was the biggest originally, and also Cloudflared to enable unhealthy growth. The devs wisdom improved and they scaled back deliberately. Now lemmy.ml is no longer centralized on Cloudflare (which was quite an embarrassment for founders of an activitypub implementation) and much smaller than LW (though still more than 2 std deviations bigger than the mean).

    If an LW admin does not like what you write, you lose reach to a large portion of the fedi because of 1 person’s influence. Fuck convenience; esp. when convenience comes with Reddit-like power abuses.

  • source
  • parent
  • context
  • [–] [S] 1 point 1 week ago* (last edited 1 week ago) (4 children)

    Ultimately instances with more users are better able to collect donations and reduce per-user monthly costs,

    Everyone has their reasons for defending centralization. For you it is cost savings, apparently. Money wins, unless the tech is done well.

    (edit) Small instances are cheaper to secure because they are less prone to targeting. The bigger an instance gets, the more it costs per user for infosec.

    it also wouldn’t be good to have them spread out evenly across 1,000 instances.

    It would be good, but not for the bottom line. Facebook has mastered the bottom line indeed.

    Without a mechanism for user data to be completely transferred between instances (including post and voting history), an instance shutting down is a terrible experience for new users that could encourage them to return to a commercial social media network and must thus be avoided at all costs.

    It’s a problem for sure. Lemmy devs are pro-data portability, but they give it a low priority. They hope that someone will build a bot that ports data so long as it does not require Lemmy server code to be written. IOW, they (Nutomic specifically) calls for a hack job. He posts pseudocode here: https://lemmy.ml/post/31128657/19022698

  • source
  • parent
  • context
  •  

    This post got over 50 comments a couple yrs ago:

    https://linkage.ds8.zone/post/367822

    Looking through the comments shows a strong bias in favor of centralization. Is it fair to say the masses in the fedi are merely anti-GAFAM? Considering how people pile onto a Cloudflare node (lemmy.world), the fedi is indeed mostly composed of those who do not resist network effect. Choosing the most evil node of a less evil network still reflects a problem.

    We need to evolve more. We need a platform that does more to thwart centralized power. The network needs to build in a penalty for disproportionately large nodes w/a single point of influence. And there should be a built-in mitgating mechanism to keep Cloudflare out, as Cloudflare is inherently centralized to the most abusive extent.

    [–] [S] 1 point 1 week ago* (2 children)

    It’s still down for me. Just times out. So I have no idea what you propose.

    Anyway, I don’t imagine how a workaround would be possible. The dataset is missing the data. If I have to scrape for the data myself, it defeats the point of a public dataset. I could write in my code a Cloudflare check, but that doesn’t help anyone else using the fediseer dataset.

  • source
  • parent
  • context
  •  

    Rationale:

    • The db currently tracks “has_captcha”. Cloudflare influences that regardless of whether the site is itself configured to push a CAPTCHA.
    • The db currently tracks “open_registrations”. The degree of openness depends on whether a node is on Cloudflare, regardless of how the software is configured.
    • Checking for Cloudflare is free. That is, no extra connections are needed. It’s simply a matter of checking for the presence of CF-RAY in the http headers on existing fetches.
    • The mission purpose of fediseer is to facilitate trust assessment. The use of Cloudflare is a significant factor in that regard.
    [–] 1 point 2 weeks ago

    Gotta say the way Kaidan documents their work is probably the most impressive I have encountered in the FOSS world. The list of new features is long and detailed, as are the bug fixes. The packaging status at the end of the page is brilliant. We can quickly see from knowing our distro whether we have the changes.

  • source
  • [–] 1 point 2 weeks ago*

    it’s about who I can reach.

    Only if you play the pushover. I will not install Signal - full stop. I hand out a contact card that has my XMPP JID and OMEMO fingerprints. Others install XMPP for the purpose of reaching me.

    I miss when Google and Facebook were XMPP

    XMPP is a good option precisely because those companies are not involved.

  • source
  • parent
  • context
  •  

    cross-posted from: https://linkage.ds8.zone/post/724293

    Wireapp has been a non-stop running goat fuck for years. The incompetent devs finally have a Debian procedure (here). It’s unclear if they are still pushing bloated Electron junk. But they seem to think banning Tor is not bad for optics in the deployment of a comms app pitched for security-minded folks. I modified their instructions to give:

     $ echo "Types: deb
    URIs: tor://wire-app.wire.com/linux/debian
    Suites: stable
    Components: main
    Signed-By:
    $(torsocks wget -O- tor://wire-app.wire.com/linux/releases.key | sed -e 's/^$/./' -e 's/^/ /')" | sudo tee /etc/apt/sources.list.d/wire-desktop.sources
    

    Notice I used the tor:// scheme instead of https://. Doing aptitude update gives:

    E: Failed to fetch tor://wire-app.wire.com/linux/debian/dists/bookworm/InRelease  403  Forbidden [IP: 127.0.0.1 9050]
    E: The repository 'tor://wire-app.wire.com/linux/debian stable InRelease' is not signed.
    
     

    cross-posted from: https://linkage.ds8.zone/post/543756

    This seems quit serious because there is a security issue when one app can interfere with another.

    If Ungoogled Chromium is running when Nheko launches, U/C instantly freezes. No i/o is possible with U/C. Then when Nheko is quit, U/C goes down with it.

     

    cross-posted from: https://linkage.ds8.zone/post/515550

    Folks— Most Lemmy client apps are on the phone. I am looking for a FOSS phone app that works offline. That is, the phone has no data plan and only occasionally connects to public wifi hotspots. I do not want to be entering login passwords and reading and writing posts when I am connected. Reading and writing posts interactively needs to happen offline. Typical workflow: when I meet people at a bar/cafe, I need the app to sync over the public wi-fi without using my attention. It should post my comments and fetch threads for which I am active, for offline access later. It needs to support multiple accounts spanning multiple instances.

    Does anything like this exist? Or do all Lemmy/kbin/mbin phone apps demand your realtime attention when connected?

     

    cross-posted from: https://linkage.ds8.zone/post/523771

    Before posting an image to the fedi, I want to be mindful about the network burden it will cause. I’m only uploading the image once but potentially thousands of people could end up downloading it.

    If it’s a color image, then JPG is typically best. This #ImageMagick command reduces the filesize quite a bit, trading off quality:

      $ convert "$original_image_file" \
        +dither \
        -posterize 8 \
        -sampling-factor 4:2:0 \
        -strip \
        -quality 75 \
        -interlace Plane \
        -gaussian-blur 0.05 \
        -colorspace RGB \
        -strip \
        smaller_file.jpg
    

    If it’s a pic of a person, this processing will likely be a disaster. But for most things where color doesn’t matter too much, it can be quite useful. Play with different -posterize values.

    If you can do with fewer pixels, adding a -resize helps.

      $ convert "$original_image_file" -resize 215x smaller_file.jpg
    

    If you can get away with black and white, jpeg is terrible. Use PNG instead. E.g.

      $ convert "$original_image_file" -threshold 30% -type bilevel smaller_file.png
    

    For privacy, strip the metadata

    The ImageMagick -strip option supposedly strips out metadata. But it’s apparently not thorough because the following command yields a slightly smaller file size:

      $ exiftool -all= image.jpg
    

    What else?

    Did I miss anything? Any opportunities to shrink images further? In principle the DjVu format would be more compact but it’s not mainstream and apparently not accepted by Lemmy.

     

    cross-posted from: https://linkage.ds8.zone/post/523771

    Before posting an image to the fedi, I want to be mindful about the network burden it will cause. I’m only uploading the image once but potentially thousands of people could end up downloading it.

    If it’s a color image, then JPG is typically best. This #ImageMagick command reduces the filesize quite a bit, trading off quality:

      $ convert "$original_image_file" \
        +dither \
        -posterize 8 \
        -sampling-factor 4:2:0 \
        -strip \
        -quality 75 \
        -interlace Plane \
        -gaussian-blur 0.05 \
        -colorspace RGB \
        -strip \
        smaller_file.jpg
    

    If it’s a pic of a person, this processing will likely be a disaster. But for most things where color doesn’t matter too much, it can be quite useful. Play with different -posterize values.

    If you can do with fewer pixels, adding a -resize helps.

      $ convert "$original_image_file" -resize 215x smaller_file.jpg
    

    If you can get away with black and white, jpeg is terrible. Use PNG instead. E.g.

      $ convert "$original_image_file" -threshold 30% -type bilevel smaller_file.png
    

    For privacy, strip the metadata

    The ImageMagick -strip option supposedly strips out metadata. But it’s apparently not thorough because the following command yields a slightly smaller file size:

      $ exiftool -all= image.jpg
    

    What else?

    Did I miss anything? Any opportunities to shrink images further? In principle the DjVu format would be more compact but it’s not mainstream and apparently not accepted by Lemmy.

     

    Before posting an image to the fedi, I want to be mindful about the network burden it will cause. I’m only uploading the image once but potentially thousands of people could end up downloading it.

    If it’s a color image, then JPG is typically best. This #ImageMagick command reduces the filesize quite a bit, trading off quality:

      $ convert "$original_image_file" \
        +dither \
        -posterize 8 \
        -sampling-factor 4:2:0 \
        -strip \
        -quality 75 \
        -interlace Plane \
        -gaussian-blur 0.05 \
        -colorspace RGB \
        -strip \
        smaller_file.jpg
    

    If it’s a pic of a person, this processing will likely be a disaster. But for most things where color doesn’t matter too much, it can be quite useful. Play with different -posterize values.

    If you can do with fewer pixels, adding a -resize helps.

      $ convert "$original_image_file" -resize 215x smaller_file.jpg
    

    If you can get away with black and white, jpeg is terrible. Use PNG instead. E.g.

      $ convert "$original_image_file" -threshold 30% -type bilevel smaller_file.png
    

    For privacy, strip the metadata

    The ImageMagick -strip option supposedly strips out metadata. But it’s apparently not thorough because the following command yields a slightly smaller file size:

      $ exiftool -all= image.jpg
    

    What else?

    Did I miss anything? Any opportunities to shrink images further? In principle the DjVu format would be more compact but it’s not mainstream and apparently not accepted by Lemmy.

     

    LaTeX mode and pretty much any programming mode supports comments. In principle, comment blocks could really benefit from some org mode features, particularly a mechanism to collapse lengthy paragraphs and lists (like the markdown spoiler).

    Or is there already a universal way to collapse text in code comments?

     

    cross-posted from: https://linkage.ds8.zone/post/517080

    I have over 700 street addresses that ultimately need to become a category or group of favourites in #OSMand. In the past I used a web service called something like nomenatum. I don’t think that option still exists. This article suggests batch encoding on this site, claiming it’s gratis but it looks like a costly subscription.

    I must say that using a service to do the job of software is not a great idea. We have #OpenStreetMaps. In principle, OSM and a tool should be able to handle this offline without a service.

    Of course it’s possible to search each address by hand in OSMand and then save the location. It would be absurdly labor intensive but it proves that a service is not needed, in principle.

    Is there any way to feed a list of addresses to OSMand?

    Or is there a linux app that can do this work, ideally offline?

    view more: next ›