[–] 1 point 2 days ago*

I see a silent downvote. Wonder what that’s about.

I guess I don’t know what was non-open to start with. Were registrations closed? I don’t recall a restriction on accessing the site. But I see that community creation is still blocked.

  • source
  •  

    This is the one and only web service that tracks relationships between FOSS program versions and OS versions. Very disappointing to see it down because I think the dataset is not shared (correct me if I’m wrong).

    It impacts other websites that refer to repology.org, like this:

    https://www.kaidan.im/2023/05/05/kaidan-0.9.0/

    (update) A month ago they had domain registrar issues:

    https://github.com/repology/repology-rs/issues/560

    They overcame that, so it’s unclear what the problem has been the past couple days. In any case, would someone with MS Github access please create some bug reports? Three reports would be useful:

    1. (bug) site is down (see update below)
    2. (feature request) ask them to consider deploying an onion site
    3. (feature request) ask them to consider sharing their dataset so the world is not dependent on the continuous availability of their website

    Update

    After trial-and-error, it turns out repology.org is online, but they have started blocking Chrome-based browsers. They do in fact offer an API and database dump. So the only remaining problem is the lack of onion service.

     

    Whenever I report a broken¹ website, which is mostly websites that matter (e.g. gov & public services), the answer that comes back is “works for me… it’s you; we’ve had no complaints”.

    Out of refusal to play the pushover, I respond by submitting my request/application on paper. This ensures they have the cost and burden of manual processing as a penalty for arbitrarily blocking a demographic of people on the whim of a lazy admin. The extra perk is that when the recipient responds, they must pay postage to help feed the postal service, which helps reduce the threat of heading in the direction of the Danish devolution (they eliminated the postal services nationwide). The other perk is that it helps make the number of offline people look bigger, which helps that demographic fight the oppression of a forced digital transformation.

    Reaching a cached archive of the target is useful for getting a snail mail address. But archive.org is shutting out Tor traffic much more frequently lately.

    Anyway, am I the only one doing this? Are most Tor users bootlicking pushovers who simply bounce to clearnet or vpn upon encountering a tor-hostile entity? Tor Project should research this.

    ¹ indeed “broken” in this context means silently tor hostile (blocking Tor but no dignity-respecting anti-tor DoS msging). If they can’t can’t be bothered to disclose their policy, then I play dumb and just say their page is broken.

    [–] [S] 1 point 1 week ago* (last edited 1 week ago)

    Now is our chance to post whatever the fuck we want to slrpnk.net communities from non-slrpnk instances, and the mods cannot stop us.

    Woohoo! It’s a censorship-free free-for-all!

  • source
  • [–] [S] 1 point 1 week ago* (last edited 1 week ago)

    Are bookstores oppressive because they don’t have every book?

    They are oppressive if they arbitrarily deny access to the books they already have to a demographic of people. E.g., you have brown skin, and because a shoplifter had brown skin they decide to block all people in that demographic. Of course collective punishment is oppressive. Anubis is not creating a failure to have information. It’s being used to deny access to information the service already has.

    Do you not still have access through other means?

    I personally do not. Clearnet does not work on my system. But this is irrelevant. Tor supports my right to privacy and autonomy, and it is consistent with my values and ethical lifestyle. I actually find it unethical to use clearnet needlessly, for a number of reasons, one of which is to do our duty to give strength in numbers to activists and the oppressed. And to give them cover traffic. I also morally oppose advertising and thus object to sharing data with surveillance advertisers.

    And your missing the point of your not entitled to it either. Why does a website HAVE to cater yo how you wish to access? Because the website still has every right to tell you to kick sand. A bookstore can ban you for wearing a backpack. This is the society we live in.

    For the /third/ time, I already agreed there is no entitlement. The site can grant access to whoever the fuck it wants. And we have the right to express criticism. This is still irrelevant to the thesis of incompetent access controls, as it was the previous times you tried to recycle a this dead strawman of an argument. I never said admins don’t have a right to implement infosec countermeasures in a foolish manner with reckless results. It’s their right. This was not contested by anyone in this thread.

  • source
  • parent
  • context
  •  

    cross-posted from: https://infosec.pub/post/54498740

    The ocean of shitty websites is rising (much more aggressively than the real oceans). To help in the de-shitification, this bookmarklet is quite useful:

    javascript:void window.open("https://web.archivep75mbjunhxc6x4j5mwjmomyxb573v42baldlqu56ruil2oiad.onion/web/"+encodeURIComponent(location.href));
    

    You simply create a bookmark on your bookmarks bar and paste that text in, in place of the URL. If you are visiting a website that gives you problems, simply clicking that bookmarklet will prefix the Internet Archive Wayback Machine in front of the current URL. It’s a notable time-saver, as opposed to copy-paste that text every time.

    There is a flaw: if the target website simply drops packets (i.e. it’s a tor-hostile site), then the URL is malformed. It attempts to visit archive.org/…/about: Or more often, it just does nothing.

    Any JS folks know how to fix that so it works on sites that time out?

    (edit) bonus points--

    Some shitty sites (Siteground?) redirect to:

    https://$original_host/.well-known/captcha/?y=ipr:$IPaddy:$random_real_number&r=$original_path
    

    So it would help if the bookmarklet would strip out the garbage that was added before visiting archive.org.

     

    The ocean of shitty websites is rising (much more aggressively than the real oceans). To help in the de-shitification, this bookmarklet is quite useful:

    javascript:void window.open("https://web.archivep75mbjunhxc6x4j5mwjmomyxb573v42baldlqu56ruil2oiad.onion/web/"+encodeURIComponent(location.href));
    

    You simply create a bookmark on your bookmarks bar and paste that text in, in place of the URL. If you are visiting a website that gives you problems, simply clicking that bookmarklet will prefix the Internet Archive Wayback Machine in front of the current URL. It’s a notable time-saver, as opposed to copy-paste that text every time.

    There is a flaw: if the target website simply drops packets (i.e. it’s a tor-hostile site), then the URL is malformed. It attempts to visit archive.org/…/about: Or more often, it just does nothing.

    Any JS folks know how to fix that so it works on sites that time out?

    (edit) bonus points--

    Some shitty sites (Siteground?) redirect to:

    https://$original_host/.well-known/captcha/?y=ipr:$IPaddy:$random_real_number&r=$original_path
    

    So it would help if the bookmarklet would strip out the garbage that was added before visiting archive.org.

    [–] [S] 1 point 1 week ago* (last edited 1 week ago) (2 children)

    Is it that internal belief system I keep talking about?

    You’re talking about it, yet the doublespeak remains irrelevant.

    I have no idea what the UDHR is.

    Not surprised. Universal declaration of human rights.

    Do you feel opreased by a book?

    Of course I would feel oppressed when blocked from access to a book, amid your attempt to arguing the contrary by reducing it to an object /being/ a thought. Being blocked from access to books is similar to being blocked from information generally (i.e. the Internet, which is where books now exist).

    Neither is your browser.

    Okay, but you’re still missing the relationship between objects and the practice of one’s cognitive liberty facilitated those objects. It’s the oppression of cognitive liberty that is the problem. The objects involved are just working for your doublespeak to conflate and trivialize the oppression of a demographic of people.

  • source
  • parent
  • context
  • [–] [S] 1 point 1 week ago* (last edited 1 week ago) (4 children)

    If its a choice it should be easy.

    If a choice is inherently easy, in your view, then you are misusing the term. Of course the reality is some choices are easier and some are not.

    Thats great, but not what I was talking about. I’m talking about internal belief systems.

    The UDHR is not.

    Your browser is not an internal belief system.

    This is like saying a book is not an “internal belief system”. Yet the bible and koran are books.

    Your high-heels is not “an internal belief system”. Nor is a hajab. Does this mean you can’t cite oppression when forced to dress a certain way?

    And again, browsers are irrelevant without the transparency of knowing the oppressor’s blocking criteria. They are more likely suppressing people on the basis of their IP address, not browser. But we can only guess because they do not express which demographics they are oppressing. The oppressed knows they are in the oppressed group, but they don’t know how they got there.

  • source
  • parent
  • context
  • [–] [S] 1 point 1 week ago* (last edited 1 week ago) (6 children)

    You don’t choose faith, its found to be you. You find your faith and community.

    Nonsense. Religion is a choice in my part of the world. There may be regions where it is imposed, but that’s irrelevent to the demonstration of your foolish stance that it’s okay to oppress demographics of those who made a choice.

    We are also free to change our religion, or even join another religion in parallel, where I am.

    Is a browser so important to you that you can’t live without it?

    This is becoming increasingly so, as governments impose using a browser to obtain public service. (and yes, I am in a country that is a signatory of the Universal Declaration of Human Rights, which means public service is a right).

    Nonetheless, a “living without it” test does not exist in this context. The UDHR does not have such criteria for our right to autonomy. Rightfully so. Women in France got their right to abortion under the right to autonomy. Imagine if they had to prove being unable to live without that right in order to have it. That criteria can fuck right off because we have higher standards than mere survival.

    Is a browser part of your internal definition of you?

    This is double speak. My choice of browser is a reflection of my ethical values. Some browsers are more closely aligned with my philosophical view than others.

    None of those are choices for faith, or other protected classes.

    Nonsense. The UDHR does not separate religion from freedom of thought. It’s written in the same article. Would do you some good to read it.

  • source
  • parent
  • context
  • [–] [S] 1 point 1 week ago* (last edited 1 week ago) (8 children)

    I can’t choose a woman, you can choose a browser. Its really that simple.

    No, it’s not. This is as good as telling someone oppressed for their religion: “you chose your religion -- you don’t have to be muslim if you don’t like being oppressed -- become christian”. Of course, this requires you to neglect freedom of autonomy, freedom of thought and conscious, freedom to practice one’s values and live by a philosophy. Choice is irrelevent when the choice is a rightfully protected choice.

    (edit) And no, I cannot “choose another browser” when the oppressor does not even disclose which browser they are not blocking. Choice implies transparency.

  • source
  • parent
  • context
  • [–] [S] 0 points 1 week ago* (last edited 1 week ago) (12 children)

    I’m not the one being an asshole here buddy

    Of course you are. You’re the one supporting oppression. Collective punishment and collateral damage is a dick move. Stop being a dick. You cannot support collective punishment and marginalization of a demographic of people without being an asshole. It’s impossible.

  • source
  • parent
  • context
  • [–] [S] 1 point 1 week ago* (last edited 1 week ago)

    That could be a plausible reason for opacity if it were true, but I don’t think it’s true because blocking Tor (for example) is trivially discovered and the non-transparency only frustrates legit users. The opacity of an anti-tor policy has no effect on adversaries. Yet a vast majority of tor-hostile sites are sloppy about informing legit users.

    Infosec that relies on secrecy is already out on a limb in despiration. And in this situation, the collateral damage to friendlies based on arbitrary factors creates a heightened need to inform the legit users. An AI scraper bot is not going to be coded to know where to look for such announcements because that’s actually more effort for the attacker than manual trial and error. Note as well we are talking about relatively unsophisticated adversaries considering they were too lazy to code the user-agent header to dynamically blend better in the first place. (They will fix that in the future).

    Nonetheless, your point cannot be disregarded because those who take the crude approach of blocking on the basis of UA string are likely not thinking all this through. Perhaps some have consciously made the decision to not inform the legit users, but considering the widespread pattern of not informing users, it’s sloppy disregard for the most part.

  • source
  • parent
  • context
  • [–] [S] 1 point 1 week ago

    I suppose they would file an insurance claim and not give a fuck. It’s no money out of the pocket of the bean counter who decides infosec costs more than it saves. OTOH, hopefully insurance companies would react by charging a higher premium to grocers who have cloud-controllable refrigeration and no proper infosec. And then maybe /that/ would turn this around.

  • source
  • parent
  • context
  •  

    Background: I’m using Ungoogled Chromium, which I do not keep up to date because non-Debian packages are a big hassle to maintain. I expect this risk to be mine alone.

    Since websites are secretive¹ about their reasons for blocking, it has been quite painful (as a Tor user) that many services are not blocking Tor, but in fact blocking old versions of Chrome. WTF? Why does a website block old Chrome versions? My gut thought was the website wants to nanny users, to try to force users to secure themselves (“for the user’s own protection”), because surely a user with old chrome does not realistically threaten the server’s security.

    The answer: it turns out that AI bots are strangely using old Chrome versions for a user-agent header. So webmasters are reacting by blocking old versions of Chrome. What I don’t understand is why devs of AI bots would try to masquerade as old Chrome versions.

    And to a lesser extent I wonder why webmasters are reckless enough to take this collective-punishment-is-ok stance. It would be like a store owner banning customers wearing blue hats from their shop because some shoplifters were caught wearing blue hats.

    ¹ Exceptionally, codeberg.org actually respects our dignity enough to preduce an error message that says they are blocking old chrome. But they are the exception.

    view more: next ›