This is the email bomb protocol. This person creates a ton of accounts at different Fediverse servers and probably other applications, using the same email address on each, so the owner of the email gets pounded with emails. This is to cover up or make it impossible for the person to see that their bank account or whatever has been compromised and to prevent recovery.

Eventually the email provider protects itself by rate limiting the incoming emails so they aren't even seen. This causes the SMTP servers to continue trying to send the emails due to the temporary failure, generating even more email.

Ultimately the email provider will shut down the email address, and that poor person cannot see any of the emails sent by the bank with warnings or account instructions, and it certainly delays recovery until all the assets are removed from the account.

You should close registrations or at least require approval.

I don't know how it works on Peertube, but on Mastodon, the email validation is sent even if approvals are required, so it doesn't stop the bombing.

You can check your logs for some way to recognize the incoming requests and set up a firewall rule if you have access to a firewall that can do this.

It's an on/off kind of thing: https://outflux.net/blog/archives/2023/10/26/enable-mte-on-pixel-8/
https://developer.android.com/ndk/guides/arm-mte

My understanding is that while the older Pixel phones had MTE capability, it was off by default and could only be enabled under the dev settings. Google did not enable it by default because Android depends heavily on vendor board support packages, proprietary SOC drivers, and HAL modules. Google felt that driver code quality from 3rd-parties is not clean enough to enable kernel-level MTE without risking bootloops and spontaneous reboots. Even worse for C++ apps, which often read slightly past their allocated memory blocks.

Instead, Google rewrote critical core Android system daemons using Rust. Like the keystore, Bluetooth stack, DNS resolver, and others. I believe using Rust essentially makes MTE unnecessary.

Also full synchronous MTE mode has high CPU/memory bus penalties (could be 5-10% under heavy memory loads).

Google probably decided that since hardly anyone used MTE anyway on earlier Pixel devices, they could use the space in the chip for other uses.

The point is that the post makes it sound like using a Pixel 11 under Android results in less security than before, but for most people there is no change since they never used MTE anyway.

The media is really misinterpreting this and rewording it to make her look rediculous. All this means is she has a bad sense of humor.

I don't see the images when I'm on the VPN or off the VPN.

I run an Ubuntu 24.04 desktop with an NVIDIA card, and "flatpak run app.vger.voyager" gives me a white window and the error "Failed to create GBM buffer of size 2400x1600: Invalid argument"

If you run into the same problem, what worked for me is:
flatpak run --env=WEBKIT_DISABLE_DMABUF_RENDERER=1 app.vger.voyager

If you have this same problem and the above command works, you can make the fix permanently with:
flatpak override --user --env=WEBKIT_DISABLE_DMABUF_RENDERER=1 app.vger.voyager

Then "flatpak run app.vger.voyager" will work.

I use regular Firefox. I haven't seen any issues. Are you using any extensions that might be interfering? Try opening the browser in debug mode and see if the issues disappear.

This is going to attract more interest in using Facebook advertising to deliver malware, knowing that the attack surface will grow substantially soon.

Without ad blocking, Facebook will become a dangerous place to visit if not done so within some sort of sandboxing.

No problems whatsoever for me

The article doesn't mention it, but it entails a geo-block, not a worldwide block. Github will probably honor the ineffective geo-block.

Because of the Streisand Effect, though, the Indian government made the "problem" far worse for themselves. These mesh networks will grow much faster now, worldwide. They will have even less control over people's communications.

YouTube requires a valid Referer header to allow embedded playback, and if Nginx is stripping it out, like mine did, the videos throw an error and refuse to play.

I fixed this by updating the referrer-Policy header. I updated the server {} block with this:

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Does anyone know why it's been put on serverHold?