Hakkin

The key shows up if you win, you can simulate it by adding ?devwin=1 to the URL.

Oh, this is interesting. I have been messing around with a WebExtension for dumping encoded WebRTC media streams by intercepting streams on RTCPeerConnection.addTrack, but it doesn't work reliably since the current WebRTC encoded stream API(s) only supports a single reader, so if the actual website is also using the API, it either breaks the site or it's impossible to intercept the media. This seems like a nice workaround, I had briefly considered some kind of proxy but I wrote it off since WebRTC traffic is encrypted, I never considered proxying the peer connection API calls themselves. Pretty clever.

A scrub only reads allocated space, so in your 10TB example, a scrub would only read whatever portion of that 10TB is actually occupied by data. It's also usually recommended to keep your usage below 80% of the total pool size to avoid performance issues, so the worst case in your scenario would be more like ~53% assuming you follow the 80% rule.

Is this true? KADOKAWA had a massive hack last year that leaked a large amount of sensitive user data and as far as I know has faced no legal repercussions. Obviously they took a decent financial and reputational hit, but that was just an effect of the hack itself, not any government intervention.

I definitely noticed the performance boost on my Pixel 8, for some reason it seems to really not like wireguard-go, it struggled to pull even 100mbps, maybe something unoptimized on Google's custom hardware. With the new GotaTun version I can pull 500mbps+, though unfortunately it also seems to have introduced a bug that randomly prevents the phone from entering a deep sleep state, so occasionally my battery will randomly start draining at 10x normal speed if I have it enabled until I reboot.

That only helps so much, some things still won't work if the browser thinks you're talking over an unencrypted connection, like HTTP/2. Technically HTTP/2 allows unencrypted connections (h2c) but as far as I know, no browser implements it (including Tor Browser) and server support is also somewhat limited, so Tor Browser is limited to HTTP/1.[01] on Onion sites unless they have a TLS certificate.

Note that you don't actually need the generated column either, SQLite supports indexes on expressions, so you can do, for example,

  CREATE INDEX subjectidx ON messages(json_extract(headers, '$.Subject'))

I find it useful to create indexes like this, then create VIEWs using these expressions instead of ALTER'ing the main table with generated columns.

It sets a cookie with a JWT verifying you completed the proof-of-work along with metadata about the origin of the request, the cookie is valid for a week. This is as far as Anubis goes, once you have this cookie you can do whatever you want on the site. For now it seems like enough to stop a decent portion of web crawlers.

You can do more underneath Anubis using the JWT as a sort of session token though, like rate limiting on a per proof-of-work basis, if a client using X token makes more than Y requests in a period of time, invalidate the token and force them to generate a new one. This would force them to either crawl slowly or use many times more resources to crawl your content.

Much better than infinite Cloudflare captcha loops.

If a disk is encrypted, you don't have to worry about the contents if you eventually have to RMA or dispose of the disk. For this use case, it makes no difference how the encryption key is input.

It's fairly rare during general browsing, but Mullvad makes no attempt to hide that their servers are VPN IPs, so any site that explicitly wants to block VPN users will very likely block Mullvad. Mostly an issue if you're trying to use a VPN to view geo-blocked media.

I have an AOC Q27G3XMN and while I do get reduced motion blur from this, I also experience very bad color banding/shifting. Messing with some of the values in the script config makes it slightly better, and changing the overdrive setting on the monitor seems to affect it as well, but there is still pretty strong banding no matter what strength it's on. I tested on my phone (Pixel 8) and it works very well there without any banding or color weirdness, so I guess it's just something about this particular monitor that doesn't work well with this method.

You can bypass the "Out of bound" message by setting a Javascript breakpoint after `let t = JSON.parse(d[e].config_str)` and then run `Object.values(t.camera.presets).map(o=>o.max_distance=50&&o)` in the console.

It breaks down pretty quickly once you get outside the default bounds, as expected, though.

TIL HAR files are just JSON, I always assumed they were some kind of binary archive file. Very convenient.

YouTube still supports WebSub (PubSubHubbub)[0] via their own hub[1]. There's very little documentation on how to actually use it though, and it seems like it's been on life support for quite awhile, a lot of small oddities have crept in over time and recently there was extended outages where notifications stopped being pushed. The current documentation isn't even correct, since is specifies an incorrect topic URL (should be /xml/feeds/ rather than just /feeds/, the /feeds/ link is for the base atom feed, and while it actually does "work" if you supply it to the WebSub Hub, it won't send you correct notifications).

[0] https://developers.google.com/youtube/v3/guides/push_notific...

[1] https://pubsubhubbub.appspot.com/

This is true for a few different compression formats, it works for bzip2 too. I've processed a few TBs of text via `curl | tar -xOf - | bzip2 -dc | grep` for tar files with lots of individually compressed bz2 files inside.

uBlock Origin has some advanced filter syntax that can sometimes deal with sites like this. It can intercept, modify or replace JavaScript functions, objects, network requests, parsing data, cookies, etc. That being said, writing filters for sites like these is somewhat of a dark art, it usually involves reverse engineering the page's JavaScript to the point where you understand what it's actually sending and checking for to function correctly, then figuring out a way to bypass those checks by selectively modifying the JavaScript's functionality.

Things like this are why I worry a bit about the proliferation of things like WASM, while JavaScript isn't great, it actually gives a great amount of control to the end user, to both see, understand and the ability to actually modify what is running in their browser. With WASM, all of this becomes highly impractical. Instead of a (semi-)readable, modifiable block of interpreted code, with the ability to inspect and modify the state at almost arbitrary points, you just get opaque binary blobs that you basically can't do anything with. As more and more sites switch to using compiled WASM blobs for their logic, it will become increasingly difficult to observe or modify any behavior of these websites as an end user.

This is more or less also what (GNU) ddrescue does[0]. It first tries to do a linear copy of the full disk, skipping any errors, then goes back and tries to re-read the error sectors until you either cancel or it succeeds. It also keeps track of everything it's doing so you can stop and start the process without it redoing work.

[0]https://www.gnu.org/software/ddrescue/manual/ddrescue_manual...

I'm not sure what you mean, I just added a new Gmail account to test and it went through the normal OAuth flow. I didn't have to enter any password into Thunderbird itself, just the Gmail OAuth popup.

Likely meant Qubes OS[0], not sure why it was phrased as a riddle.

[0] https://www.qubes-os.org/

DeepL has its moments but it also has many many failure cases. It particularly is very bad with long text blocks, it commonly completely misses sections of text or repeats the same block of text multiple times.

I don't know if it's still the case, but it used to be that pretty much any semi-major company had a support presence on Twitter. Often just tweeting anything with the name of the company in it would get you a response from a support rep in a few minutes. It was one of the best ways to get in direct contact with support for many companies. The API limitations probably severely hampered this avenue of support for most companies, I imagine.

Isn't there software emulated TPMs already? I think all this is doing is ensuring the cookies stay on the device that has the key (assuming a proper hardware TPM). If a site requires this, the underlying algorithm could be implemented in software using shared keys and it wouldn't do much to prevent scraping.

Ah, I think I understand the random bytes at the start of the script now. They're prepended to make the partial output of the "corrupted" (pre-tr'd) test stream look like random data. Without those random bytes, you will see part of the start of the script if you observe the partially decompressed output before xz throws an error. They really thought quite carefully about hiding this well.

Still not sure about the repeated lines, though now I'm convinced there must be some reason for it.

I also thought it was odd. There's also different random bytes (not random text, actual random bytes) prefixed to the start the scripts, but the bytes are prefixed by a hash symbol, which comments them out, so they don't affect the script. It seems intentional, but I can't think of why they would be there. I thought maybe xz would skip compression if the input was short/not complex enough or something, so they were added to pad the size, but removing them and re-compressing with xz seems to properly compress it, none of the original plaintext is in the compressed archive bytes.

One thing I noticed while trying to reproduce the exact bytes included in the .xz file committed to git is that the script's xz stream doesn't seem to be compressed by any of the default xz presets, I was only able to reproduce it by using `xz --lzma2=dict=65536 -c stream_2`. All the default numbered presents chose a different dictionary size. Another odd seemingly intentional choice, but again I don't understand the reasoning.

and then that fork becomes more performant or feature rich or secure or (etc), and it becomes preferred over the original code base, and all distributions switch to it, and we're back at square one.

The post doesn't spell it out but I wonder if they implied there's a suspicion that the person doing the pressuring there is also another sock puppet of JiaT75 as some scheme of getting access to xz

You can get the user's e-mail by clicking the "Reply via e-mail to" on the page. It matches the <firstname><lastname><number>@protonmail.com of the other sockpuppets, and the PGP key for the account was made 1 day prior to their first communication on that mailing list.

If I could change one thing about S3's API I would like an option to read the metadata with the listings. Rclone stores modification times of files as metadata on the object and there isn't a bulk way of reading these, you have to HEAD the object. Or alternatively a way of setting the Last-Modified on an object when you upload it would do too.

I wonder if you couldn't hack this in by storing the metadata in the key name itself? Obviously with the key length limit of 1024 you would be limited in how much metadata you could store, but it's still quite a lot of space, even taking into account the file path. You could use a deliminator that would be invalid in a normalized path, like '//', for example: /path/to/file.txt//mtime=1710066090

You would still be able to fetch "directories" via prefixes and direct files by using '<filename>//' as the prefix.

This kind of formatting would probably make it pretty incompatible with other software though.

I encountered similar issues with FTS5, I found you can clean it up slightly with a CTE

  WITH matches(id) AS (
    SELECT rowid FROM address_fts WHERE address_fts MATCH 'google'
  )
  ...
  WHERE
    fa.rowid IN matches
    OR
    ta.rowid IN matches

It makes it slightly easier to generate queries since you only have to generate the CTE and then you can just use the CTE name everywhere else.

I tried to do Japanese -> English for multiple audio snippets using the Seamless huggingface demo and all of them output complete gibberish. Really makes me question how many of the languages they claim to "support" are actually usable. ElevenLabs at least produces a result that resembles the input, so they still have the edge in some places.