tomudding

The Dutch government has a similar list[0] though less extensive and does not (yet) include repos from the new platform

[0] https://oss.developer.overheid.nl/repositories

which is at least detected by https://downdetectorsdowndetectorsdowndetectorsdowndetector....

(2020)

Yes, fixed in all (at the time) supported versions in October last year [0].

[0] https://github.com/php/php-src/commit/248f647

I have been using the Timeless skin [0] for quite some time now and the main reason I switched was that the content would be a bit more condensed towards the middle of the page. This helps a lot on larger monitors and I can see why this new theme also does something similar. However, the large amount of whitespace on the sides is just wasted and in combination with the fact that more interaction is required to do basic things (like changing the language of a page) is something that makes this new theme not "barely noticeable".

[0] https://en.wikipedia.org/w/index.php?title=Main_Page&useskin...

There is a list of partners [0], I thought I had seen regexes at some point but I can no longer find them.

[0] https://docs.github.com/en/enterprise-cloud@latest/code-secu...

He leaves behind a great legacy. I can highly recommend Blood Music, Eon, or Forge of God if you have never read one of his books. However, my personal favourite was actually the (Halo) Forerunner Saga series.

Cloudflare caches robots.txt by default when proxied (the only .txt-file that they automatically cache), for all other content the following from their ToS probably applies:

Use of the Services for serving video or a disproportionate percentage of pictures, audio files, or other non-HTML content is prohibited, unless purchased separately as part of a Paid Service or expressly allowed under our Supplemental Terms for a specific Service.

We will never know the reasoning of the support agent who replied to the EasyList maintainers, but I can imagine that it is indeed disproportionate for EasyList.

I really hope that Cloudflare actually sees that they are making a wrong decision here and actually help the EasyList maintainers.

GitHub has a soft limit of like 100 GB/month on transfers for Pages. According to the Adguard blog post traffic was already several TBs a day before the issue arose.

but want to make sure we do it right.

Make sure you do it differently than how Muse Group did it with Audacity (specifically the announcement and explanation of why and what parts) [0]. Which I'd argue is not particularly difficult to do.

[0] https://arstechnica.com/gadgets/2021/07/no-open-source-audac...

Previous discussion here:

https://news.ycombinator.com/item?id=30499150

It has been an issue since September/October last year, but occasionally it seems to get worse (and then suddenly no spam mails).

Scanning the LAN through your browser is nothing new. JS-Recon from AnD Labs [0] is a tool from 2010 that could do it. I have seen eBay [1], Facebook [2], and Halifax [3] do it too, albeit for other reasons than scanning for outdated devices (fraud/loss prevention). LexisNexis' ThreatMetrix [4] is commonly used to do this.

Please note that this is a copy of a comment I made 2 years ago and I have not tested the links to see if they are still correct.

[0] https://web.archive.org/web/20101128053633/http://www.andlab...

[1] https://forum.ultravnc.net/viewtopic.php?f=7&t=33509

[2] https://www.reddit.com/r/AskNetsec/comments/4j0nas/why_is_fa...

[3] https://www.theregister.com/2018/08/07/halifax_bank_ports_sc...

[4] https://risk.lexisnexis.com/products/threatmetrix

Can anyone tell me which other "large" projects have this capability?

I'd say that all popular apps (Android/iOS) have such functionality. Most will probably use it for A/B testing, but technically you could change anything you'd like with it.

Apart from the companies creating their own implementations [0], popular services I have seen include Optimizely [1] and Firebase Remote Config [2].

[0] https://engineering.fb.com/2014/01/09/android/airlock-facebo...

[1] https://www.optimizely.com/products/intelligence/full-stack-...

[2] https://firebase.google.com/docs/remote-config/

Or you simply didn't know that Firefox made it the default a while ago.

Oh, interesting! I did not know it is a default now. I can imagine why they would enable it by default, but when Cloudflare (which I assume is the default DoH provider) has a problem at some point everyone is doomed.

Really wish they also could make it so the data collection part is opt-in instead of opt-out (which at this point in time appears to be the actual cause of this problem).

Disabling DoH and properly closing Firefox most certainly works (for me). However, if you had enabled DoH then you probably do not want to turn it off, in which case disabling HTTP/3 as mentioned is the only proper solution.

I think this can also be a good thing, as long as you also use software which makes sure you have a distinct 'unique' fingerprint for each session.

Not that I am a huge fan of Brave, but I think they have implemented something like this for certain (or all) APIs. You will still have a unique fingerprint, but it should not match to any previous fingerprints you had in the past.

Edit: see https://brave.com/privacy-updates/3-fingerprint-randomizatio...

I think this sounds more like some sort of fingerprinting attempt. It good to see that random access to these kind of resources fails due to new(er) browser controls. However, this does not mean that the fingerprinting actually failed.

There is probably some way to determine if the request was denied automatically by the browser or manually by the user (e.g., time to get "response"), which is definitely something which can be used for fingerprinting.

Which reminds me of fingerprinting by tiny differences in the audio API provided by browsers [0]. Super interesting, but also a bit depressing. Also works for things like canvases and WebGL.

EFF allows you to check how fingerprintable your browser is [1]. Do note that the results may not be very accurate.

[0] https://fingerprintjs.com/blog/audio-fingerprinting/

[1] https://coveryourtracks.eff.org

While I personally believe the questions stated were perfectly reasonable (and could have been genuine questions from someone), I can understand that people feel (legally) pressured to provide answers to the questions. Which puts this study in a grey area.

With regard to GDPR, the "respond within x" is simply not applicable. The one month period is strictly for any requests concerning Article 15 through 22 and none of the questions are talking about any of that.

Now, if one of the questions was something along the lines of "do you process any information related to me?" then it would potentially fall under Article 15.1 and would require a timely response. IANAL, however, I think in such cases you could simply point to a privacy policy, which you are already required to have.

They increased the prices recently, without any VAT a new instance of the CX11 is now €3.49 p/month.

I do hope they will start providing cloud instances without IPv4 soon too (they say they are working on it).

Probably related to the Google Cloud "service disruption" that started earlier this morning: https://status.cloud.google.com/incidents/1xkAB1KmLrh5g3v9ZE...

It was very frustrating to see DNS working perfectly fine (since DNS is always the problem) and the connections just timing out.

"What is the Answer to the Ultimate Question of Life, The Universe, and Everything?"

"The Ultimate Question"

:(

While theoretically secure, CBC ciphers are considered weak because of their implementation. They are more often than not vulnerable to padding oracle attacks.

These issues have been around for more than a decade, but they keep popping up. The last 3-ish years a larger push has been made to disable CBC ciphers (in SSL/TLS, SSH, etc.). See [0, 1, 2, 3, and 4] for more information.

GCM/CTR is considered to be a more secure alternative.

[0] https://en.wikipedia.org/wiki/Padding_oracle_attack#Padding_...

[1] https://www.openssh.com/txt/cbc.adv

[2] https://ieeexplore.ieee.org/document/5207634 (is CPNI-957037)

[3] https://alicegg.tech/2019/06/23/aes-cbc.html

[4] https://docs.microsoft.com/en-us/dotnet/standard/security/vu...

[n]: You can find more information with a quick search, this also includes security advisories from HPE, RedHat, IBM, and F5.

Unrelated to this topic, but Death's End is also a great book if you haven't started reading it. I can also recommend Ball Lightning which more or less takes place before the events in the The Three-Body Problem.

Can you provide a link to the commit that fixes it?

If I understand the issue [0] correctly, these two commits should be the fix:

https://github.com/signalapp/Signal-Android/commit/e90fa05d6...

https://github.com/signalapp/Signal-Android/commit/b9657208f...

The former updates how recipients (or really threads, I suppose) are merged (the issue occurred when trimming threads) and the latter changes the way how thread ids are generated (now automatically incremented). Together they should prevent unrelated recipients (threads) from being merged.

[0] https://github.com/signalapp/Signal-Android/issues/10247#iss...

Additionally, Pogba did the same with Heineken yesterday. Yet that stock (HEIA:AMS [0]) went up 1.39% today, without any other clear signals that would cause the stock to go up that much.

Correlated (maybe even caused by)? Who knows, it is the stock market after all, so ¯\_(ツ)_/¯.

[0] https://live.euronext.com/en/product/equities/NL0000009165-X...

Lovely extension, some discussions about its functionality can be found in this thread [0] after the removal of the extension from Chrome's Web Store.

One things I noticed is that it can be too aggressive from time to time. I encountered this "issue" when creating a Bitwarden account, I was unable to verify my e-mail address because ClearURLs was (unbeknownst to me) removing some of the parameters from the activation URL. While similar cases will most likely not be frequent, it can be really frustrating to determine why something does not work (also applies to ad blockers).

[0] https://news.ycombinator.com/item?id=26564638

I think they could have spent their time better on some much more needed features/improvements, instead of adding a payment system (with imho bad cryptocurrency).

Love it!

9. IANA Considerations

If this work is standardized, IANA shall set up a registry for criminal networks and addresses. If the IANA does not comply with these orders, the Protocol Police shall go and cry to ICANN before becoming lost in its bureaucracy.

Quick reminder that icann.sucks is only $185k.