Emotet

joined 7 months ago
[–] Emotet@slrpnk.net 53 points 1 month ago

I simply can't wrap my head around the thought process behind launching a clusterfuck like this. Y Combinator probably didn't do their due diligence and simply rode the fading AI Bubble, so I can at least understand how the funding might have been approved.

But actively leaving your $250,000+/year job to team up with some questionable choices to basically fork two OS projects, change the discord links and generate an illegal licence for that shit show, all while proudly stating, publicly, "dawg i chatgpt'd the license, anyone is free to use our app for free for whatever they want. if there's a problem with the license just lmk i'll change it. we busy building rn can't be bothered with legal" when they are made aware of the fact.

This is absolutely insane, sounds like someone was about to get fired and decided to use some personal relations and fresh graduates to somehow successfully cash in one last time with absolutely no regard of even the basics. Pretty wild that those guys even managed to figure out how to found a Startup. Probably asked ChatGPT for instructions there, as well.

[–] Emotet@slrpnk.net 1 points 1 month ago* (last edited 1 month ago)

Great points.

Regular solar cells with better efficiency are already are thing, even in a compact travel format or as a novelty part of some electric cars. Those are cheap to produce, but still aren't practical at all, unless we're talking about something like a 2m² solar panel to charge a phone in a somewhat reasonable time on a very sunny day in an off-grid situation.

Using transparent solar cells additionally to regular ones in buildings instead of windows is pretty much the only reasonable application I can think of right now, but with a visible transmittance of 20% that's kinda farfetched as well.

[–] Emotet@slrpnk.net 30 points 1 month ago (11 children)

Das stimmt bei richtiger Verwendung schlichtweg nicht und es nützt niemandem, wenn man falsche Informationen herausposaunt. Wie auch im Artikel zu lesen, fand die timing attack auf üblichem Wege, gerade fürs deutsche Rechtssystem aber äußerst kontrovers statt:

Zur finalen Identifikation verpflichtete das Amtsgericht Frankfurt am Main schließlich den Provider Telefónica, unter allen o2-Kundinnen und -Kunden herauszufinden, wer von ihnen sich zu einem der identifizierten Tor-Knoten verband.

Bei einer Timing Attack werden, wie der Name schon sagt, Zugriffszeiten und möglichst viele (Meta-)Daten zu bestimmten Paketen statistisch abgeglichen. So kann man auch ohne direkten Zugriff auf die Daten bei ausreichender Datenlage feststellen, wer mit wem kommuniziert.

Hier wurde schlichtweg jeder o2 Kunde in Deutschland erstmal pauschal überwacht, ob er nicht mit einem bestimmten Server Kontakt aufnimmt. Um dem entgegenzuwirken, kann man natürlich erst einmal über einen (no log) VPN Provider gehen, um gar nicht erst zugeordnet werden zu können.

[–] Emotet@slrpnk.net 26 points 2 months ago

Instead of waiting for a zombie fungus to evolve into something that can infect humans, they decided to cut out the middleman and made cyborg mushrooms.

[–] Emotet@slrpnk.net 17 points 2 months ago (1 children)

Random guy with no affiliation to crypto and only a vague understanding of monero from another instance here, who saw the post on /all.

Most people stumbling over posts like this probably see yet another shady cryptocurrency and aren't interested or even actively dislike it, resulting in downvotes. Calling people "grudgeful bitfags" and "overly-sensitive leftist fediverse dwellers" probably doesn't help all that much either, neither do comments that attribute a general disinterest to a "very successful psyop by the CIA to make crypto look like a scam".

[–] Emotet@slrpnk.net 6 points 3 months ago (1 children)

if you've flown for 12 hours with all that entails to go to the US (for a reason) and are presented with the choice of unlocking your phone or be denied entry, you will cooperate. Especially if you moved all your sensitive info beforehand.

[–] Emotet@slrpnk.net 6 points 4 months ago

Yikes. Thanks for putting in the works and sharing your findings to you and @Nothing4You@programming.dev.

[–] Emotet@slrpnk.net 4 points 4 months ago

If you share a WiFi connection with an attacker at a coffee shop, for example, there are certain attacks they can execute to see the unencrypted parts of your Internet communications (e.g., the domain names of the websites you visit) and interfere with your communications to carry out other advanced attacks against you. Typically, security experts recommend the use of a VPN to protect against attackers with whom you share a WiFi connection. Our research reveals that using a VPN opens you up to similar attacks from other VPN users with whom you share your VPN server. In the same way that the WiFi radio signal is a shared resource that makes users vulnerable to attacks, there is a shared resource on VPN servers called a port (each connection through the VPN server is assigned to a port). By carefully crafting packets from within the attacker’s own connection to the VPN server and from a remote Internet location controlled by the attacker, it is possible to carry out attacks on other VPN users who are using the same VPN server in a manner that is very similar to the attacks that could be carried out on shared WiFi. We call this attack primitive a port shadow because the attacker shadows their own information on a victim’s port as a shared resource, and this attack primitive can lead to snooping of unencrypted data, port scans, or connection hijacking.

Diagram

[–] Emotet@slrpnk.net 29 points 4 months ago* (last edited 4 months ago) (2 children)

Ah. So Lemmy with version 0.19.4+ allows users to set a custom thumbnail URL for a post, which can be set to pretty much anything resembling a valid link, especially a link to another image in the local pictrs db and trigger a deletion of both when a minimum age check is passed.

Also this:

Except that the field allows some funny URLs e.g. https://t.t/;';'%22;...[:%3C%3E?]%27;%20yaba%20daba%20doo, if this is an issue too is not confirmed

Relevant XKCD

[–] Emotet@slrpnk.net 17 points 4 months ago

"Oi mate, I wonder if this codebase uses color or colour. Anyway, push to PROD. "

[–] Emotet@slrpnk.net 19 points 4 months ago (2 children)

str(float("100.0")) + "%"

[–] Emotet@slrpnk.net 25 points 4 months ago (3 children)

This is exactly how it's supposed to work in a functioning democracy.

Where ideally everyone, but at least a critical percentage of citizens is educated enough to recognize the pattern of deceit and false, but easy answers to very complex questions from extremist parties.

Where established parties don't feel the need to pander to the votes of extremist parties by cooperating and adapting points pushed by extremists.

Where the average citizen doesn't feel left out by the system and is tempted to align themselves with extremist parties in order to protest the current reality of said system.

Where the system implements safeguards to not allow the system to be taken hostage by extremists.

Would be nice, eh?

 

@elvith@feddit.org und ich haben mehr oder weniger unabhängig zwei Web Apps entwickelt , welche beide bis auf gewisse Extrafeatures den Accountumzug so einfach wie möglich gestalten sollten:

https://stablenarwhal.github.io/Lemmy-Userdata-Migration/

Features:

  • Don't trust me or GitHub? Clone the project and host it yourself or run it locally (Example in Wiki)
  • Export user data from any Lemmy instance (>=v0.19)
  • Download user data as a text file
  • Modify user data, e.g. to add or remove followed users/communites (Example in Wiki)
    • "display_name" ​
    • "bio" ​
    • "avatar" ​
    • "banner" ​
    • "matrix_id" ​
    • "bot_account" ​
    • "settings" ​
    • "followed_communities" ​
    • "saved_posts" ​
    • "saved_comments" ​
    • "blocked_communities" ​
    • "blocked_users" ​
    • "blocked_instances"
  • Transfer user data to the target account on the target instance

https://elvith-de.github.io/lemmy-migration/

Features:

  • Login and export settings from any Lemmy instance (e.g. feddit.de)
  • Optionally: Find local communities on the target instance that match followed communities
  • Optionally: Backup your settings to a file (can be imported on any Lemmy instance in your profile)
  • Login and import settings to any Lemmy instance (e.g. feddit.org)
 

@elvith@feddit.org und ich haben mehr oder weniger unabhängig zwei Web Apps entwickelt , welche beide bis auf gewisse Extrafeatures den Accountumzug so einfach wie möglich gestalten sollten:

https://stablenarwhal.github.io/Lemmy-Userdata-Migration/

Features:

  • Export user data from any Lemmy instance (>=v0.19)
  • Download user data as a text file
  • Modify user data, e.g. to add or remove followed users/communites (Example in Wiki)
    • "display_name" ​
    • "bio" ​
    • "avatar" ​
    • "banner" ​
    • "matrix_id" ​
    • "bot_account" ​
    • "settings" ​
    • "followed_communities" ​
    • "saved_posts" ​
    • "saved_comments" ​
    • "blocked_communities" ​
    • "blocked_users" ​
    • "blocked_instances"
  • Transfer user data to the target account on the target instance

https://elvith-de.github.io/lemmy-migration/

Features:

  • Login and export settings from any Lemmy instance (e.g. feddit.de)
  • Optionally: Find local communities on the target instance that match followed communities
  • Optionally: Backup your settings to a file (can be imported on any Lemmy instance in your profile)
  • Login and import settings to any Lemmy instance (e.g. feddit.org)
 

So I wrote a little web app that allows a user to move their user data, like settings and subscribed/banned communities, from one account/instance to another.

It runs completely client-side, but is hosted on GitHub for the moment. Maybe it'll be of some use!

Features:

  • Export user data from any Lemmy instance (>=v0.19)
  • Download user data as a text file
  • Modify user data in the browser, e.g. to add or remove followed instances
  • Transfer user data to the target account on the target instance
 

An dieser Stelle reposte ich auch auf der neuen deutschen Main-Instanz zwei einfache Wege, um seinen User (Settings und abonnierte/geblockte Communities) von einer Lemmy Instanz auf eine andere umzuziehen, beispielsweise von feddit.de auf feddit.org, von meinem ursprünglichen Post unter feddit.de/c/main ( https://alexandrite.app/feddit.de/post/11325409)


Weg 1, falls man noch einen Browser mit aktiver Session auf feddit.de hat:

Lemmy bietet seit Version 0.19 eine Funktion an, um die user data zu ex- und importieren. Das geht normalerweise über einen Button in den Settings des Webinterfaces, das geht aktuell bei feddit.de nicht.

Aber der zugrundeliegende API-Aufruf funktioniert noch, solange man noch mit einem Browser auf feddit.de eingeloggt ist:

  1. Man gehe auf https://feddit.de/api/v3/user/export_settings und speichert die zurückgegebene Datei als irgendwas.json
  2. Man nehme einen (neuen) Account auf einer stabilen Instanz der Wahl, gehe auf /settings und lade irgendwas.json über den Import-Button hoch.
  3. Voilà, man genieße die neue Instanz.

Das funktioniert mit jeder Instanz >=0.19, man muss lediglich das "feddit.de" in der URL ersetzen. Und wenn das Webinterface funktioniert, geht das auch über den Export- Button in den Settings.


Weg 2:

Für die Leute, die keine offene Browser Session haben, hier ein kleines, aber funktionales Bash Script, welches im Ausführungsverzeichnis eine myFedditUserData.json erstellt, welche bei anderen Instanzen importiert werden kann.

Anforderungen:

  • Linux/Mac OS X /Windows mit WSL
  • jq installiert (Unter Ubuntu/Debian/Mint z.B. per sudo apt install -y jq

Anleitung:

  • Folgendes Script unter einem beliebigen Namen mit .sh Endung abspeichern, z.B. getMyFedditUserData.sh
  • Script in beliebigen Textprogramm öffnen, Username/Mail und Passwort ausfüllen (optional Instanz ändern)
  • Terminal im Ordner des Scripts öffnen und chmod +x getMyFedditUserData.sh ausführen (Namen eventuell anpassen)
  • ./getMyFedditUserData.sh im Terminal eingeben
  • Nun liegt im Ordner neben dem Script eine frische myFedditUserData.json

Anmerkung: Das Script ist recht simpel, es wird ein JWT Bearer Token angefragt und als Header bei dem GET Aufruf von https://feddit.de/api/v3/user/export_settings mitgegeben. Wer kein Linux/Mac OS X zur Verfügung hat, kann den Ablauf mit anderen Mitteln nachstellen.

Das Script:

#!/bin/bash

# Basic login script for Lemmy API

# CHANGE THESE VALUES
my_instance="https://feddit.de"			# e.g. https://feddit.nl
my_username=""			# e.g. freamon
my_password=""			# e.g. hunter2

########################################################

# Lemmy API version
API="api/v3"

########################################################

# Turn off history substitution (avoid errors with ! usage)
set +H

########################################################

# Login
login() {
	end_point="user/login"
	json_data="{\"username_or_email\":\"$my_username\",\"password\":\"$my_password\"}"

	url="$my_instance/$API/$end_point"

	curl -H "Content-Type: application/json" -d "$json_data" "$url"
}

# Get userdata as JSON
getUserData() {
	end_point="user/export_settings"

	url="$my_instance/$API/$end_point"

	curl -H "Authorization: Bearer ${JWT}" "$url"
}

JWT=$(login | jq -r '.jwt')

printf 'JWT Token: %s\n' "$JWT"

getUserData | jq > myFedditUserData.json

@elvith@feddit.org hat mein Script auch in PowerShell nachgebaut, welches unter Windows ohne WSL auskommt: https://gist.github.com/elvith-de/89107061661e001df659d7a7d413092b

# CHANGE THESE VALUES
$my_instance="https://feddit.de" # e.g. https://feddit.nl
$target_file = "C:\Temp\export.json"

########################################################
#Ask user for username and password
$credentials = Get-Credential -Message "Logindata for $my_instance" -Title "Login"

$my_username= $credentials.UserName
$my_password= $credentials.GetNetworkCredential().Password

# Lemmy API version
$API="api/v3"

# Login
function Get-AuthToken() {
    $end_point="user/login"
    $json_data= @{
        "username_or_email" = $my_username;
        "password" = $my_password
    } | ConvertTo-Json

    $url="$my_instance/$API/$end_point"

    (Invoke-RestMethod -Headers @{"Content-Type" = "application/json"} -Body $json_data -Method Post -Uri $url).JWT
}

# Get userdata as JSON
function Get-UserData() {
    $end_point="user/export_settings"

    $url="$my_instance/$API/$end_point"

    Invoke-RestMethod -Headers @{"Authorization"="Bearer $($JWT)"} -Method Get -Uri $url
}

$JWT= Get-AuthToken

Write-Host "Got JWT Token: $JWT"

Write-Host "Exporting data to $target_file"
Get-UserData | ConvertTo-Json | Out-File -FilePath $target_file
view more: next ›