• 0 Posts
  • 192 Comments
Joined 2 years ago
cake
Cake day: December 14th, 2023

help-circle






  • BakedCatboy@lemmy.mltoPrivacy@lemmy.mlPasskeys
    link
    fedilink
    English
    arrow-up
    20
    ·
    7 days ago

    I don’t which is why I use my selfhosted vaultwarden instance to store mine. I refuse to add passkeys to any service if they don’t properly invoke the standard passkey prompt in a way that’s compatible with bitwarden, otherwise I love passkeys and use them everywhere possible as long as I have complete control over them.



  • I managed to use the reader mode trick to get the text:

    Signal warns it would pull out of Canada if made to comply with lawful access bill

    Marie Woolf 6 - 8 minutes

    Udbhav Tiwari, Signal vice-president of strategy and global affairs, says Ottawa’s Bill C-22 could threaten encryption and make private messaging services a potential target for cyberattacks.

    Secure messaging service Signal, which uses end-to-end encryption, is warning it would withdraw from Canada if asked to compromise its users’ privacy under Bill C-22, Ottawa’s proposed lawful access legislation.

    In an interview, Udbhav Tiwari, Signal vice-president of strategy and global affairs, said the company has deep concerns about measures in the bill, including its potential to introduce security vulnerabilities.

    Mr. Tiwari said that Signal “would rather pull out of the country than be compelled to compromise on the privacy promises we have made to our users.”

    He expressed fears that Bill C-22, which is currently being scrutinized by Commons committee, could threaten encryption.

    Mr. Tiwari also warned changes to systems required under the bill could make private messaging services a potential target for cyberattacks.

    “Bill C-22 could potentially allow hackers to exploit these very vulnerabilities engineered into electronic systems, with private messaging services serving as an ideal target for foreign adversaries,” he added in a text message.

    Spy watchdog asks for greater oversight of proposed lawful access regime, including to boost public trust

    Signal was founded in 2012 and is not linked to major tech companies. It has millions of Canadian users and is used for secure communication by journalists, dissidents, government agencies, private citizens and politicians.

    The bill would require telecoms, internet companies and other electronic service providers to make changes to their systems to give surveillance capabilities to police and the Canadian Security Intelligence Service to combat threats and criminal activity.

    Signal runs on its own centralized servers. The only user data it stores are phone numbers, users’ last login information and the date they joined the service. Users’ contacts, chats and other information are stored by users themselves, on their phones.

    The bill would require “core providers” – which would later be defined through regulations – to retain metadata for up to a year.

    The metadata would not include e-mails, web-browsing history, social-media activity or text messages, but it could include information about which telephone numbers have been in touch with each other, and data allowing someone’s location to be pinpointed.

    “End-to-end encryption is incompatible with exceptional access, no matter how creative the route taken to achieve it,” Mr. Tiwari added in a statement. “Provisions that enable the deliberate engineering of vulnerabilities into critical infrastructure like Signal are a grave threat to privacy everywhere.”

    White hat hackers warn lawful access bill could make it easier for criminals to penetrate Canadian systems

    Last year, a Signal chat between U.S. national security officials and Defence Secretary Pete Hegseth mistakenly included a journalist. The chat specified timings of warplane launches and when bombs would drop in planned attacks on Yemen’s Houthis.

    At a Commons committee hearing on Bill C-22 earlier this month, Public Safety Minister Gary Anandasangaree, who introduced the bill, was asked about its impact on encrypted services, and described it as “encryption-neutral.”

    Tech companies, including Apple, and the Canadian Chamber of Commerce have warned the lawful access regime proposed by the bill could weaken or break encryption.

    Meta, which owns encrypted messaging service WhatsApp, testified earlier this month to a Commons committee examining the bill. Rachel Curran, the tech giant’s head of public policy in Canada, warned that the bill “could conscript private companies into service as an arm of the government’s surveillance apparatus – with expansive scope and insufficient safeguards.”

    “As drafted, the bill could require companies like Meta to build or maintain capabilities that break, weaken, or circumvent encryption or other zero-knowledge security architectures, and force providers to install government spyware directly on their systems,” she said.

    Simon Lafortune, a spokesperson for Mr. Anandasangaree, said Wednesday: “We want to reassure Signal and all service providers that we are not legislating to require them to install capabilities to enable surveillance and any assertions otherwise are false.”

    The broadly worded bill could lead to the rollout of forced metadata collection for messaging apps, said Kate Robertson, a senior research associate at the University of Toronto’s Citizen Lab whose expertise includes cybersecurity, state agencies’ use of personal data and surveillance activities.

    Ms. Robertson said that when recently pressed to commit to protection for encryption, “government officials were reticent.”

    “Encrypted communication systems are a lifeline for human rights defenders, journalists and dissidents around the world,” she said.

    Matt Hatfield, director of OpenMedia, a non-profit that advocates for widespread and affordable internet access, said “Signal, WhatsApp and other encrypted messaging services could clearly be scoped into Bill C-22 under its current definitions of electronic service providers.”

    “A future public safety minister could issue orders to them requiring them to retain user metadata,” Mr. Hatfield said in an e-mail.

    Michael Geist, Canada Research Chair in internet and e-commerce law and professor at the University of Ottawa, said he expected private messaging services to become a high-value target for law enforcement if the bill becomes law, including for obtaining metadata.

    He said that currently, courts focus on obtaining data itself, but the lawful access regime would mandate permanent structural changes to company systems.

    “There is a significant difference between court-ordered disclosures and mandates to retrofit or change technical structures,” he said.



  • BakedCatboy@lemmy.mltolinuxmemes@lemmy.worldi i
    link
    fedilink
    English
    arrow-up
    2
    ·
    15 days ago

    Seconding or thirding this! I have quite a few friends who enjoy weird tarot decks, and I think it would make such a cool intersection of interests and definitely one of the more unique decks. I would definitely give some as gifts if it were to come to fruition!


  • You’re welcome! It was a fun hyperfixation project. I ended up making the script so easy to use I decided to just scrape every other endpoint too, so if anyone wants it, here’s a full dump of every endpoint, it’s only like 4x bigger:

    https://mega.nz/file/YF4F3bCS#pkS8Ki9QuucMGJF65YwGUE-NQZ78QEWs73fmF71qa18

    And if anyone wants to do their own scraping to get more up to date data later, just pip install:

    python-dotenv==1.2.2
    Requests==2.34.2
    tqdm==4.67.1
    

    Put API keys in .env or export env vars:

    CLIENT_ID=<client_id>
    # Provide to fetch new token
    CLIENT_SECRET=<client_secret>
    # Optional, provide to reuse existing access token, secret will not be used
    ACCESS_TOKEN=<access_token>
    

    And just run python dump.py games or any other endpoint in the api docs like release_dates etc. It outputs the json and a simple log to an output folder wherever you ran it. No error handling or checkpointing so if it fails partway through you don’t get anything, but I didn’t have a single error the whole time.

    usage: dump.py [-h] api_route
    
    IGDB Dump Script
    
    positional arguments:
      api_route   The API route to scrape, eg: games or game_time_to_beats
    
    options:
      -h, --help  show this help message and exit
    

    dump.py:

    import argparse
    import json
    import logging
    import os
    import pathlib
    import time
    from dotenv import dotenv_values
    import requests
    from tqdm import tqdm
    
    API_PAGE_SIZE = 500
    OUT_DIR = "output"
    
    config = {
        **dotenv_values(".env"),
        **os.environ,
    }
    
    # Set up flags / args
    parser = argparse.ArgumentParser(
        prog="dump.py", description="IGDB Dump Script"
    )
    parser.add_argument(
        "api_route",
        help="The API route to scrape, eg: games or game_time_to_beats",
    )
    args = parser.parse_args()
    
    # Create out dir
    pathlib.Path.mkdir(OUT_DIR, parents=False, exist_ok=True)
    
    # Set up logging to the route's file
    tqdmHandler = logging.StreamHandler(tqdm)
    tqdmHandler.terminator = ""
    logging.basicConfig(
        level=logging.INFO,
        format="%(message)s",
        handlers=[
            logging.FileHandler(f"{OUT_DIR}/{args.api_route}.log"),
            tqdmHandler
        ],
    )
    
    # Check for existing json to prevent overwriting existing dumps
    outFile = f"{OUT_DIR}/{args.api_route}.json"
    if pathlib.Path(outFile).exists():
        print(f"Existing json found {outFile}, please move or remove it before proceeding")
        exit(1)
    
    if config['CLIENT_ID'] and config['ACCESS_TOKEN']:
        logging.info("Using CLIENT_ID and existing ACCESS_TOKEN")
    elif config['CLIENT_ID'] and config['CLIENT_SECRET'] and not config['ACCESS_TOKEN']:
        logging.info("Fetching new access token...")
        response = requests.post(
            url="https://id.twitch.tv/oauth2/token",
            params={
                "client_id": config['CLIENT_ID'],
                "client_secret": config['CLIENT_SECRET'],
                "grant_type": "client_credentials"
            },
            timeout=30
        )
        config['ACCESS_TOKEN'] = response.json()['access_token']
    else:
        logging.info("Missing CLIENT_ID and CLIENT_SECRET or ACCESS_TOKEN")
        exit(1)
    
    # Re-check access token in case fetch failed
    if config['CLIENT_ID'] and config['ACCESS_TOKEN']:
        items = []
        offset = 0
        logging.info(f"Fetching batches of {API_PAGE_SIZE} on endpoint {args.api_route}")
        with tqdm() as pbar:
            while True:
                response = requests.post(
                    url=f"https://api.igdb.com/v4/%7Bargs.api_route%7D",
                    headers={
                        "Client-ID": config['CLIENT_ID'],
                        "Authorization": f"Bearer {config['ACCESS_TOKEN']}"
                    },
                    data=f"fields *; limit {API_PAGE_SIZE}; offset {offset};",
                    timeout=30
                )
                newItems = response.json()
                fetchCount = len(newItems)
                pbar.update(fetchCount)
                if fetchCount != API_PAGE_SIZE:
                    logging.info(f"WARN: Requested {API_PAGE_SIZE}, got {fetchCount}")
                offset += API_PAGE_SIZE
                items.extend(newItems)
                if fetchCount < API_PAGE_SIZE:
                    logging.info("Received partial page, ending")
                    break
                time.sleep(1)
    
        logging.info(f"Total fetched: {len(items)}")
        with open(outFile, "w", encoding="utf-8") as file:
            logging.info("Writing to json...")
            json.dump(items, file, ensure_ascii=False, indent=2)
    
        # Print some stats
        logging.info(f"\nChecking json output: {args.api_route}.json")
    
        entries = []
        with open(outFile, "r", encoding="utf-8") as file:
            entries = json.load(file)
    
        logging.info(f"{len(entries)} entries in json")
    
        entryDict = {}
        for entry in entries:
            entryDict.update({entry['id']: entry})
    
        logging.info(f"{len(entryDict)} unique IDs in json")
    else:
        logging.error("Client ID or Access Token not available")
        exit(1)
    
    

  • What defaults are you talking about? If you meant to reply to my other comment, I’m talking about hardware transcoding codec support settings on the server, it has nothing to do with what codec is chosen for a client - that decision is made separately. Once the codec the client needs is chosen, the hardware transcoding setting only changes whether they codec is decoded using CPU or GPU/quicksync by the server - it has no effect on codec selection. The only reason you would disable hardware transcoding for a codec that your server is capable of hardware transcoding is if your hardware is faulty or produces undesirable output for that codec when using hardware transcoding - most people don’t do this, it’s a fairly uncommon edge case. And disabling it won’t stop clients from accessing that codec, it just means that your server will CPU transcode it if requested instead of using hardware acceleration - so again it has nothing to do with client support or TVs because all it does is switch your server between hardware and software encoding / decoding. The only sane default for that setting is to hardware accelerate codecs that your PC is capable of hardware accelerating if hardware acceleration is enabled. There’s no reason not to automatically detect hardware capabilities like Plex does, instead of the current “default” where you enable hardware transcoding and then have to figure out what your hardware supports to be hardware accelerated.

    Like even if they copy pasted the quicksync codec support table from Wikipedia into the server hardware acceleration settings that would be miles better because then you wouldn’t have to look up that information separately. Or, hear me out, just show next to each option which ones your computer is capable of hardware decoding vs CPU decoding.







  • BakedCatboy@lemmy.mltolinuxmemes@lemmy.world*Permanently Deleted*
    link
    fedilink
    English
    arrow-up
    94
    arrow-down
    1
    ·
    24 days ago

    As a web dev I hate the trend of websites relying on chromium-specific quirks, there are a handful of sites I need to use which refuse to work in any non-chromium browser, and customer support will always tell you to just use chrome as if you’re not a normal person for using Firefox. So yeah what’s wrong with chromium to me is that it’s the new internet explorer when it comes to web standards. Websites and large businesses can afford to just not care if they are following web standards as long as it works in chrome, and if you have a problem it’s your fault for not using chrome.