• 0 Posts
  • 273 Comments
Joined 1 year ago
cake
Cake day: June 10th, 2023

help-circle
  • I get your point that the exploit existed before it was identified, but an unmitigated exploit that people are aware of is worse than an unmitigated exploit people aren’t aware of. Security through obscurity isn’t security, of course, but exploiting a vulnerability is easier than finding, then exploiting a vulnerability. There is a reason that notifying the company before publicizing an exploit is the standard for security researchers.

    You’re right that it’s never an OK title, because fuck clickbait, but until it’s patched and said patch propagates into the real world, more people being aware of the hole does increase the risk (though it doesn’t sound like it’s actually a huge show stopper, either).







  • No. [I was wrong. In addition to being distributed between servers like I said, you can also enable P2P sharing to distribute the bandwidth even further.]

    If you have a server that allows users to sign up, the stuff they follow/watch (you’d have to look at details if you want to host to see exactly how it’s distributed) goes through your server.

    The flip side to this is that, when your user uploads an extremely popular video (or you personally do if you don’t allow signups), you don’t have to stream every video to every individual user. You send it on to other federated instances that those users are signed up to, but if one instance has 100 users view your video, you don’t have to send it 100 times. (This is likely less efficient than YouTube, because they can control exactly how load is spread between their delivery network with a comprehensive view of everything, but it dramatically lowers the barrier to entry for an individual to get involved or handle the distribution demand of a popular video.)

    Just as a client, you don’t serve anyone else. It’s a website (or app) that works much like YouTube does. It’s on the server side where the load is distributed.





  • If you don’t physically control the hardware, it is not secure.

    The only valid approach to preventing cheating that matters is to have authoritative servers. Nothing else works, nothing else theoretically can work, and nothing else can possibly be described as anything but malware. There is literally no possible scenario where any entertainment company knowing anything about what else is happening on your computer can be justified.


  • Server side anti cheat can’t distinguish good players from aimbots.

    Neither can a rootkit, which should be unconditionally illegal and send CEOs to jail for putting in their product. There are no exceptions and no scenarios where it can possibly be acceptable for a video game to access any operating system anywhere near that level. Every individual case should constitute felony hacking, with no possibility of “user consent” being a defense even if they do actually clearly and explicitly ask for “permission”.






  • Not that other means of accessing the passwords aren’t worth considering, but in the real world, it takes a lot more for someone to actually coerce your password from you than to use unencrypted storage.

    I generally like xkcd, but this is a harmful trivialization of the value of encryption. In the real world, anything that isn’t encrypted is negligent as hell. There’s no valid reason not to do it, with maybe the exception of a thumb drive you’re sharing across a computers you don’t control and are clearly aware is not secure.


  • It’s why I wasn’t automatically blaming the other options. I never looked at the actual data to know if they were there.

    But trying to recreate them was absolutely brutal, and has been with every option I tried. I looked at implementing my own down and dirty tool to make it more manageable in bookwyrm, but there was just too much mental overhead to get a grasp of the code base in my limited dev time. Just making a basic database and a couple scripts to display my favorites on a couple web pages seems a lot easier. Plus I can treat series as first class citizens in lists and pages with their own blurbs, which none of the bigger options seems to think is useful.


  • Bookwyrm imported my goodreads export more or less fine, but (IDK if Amazon gave me them) my lists disappeared in the process, and trying to recreate them was the dealbreaker for me. My absurdly large book lists were casual and not something I needed to keep, but I have a few 50-100 book lists that I do care about and that would have required manually searching each title, and that’s where I drew the line.

    It’s already enough of a hassle to go page by page through the 1000-1500 books I have on goodreads and check boxes. Typing them out is way too much work to migrate.

    Eventually I’ll probably roll my own because I have other functionality requests none of the options meet, but goodreads lists are already not great, so not even matching them is a big step down.