@adrake@sfba.social avatar

adrake

@adrake@sfba.social

Working in tech as a software engineer. Baker, gardener, and more in my free time. He/him.

This profile is from a federated server and may be incomplete. Browse more on the original instance.

drahardja, to windows
@drahardja@sfba.social avatar

So it seems that what does is take screenshots, sorts windows by application, then runs each window through an image-to-text model and logs its contents, capturing text, web domain information, and the topic of the content. This information is then logged in a searchable local database.

This has to be combined with some way to get back to the content, right? So if I searched for a topic in the future, Windows has to be able to restore the app and the document that you were viewing. So there has to be some URL or file path associated with each window content.

I know people are freaked out about this feature, but I think it’s basically Spotlight on steroids. I’m actually not that freaked out about it if it’s local-only, and I think this can actually be useful for someone with like me who loses content all the time.

The real questions: what privacy-protection mechanisms are present, who gets to access to this data, how easily it can be exfiltrated?

https://mastodon.social/@detective/112513529733646088

adrake,
@adrake@sfba.social avatar

@drahardja @overstrike file granularity isn't nearly good enough.

If you delete a paragraph from a document, it's deleted from normal search indexes as soon as the index is next updated. Not only would the app need to track which files were on screen for each screenshot, it would need to track which bits of the file contributed to that screenshot. That's a ludicrous amount of work to expect from application developers (and I doubt Microsoft will provide an API with that granularity, anyway).

A system that changes user privacy for the negative and requires every application to do a bunch of complicated work to get back to the status quo is broken. Most apps won't bother (or won't be up to date, etc.), and even a careful user won't be able to tell if the app screwed it up.

adrake,
@adrake@sfba.social avatar

@drahardja @overstrike "most recent log entry for a file" is not something it can do without deep application integration. Windows does not have a magic wand it can wave to determine which file an app is displaying on screen at any given instant. At best, it can know what files the app opened at some point in the past, but it can't know how if or how long the app kept the logical contents in memory.

I'm not really concerned with how well this feature functions from the perspective of a user trying to retrieve something. I'm much more concerned with the fact that users will think they've erased something (or never saved it in the first place), but in reality the OS will have silently kept a copy of it, which sticks around for an extensive period of time.

That data is stored as an ordinary system file. It is accessible to malware, other admins on the same computer, and unless you pay for Windows Pro and turn on BitLocker, anyone with physical access to the device.

sysop408, to sysadmin
@sysop408@sfba.social avatar

DNS gurus, am I correct in believing that PTR records are primarily used for mail sending servers and servers that never send mail do not need one?

adrake,
@adrake@sfba.social avatar

@sysop408 it should be fine, yeah.

They are used somewhat more broadly as a reputational signal -- a PTR record and a A/AAAA that mutually agree imply that the domain and IP are probably controlled by the same entity. That's mostly useful for email, where the domain is critical.

If the PTR exists but the value doesn't point back to the same IP, that suggests the IP owner is trying to pretend to be associated with some domain (i.e. to trick a sysadmin looking at logs), which is a pretty negative signal for any type of traffic, and I've seen web application firewalls complain about it.

Not having a PTR at all should be pretty neutral outside of email.

adrake,
@adrake@sfba.social avatar

@flyingsaceur @sysop408 do those blocking reverse lookups hang on NXDOMAIN? Or only if they don't get a response at all?

divya, to random
@divya@sfba.social avatar

deleted_by_author

    •
    adrake,
    @adrake@sfba.social avatar

    @divya transmit the sound through what medium, exactly?

    adrake,
    @adrake@sfba.social avatar

    @divya Sound requires a medium like air or water to propagate through. "In space, nobody can hear you scream" is literally true -- outside of an atmosphere (or ocean, etc.) sound just isn't a thing.

    "Within Voyager" is electronics and vacuum. No air for sound to propagate. You could technically use the spacecraft's structure as the acoustic medium, but that means you're subjecting the electronics to excessive vibration, which is a great way to cause premature failures.

    There's zero chance Voyager would survive entry into some alien world's atmosphere on its own, so the only hope of the message being received is if it's picked up while still in space. With that level of sophistication one has to imagine they would already be aware it's some alien artifact, without it needing to vibrate to tell them!

    shoq, to random
    @shoq@mastodon.social avatar

    I’m stumped. If any of you code ninjas can figure this out for me, I will happily send you a McDonald’s gift card for a meal of your choosing. Using Google App script, a bunch of text extractor solutions (cheerio, regex, HtmlService, etc.) and my limited skills, nothing works.

    The link: https://chat.openai.com/share/27d19c8e-4758-417d-9bab-a3d22d12366a

    adrake,
    @adrake@sfba.social avatar

    @shoq there's a script tag (id=NEXT_DATA) which is just a JSON blob with the conversation data in a fairly readable format.

    I can throw together a tiny python script to extract it once I'm back at my desk if that would be helpful

    divya, to random
    @divya@sfba.social avatar

    deleted_by_author

    •
    adrake,
    @adrake@sfba.social avatar

    @divya that's basically how I lost 60 lbs. Committed to tracking all the food I ate in the Fitbit app, which was such a terrible user experience that I found myself skipping snacks to avoid having to interact with it.

    The weight fell off.

    drahardja, to javascript
    @drahardja@sfba.social avatar

    Hey coders, how do you call a function prototype’s constructor function from within another constructor function?

    Example:

    function Parent(a) { this.parentValue = a; }
    function Child(a, b) {
    // Call Parent(a), how? <—
    this.childValue = b;
    }
    Object.setPrototypeOf(Child.prototype, Parent.prototype);

    I know, I know, use class. But I’m curious how the syntax looks using prototypes.

    adrake,
    @adrake@sfba.social avatar

    @drahardja as others replied, Parent.call(this, ...) is how you do that pre ES classes.

    It's not exactly equivalent to what classes do, though, and there's no simple way to get behavior identical to classes without them. (Classes are not just syntactic sugar.)

    thor, to random
    @thor@berserker.town avatar

    IDC connectors are fairly space hungry compared to bare pin headers. When I choose footprints, I keep treating the two as the same, because they are in terms of the pin pitch. But in terms of PCB surface space, two different beasts. I replaced a pin header on the right with an IDC connector.

    adrake,
    @adrake@sfba.social avatar

    @thor why not go for 0.05" IDC? Half the pitch and exactly as easy to solder as pin headers IME. (That's what the standard Cortex debug connector uses.)

    I sometimes skip the shroud to save even more space, since I can usually spare a pin for a key.

    I've spent way too much time cursing my past self for designing a board that required carefully hooking up 20 individual wires when I could have used real connectors 😛

    divya, to random
    @divya@sfba.social avatar

    deleted_by_author

    •
    adrake,
    @adrake@sfba.social avatar

    @divya ahead, except for the part where (as of 2022) they emit ~10% more CO2 per capita than the US , and their energy mix emits ~35% more CO2 per watt-hour because it is nearly 50% coal (vs 10% in the US).

    sysop408, to random
    @sysop408@sfba.social avatar

    Has anyone ever lost an SSD drive under normal usage conditions due to device fatigue?

    Earlier this year, I suffered my first ever SSD drive failure. It was an older SanDisk Extreme SSD and for most of its life, it was used for archival purposes so I doubt write fatigue could even be considered as a factor.

    The SSDs I worry about the most would be the ones in my servers because they get used so heavily and I don't have physical access to them.

    They definitely seem way more resilient than hard drives. Knock on wood, but I have yet to have a server SSD even need replacement due to disk errors.

    When I had hard drives on my servers, I don't think I've gone more than 3 years before at least one of the drives would need to be replaced.

    adrake,
    @adrake@sfba.social avatar

    @sysop408 these days most SSDs have a rated write volume, and the ones I'm aware of stop working (going read-only) when that limit is exceeded to avoid silent data loss. That limit is normally so high that the only way you'd hit it within a decade is with something like server use.

    Any failures before that limit is exceeded are sort of definitionally not wear-related? So I imagine the candidates you're looking for are drives from before that built-in lifetime metering.

    stevenray, to random
    @stevenray@sfba.social avatar

    The worst thing about waiting in line at Walgreens: the infernal music. Good God, it’s awful.

    adrake,
    @adrake@sfba.social avatar

    @stevenray it beats their telephone hold music, which is a literally <20 second loop ending with a recording of someone saying how important my call is (which is way louder than the music).

    Listening to that for an hour+ trying to reach the pharmacy really does a number on your sanity.

    baloo, to random
    @baloo@sfba.social avatar

    IEEE hands out copies of 802.1AR for free, but you need to register.
    They will stamp the PDF they give you.

    Are you allowed to copy paste relevant sections in code comment when implementing the spec?

    https://ieeexplore.ieee.org/document/8423794

    adrake,
    @adrake@sfba.social avatar

    @baloo I'm not a lawyer, but I would feel very confident doing so myself as long as the excerpts are only a portion of the spec, and that they only include the parts relevant to the code they're explaining.

    Basically someone shouldn't be able to read your code comments as a substitute for the original spec.

    https://www.copyright.gov/fair-use/index.html has some criteria courts like to use. Implementing a spec seems pretty obviously "transformative" to me.

    adrake,
    @adrake@sfba.social avatar

    @baloo yeah, fair use doctrine is a mess 😞

    If you're actually worried about a legal fight, I don't think claiming ChatGPT wrote it will help you. That caselaw is far from settled, and even if you ultimately win, you're still stuck with the bill from your lawyers (which will certainly be higher than for a straightforward fair use case!)

    If you want to completely avoid the concern, cite section/page numbers and paraphrase the text you would have quoted.

    Frances_Larina, to random
    @Frances_Larina@sfba.social avatar

    "Amazon Rolls Out Passkeys (ie biometrics) as Big Tech Says Goodbye to Passwords"

    I bet consumers will eat it up. Kiss goodbye to that last shred of anonymity once it's ubiquitous.

    Also, tying login authentication to a specific phone is extremely problematic to smaller companies that may not have a dedicated device &/or that device dies as phones tend to do every few years.

    https://gizmodo.com/amazon-rolls-out-passkeys-farewell-to-passwords-1850950207

    adrake,
    @adrake@sfba.social avatar

    @Frances_Larina

    • Passkeys are secured by the device itself, if you don't use biometrics on your device, the passkeys are secured by whatever you use to unlock your device (pin/password). None of those are sent to the site you're logging into.
    • Passkeys can be synced between devices and backed up to the cloud. They aren't tied to the device any more than any other data you might have.
    jonathankoren, to random
    @jonathankoren@sfba.social avatar

    There really should be a non-Docker controlled Docker. Like something with so much less corporate popup bullshit

    adrake,
    @adrake@sfba.social avatar

    @jonathankoren at least in production environments, people have been moving away from Docker proper for several years (well before this started) due to reliability issues. Kubernetes dropped support for it entirely last year. We've been using CRI-O in production since 2019ish.

    On Linux desktop, podman is a drop-in replacement for interactive use (based on the same underlying container libraries as CRI-O).

    Mac and Windows obviously need a VM of some sort to run Linux containers. There's an official tool for Podman to do that, but I've gotten mixed reviews from my Mac-using colleagues.

    I'll also make the observation that if software freedom is a big issue for you, Mac OS is by far the worst choice of platform to be developing on.

    adrake,
    @adrake@sfba.social avatar

    @harish @jonathankoren The https://front.com application backend has been running on Kubernetes since late 2018, which I think qualifies as real work.

    Kubernetes and its ecosystem is incredibly complex, and it's crucial to balance that complexity against the benefits in your specific circumstances. If you have a workload that fits on a few reasonably-sized servers, or your workload is homogeneous, the benefits probably won't outweigh the complexity. Keep it simple!

    When we made the switch, we had enough scale and enough growth to desperately need some more sophisticated automation to handle it. After a careful review of the options, we went with Kubernetes. It was a lot of work to deploy, but it paid itself off pretty quickly in both money and saved time, and has continued to pay dividends.

    CRI-O itself is an implementation detail. Switching to CRI-O from Docker was a short project and completely transparent to developers (besides the reduced node failure rate).

    adrake,
    @adrake@sfba.social avatar

    @harish no problem!

    I guess I should clarify if "and what not" includes containers (Docker/Podman) -- I do still think containers are a valuable tool even at small scale. My personal servers run a stable LTS distro to minimize admin overhead, and I develop against modern dependencies to minimize development overhead, and containers make that strategy work. My management stack for those is just SSH and podman run, though, no need for Kubernetes.

    cabel, to random
    @cabel@panic.com avatar

    Ok, so which of you text encoding experts is going to help me understand why “ ’d “ — presumably with a smart quote? — somehow ended up as 抎

    adrake,
    @adrake@sfba.social avatar

    @cabel my best guess involves a broken UTF-8 implementation on the printer. That presumed smart-quote is 0x92 in Windows-1252, so you have the byte sequence 92 64 for the " 'd " that got replaced. That's an invalid UTF-8 sequence (the first byte doesn't have enough leading 1s) but you could maybe imagine some sort of bug in the implementation that leads to a nonsense codepoint (with whatever was left in some variable) instead of a replacement character. I haven't nailed down a great candidate for a bug, though, the bit patterns don't line up very well.

    nsaphra, to random
    @nsaphra@sigmoid.social avatar

    what are these wasps doing??? There's 3 and one of them is huge (different species?)

    video/mp4

    adrake,
    @adrake@sfba.social avatar

    @nsaphra looks like an American yellowjacket (V. alascensis) queen with two drones (males), presumably mating. https://bugguide.net/node/view/14087 has pictures showing the queen/drone markings.

    We have a lot of yellow-faced bumblebees around us, and certain times of year I'll see the queen out foraging. The dead giveaway is that she's at least twice the size of a normal worker! Absolutely massive bee.

    adrake,
    @adrake@sfba.social avatar

    @nsaphra yellow-faced bumblebees do, yeah. The queens only live for a year, born in the fall, they emerge, mate, find a new nesting site and hibernate through the winter there. Come spring they lay eggs and incubate the first generation of workers, and have to forage until the workers can take over. Then, towards the end of their lives, once the new queen and male eggs are laid, they return to foraging. They don't need to lay any more eggs, so gathering food for the next generation is presumably the most valuable thing for them to do before they die.

    adrake,
    @adrake@sfba.social avatar

    @nsaphra Wow! That is much cooler. Quite a lucky find!

    b0rk, to random
    @b0rk@jvns.ca avatar

    working on writing "implement tcp in a weekend" and it's definitely going to be harder than the DNS guide (https://implement-dns.wizardzines.com/) but I think it's going to be really fun

    (to be determined if the TCP project can actually reasonably be completed in a weekend or not, need to finish it and do some testing)

    adrake,
    @adrake@sfba.social avatar

    @b0rk @joshsusser that sounds like how the average IoT device got its network stack!

    jonty, to random
    @jonty@chaos.social avatar

    It turns out you can simply serve a file from a domain to use it as your bsky handle.

    So this guy is now S3. All of S3.

    adrake,
    @adrake@sfba.social avatar

    @reiver @jonty I think all you have to do to get that to work is make a S3 bucket called "xrpc" and make it publicly readable.

    This kind of thing is one of the reasons other domain ownership verification protocols (e.g. ACME) use the /.well-known path prefix 😛

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • JUstTest
  • GTA5RPClips
  • thenastyranch
  • ngwrru68w68
  • magazineikmin
  • khanakhh
  • rosin
  • mdbf
  • Youngstown
  • slotface
  • everett
  • cubers
  • kavyap
  • DreamBathrooms
  • Leos
  • InstantRegret
  • Durango
  • osvaldo12
  • ethstaker
  • cisconetworking
  • tacticalgear
  • normalnudes
  • anitta
  • modclub
  • tester
  • provamag3
  • megavids
  • lostlight
  • All magazines
    •