I’m very interested to hear what went wrong.

We’ll probably never know. Given the impact of this fuck up, the most that crowdstrike will probably publish is a lawyer-corpo-talk how they did an oopsie doopsie, how complicated, unforseen, and absolutely unavoidable this issue has been, and how they are absolutely not responsible for it, but because they are such a great company and such good guys, they will implement measures that this absolutely, never ever again will happen.

If they admit any smallest wrongdoing whatsoever they will be piledrived by more lawyers than even they’d be able to handle. That’s a lot of CEO yachts in compensations if they will be held responsible.

It’s not surprising per se, but it’s something that people should be more aware of. And a lot of this consumption is not providing global services (like the Google search or workspace suite) but the whole AI hype.

I didn’t find numbers for Google or Microsoft specifically, but training ChatGPT 4 consumed 50 GWh on its own. The daily estimates for queries are estimated between 1-5 GWh.

Given that the extrapolation is an overestimate and calculating the actual consumption is pretty much impossible, it’s still probably a lot of energy wasted for a product that people do not want (e.g. Google AI “search”, Bing and Copilot being stuffed into everything).

Chrome cookies are encrypted, for exactly the reasons stated. If malware gains access to your system and compromises it in a way that DPAPI calls can be replicated in the way Chrome does it, then your sessions will also be compromised. But this is way harder to do, and at least prevents trivial data exfiltration.

Please don’t take personal offense, but you have merely a project scaffold with an unrealistic goal that will be blocked and C&D’d into the ground, without any other projects created.

It doesn’t matter how hard you’re working on your anonymity, this project will be ripped apart by a horde of lawyers in seconds. You’re not only doing something questionable or against ToS, you’re directly attacking and sabotaging their monetization. This will not be taken lightly by the legal team of reddit.

You want to provide a better, cooler, more robust and other random buzzwords API than the own of reddit. So, you alone, want to provide a better API than the whole team of reddit does for their absolute core product, all by scraping. This is simply not realistic.

While we’re at the topic of monetization, scraping, ETL into your own model and providing the API - for the amount of content that reddit has (quantity, not quality) this will be a highly resource intensive task. How do you plan to fund that, since your API will be better than the official one, I can expect at least the same performance as well, right?

And also, most importantly, even if you magically achieve working around all that and get that working - why? Who is your expected user group? Pretty much every software using reddit moved away from reddit or simply has died. AI gen content is rampant, and most discussions seem like bots talking to bots. There is literally nothing to gain from an API to reddit - so why would anyone bother using it?

The third option is to use the native secret vault. MacOS has its Keychain, Windows has DPAPI, Linux has has non-standardized options available depending on your distro and setup.

Full disk encryption does not help you against data exfil, it only helps if an attacker gains physical access to your drive without your decryption key (e.g. stolen device or attempt to access it without your presence).

Even assuming that your device is compromised by an attacker, using safer storage mechanisms at least gives you time to react to the attack.

Yes, in your head, and in your second factor, if possible, keeping derived secrets always encrypted at rest, decrypting at the latest possible moment and not storing (decrypted) secrets in-memory for longer than absolutely necessary at use.

Been a few days since using electron, but AFAIK electron can’t be used as a wrapper for android apps, or can it? Or is their android app a web app wrapped into a “native” android app too?

Also, since this seems to be an issue since 2018, 6 years should be plenty to rewrite using a native secure storage…

Kinda expected the SSH key argument. The difference is the average user group.

The average dude with a SSH key that’s used for more than their RPi knows a bit about security, encryption and opsec. They would have a passphrase and/or hardening mechanisms for their system and network in place. They know their risks and potential attack vectors.

The average dude who downloads a desktop app for a messenger that advertises to be secure and E2EE encrypted probably won’t assume that any process might just wire tap their whole “encrypted” communications.

Let’s not forget that the threat model has changed by a lot in the last years, and a lot of effort went into providing additional security measures and best practices. Using a secure credential store, additional encryption and not storing plaintext secrets are a few simple ones of those. And sure, on Linux the SSH key is still a plaintext file. But it’s a deliberate decision of you to keep it as plaintext. You can at least encrypt with a passphrase. You can use the actual working file permission model of Linux and SSH will refuse to use your key with loose permissions. You would do the same on Windows and Mac and use a credential store and an agent to securely store and use your keys.

Just because your SSH key is a plaintext file and the presumption of a secure home dir, you still wouldn’t do a ~/passwords.txt.

How in the fuck are people actually defending signal for this, and with stupid arguments such as windows is compromised out of the box?

You. Don’t. Store. Secrets. In. Plaintext.

There is no circumstance where an app should store its secrets in plaintext, and there is no secret which should be stored in plaintext. Especially since this is not some random dudes random project, but a messenger claiming to be secure.

Edit: “If you got malware then this is a problem anyway and not only for signal” - no, because if secure means to store secrets are used, than they are encrypted or not easily accessible to the malware, and require way more resources to obtain. In this case, someone would only need to start a process on your machine. No further exploits, no malicious signatures, no privilege escalations.

“you need device access to exploit this” - There is no exploiting, just reading a file.

Die Logik jegliche Diskussionsgrundlage zu nehmen, indem man seine Argumentation voll auf Putins Propaganda, ChatGPT, Botfarmen, und sonstigen nicht nachweisbare Argumente stützt ist dafür besser?

Ich hab auch nicht gesagt das Deutschland dort als nicht mehr Atom-Nation hinsoll. Allerdings ist dann die Frage von Menschen, die erstmal nicht contra Atomstrom sind, doch berechtigt, warum alle EU-Staaten dort aufmarschieren, Zukunftsplanung mit Atomstrom betreiben, während in Deutschland die Strompreise EU-weit am höchsten sind und Firmen in Nebenstaaten abwandern?

Genau das ist der Grund warum sich solche Resonanzkammern von hardliner pro und contra Gruppen bilden.

Genau, das ist auch der böse Putin. Das es erst auch den Atom-Gipfel in Brüssel gab, bei dem Deutschland als einziger EU-Staat nicht dabei war ist auch nur Propaganda.

Or you can just use vscodium.

If you use a dockerized environment, that will only work better on Linux. .NET8 is AFAIK natively supported on Linux, so there shouldn’t be too much of an issue apart from the usual clunkyness. Visual Studio will probably be more of a problem. The “easiest” way would probably be to switch to jet brains or vscode. If you are hardstuck on VS for whatever reasons, you probably should be able to do some voodoo with running it in docker and using the container as a remote desktop, but this will be PITA to setup and maintain.

The color scheme and the bug keycap have been the single reason to buy it, ngl

Yeah, Gateron Silent Reds are basically “off brand” Cherry MX reds, with same specs. I’ve read that they are supposed to be a bit smoother, and definitely can confirm that, they definitely feel very smooth without any additional lubing

Meta has React, RocksDB and pytorch, and a few other “niche” frameworks and tools. “Half of the internet […] run[ning] on open source code and infrastructure that Meta built and maintains” is a big, big exaggeration. Also maintainance is done by the OSS community for big parts, and I’m really curious what open source infrastructure Meta is running.

I’m not saying Meta has no relevance in OSS, but I can hardly think of an open source org that does open source purely for its own benefit. React helps them shape the web in the way Meta wants it, their ML stuff is important for their own internal needs (ads, BI, and the whole social networking, etc.), their AR/VR/XR contributions are for the Quest, and KI/LLM since they need it themselves instead of relying/partnering with OpenAI. Meta (the company) absolutely does not stand by the principles of open source, no matter how much you want to sugarcoat it.

It’s not a hate train, it’s being cautious. And do you really think that Meta is open sourcing because of their passion for FOSS and standing by those values? They’ve taken an internal framework they’ve build, open source it so that they can advertise how open and great they are on the page you linked, and after it gains traction (which it will, since it’s used by Meta it must be good /s) they can reduce their own internal efforts to a minimum, since the community will contribute. Open source may be a passion for the developers of Meta, but the company Meta does not give a single flying fuck about FOSS or the Fediverse.

You’re right, containers are not VMs, and I’ve never claimed that. For the matter of basic unix access control for a beginner they are similar enough to treat them as such. It’s enough of a baseline for basic security for a beginners workload imo. For advanced use cases - absolutely do not treat containers as you would VMs.

Imagine your containers as very lightweight mini-VMs. Would you run everything as root in your virtual machines? Containers aren’t really that different to classical VMs from an operations point of view. You have a different attack surface, but it is still there, and running as a non-root user inside the container reduces this attack surface, and should IMHO be the default. Privileged containers and users may be required for specific purposes, but should not be the norm, if possible.

Yeah, that's literally the same as 12ft or any other anti paywall tool. I mean hey, it's just two lines, that's even 8 less than the original smoothbrain, absolutely easy to use for any end user. Thanks. /s