天空вℓσи∂ [Unemployed edition] @skyblond@social.cleverlibre.org

And... I got the speed wrong last night.

I thought I was using a proxy server hosted on Hetzner, but I was actually using a Japanese server.

With a DE proxy not hosted by Hetzner, I got 240 Mbps download, as same as the Google drive (and I think this is the limit of my downlink). The uplink speed is the same.

Solved the mounting issue with mountain duck.

Solved the folder sync/backup issue with duplicati.

Now I can cancel my Google One subscription and call it a day.

So, how can I know if my Windows/Android/some social media platform is tracking me or not?

I don't know. You don't know. Only they know. Since it's a blind watermark or steganography, by design, no one should notice and know the existence of the hidden info, unless they know the mechanism beforehand. The LSB, 2D Fourier transform, jstep methods are old and known by the public. However, it would be easy to develop their way, maybe from scratch, or based on advanced research and paper.

The best way to defeat is turning your screenshots into only white and black, aka binarize. By doing so, all info in the pic will be significantly decreased, while the text on the picture can still be read. This method doesn't work with pictures. Another way to defeat it is taking a photo of your screen, but it's not 100% time working. People have tools to remove hidden info in the picture, and they released their code on GitHub. However, I want to warn you that they are not 100% working. They can only handle the watermark/steganography they know. Just like virus scanning, they can only find the patterns they have already known. You must develop your own methodology to keep yourself safe, like no login if not required, using proxy/vpn/tor, using a virtual machine, describing what you see instead of sending a screenshot, etc.

Automated tools can't solve everything. That's why we need security researchers and people at EEF to keep watching on all possible threats.

(This is the end of the thread)

I talked about this with my friends. This is not the first time that a blind watermark has been used to track the flow of info. They usually are used in enterprise situations, where you want to know who takes a screenshot of the internal IM app and sent on the internet, and I think this is acceptable.

However, tracking regular users is kind of crossing the line. After 30 minutes of diving into the steganography and blind watermark, I think most apps use the blind watermark when dealing with screenshots.

Steganography like LSB or jstep, or even 2D Fourier transform, is not practice. Thinking about LSB or jstep. I post a photo on qoto. No matter your client, it's a small picture on your device. You take a screenshot of what I said with that pic. With this significant scaling, I think most info is lost. With 2D Fourier transform (add high-frequency info to the pic), it would be hard for an app to do this, since they cannot change how Android or iOS render the button, etc. However, I think a modified ROM or hardware can output something secretly when taking screenshots or photos. A simple solution is to encode the Google/Xiaomi/Huawei account id, or IMEI in the screenshot or the photo, and considering this is not a massive amount of information, it shouldn't cause too much interference to the pic. And since it's system/hardware level, it's hard to notice.

The more common way is the blind watermark, aka, an invisible layer with graphical info, like text, on top of the app. The invisible layer tends to use 0.5% transparency, so it can't be detected by the naked eye. However, if you apply a random color map, aka map each color to a random color, the similar, hard-to-detected color will be mapped to a different color, which is likely to be easily detected.

As far as I (and other people on the internet) know, only the watermark is used to track people in public, based on how many things can the target platform control (mostly App).

Also want to talk about the blind watermark on some Chinese social medias, to track user across different platforms.

It's extremely dangerous when someone post those screenshots with their identity to something like twitter, since twitter is blocked in China, and the police can catch and charge you if they can proof you have the account on those platforms.

The best way to defeat that is turning screenshots into pure white and black, works with text, not work with pics.

... And it's too late, I'm on the bed. I'll keep talking this tomorrow (if I can remember).

Even though the people are active at a late time (1:30 AM here), and with a not-so-beautiful web panel compared to Twitter (I'm a PC guy, while my friends prefer mobile), I still love using mastodon.

Seeing different people from different instances reacting to my post is fantastic! And I was amazed by how fast my post spread across the mastodon network (when you need minutes to sync between P2P nodes).

(And I just noticed, even with Grammarly, my English is still bad, by not taking Grammarly's suggestions, LOL)

(You definitely can understand what I'm trying to say, right? ...Right?)

I'm thinking about switching from google drive to dropbox, due to safety reasons (I don't want any suspicious AI spy on my files). Today I noticed the Hetzner Storage box and mountain duck.

Hetzner storage box offers 1TB network drive for 3.2 EUR per month, and mountain duck offers a way to mount that network drive on Windows, with a 39 USD one-time fee. The software is made in swiss.

Due to the god damn GFW in China, the speed can't go over 100KB/s without proxy. Thankfully, with my proxy server set up on the Hetzner FSN datacenter, the upload speed is faster than 4MB/s, which I think is the limit of my network. The download speed is also not bad: 8MB/s at the beginning, drop to 2MB/s, sometimes stuck at 2Mbps. Not sure who should be blamed for this, since there are too many participants involved: mountain duck, my transparent proxy, my network ISP, the proxy server on Hetzner, Hetzner storage box, I don't know. But with WebDAV, it supports random access, which means I can stream a video and scroll back and forth without waiting for the stupid client software to download the entire file (It's you, Google Drive Client).

The price is also the cheapest. Hetzner's price is equivalent to 38.16 USD per TB per year (BX11, with BX41, you get 24.246 USD per TB per year), while Google Drive (2TB annually) is 49.995 USD per TB per year, and dropbox (2TB annually) is 59.94 USD per TB per year. The proxy server is kind of required no matter which service I use, so that's not a big game changer.

I will try this configuration for a while. If I think it's good enough, that would be a great deal.

Recently I'm actively seeking replacement for telegram, since it's not reliable anymore (taking free user's account without any notification). I have tried matrix. It sounds good, but your experience mainly depends on your home server. I set up 3 accounts on matrix.opensuse.org, matrix.qoto.org and matrix.org. The experience is different. The matrix one is the default one, as expected, I need proxy to connect it, beside that, everything works fine. The qoto one is not that smooth, there are lags and errors during my test (matrix.org server cannot connect to the qoto server, I don't know why). The openSUSE one is pretty good, I use their matrix service for almost a year, and the most important thing is I can directly connect to it without using any proxy in China. So, I delete my other 2 accounts and keep using the opensuse one.

Today, Google play recommended me an app called ThreeMa. A one time paid app which offers a full anonymous communication. It don't need any private info to register (while matrix use email, opensuse server use their own SSO login). And it's also e2ee, just like matrix, it also support file, video call etc. And to my surprise, it's not banned in China, I can send message to the echo account without using any proxy (but might be blocked in the future).

I guess they are my current backup communication app for now.

(Also, Briar did a good job too, it can make communication happens only using Bluetooth, WiFi or internet over tor, but it only works on Android, and doesn't have any advance features, it's a good replacement when internet is down or we lose internet access like North Korea)

魔術師解析「扒手」電影片段，示範偷錢包手錶、偷換牌等戲法！ Magician Reviews Visual Tricks Scenes｜經典電影大解密｜GQ Taiwan

https://www.youtube.com/watch?v=fych2e9pRi0

If I was doing the scammer 3.0, sorry, I mean web 3.0, I would create a series of fungible tokens for each picture the ai generated with the same prompt, and create an NFT for the prompt. Then let people auction the seed using that token. So they can purchase their own seed of the picture, using the token of the picture, to proof their dominance over the seed. And if you own all possible NFTs, then you own the prompt.

That's much better than 10 GBP for 1k standard generation.

via @skyblond

https://qoto.org/@skyblond/108906034471132696

New profile picture.

Generated by stable diffusion. Writing prompt is hard, but the lexica.art is pretty helpful (for me to copy and paste, just like coding).

The battery of my Razer laptop got swollen, again. This battery was only serviced for about 6 months. Of course, it's summer, and I always keep at least 30 chrome tabs and 4 VMs running in the background. The temperature in the case is always higher than 60 C, and most time it's 80 C, and I used the laptop 18 hours a day and 7 days per week. It has to be swollen, LOL.

Anyway, I think it's Razer's design issue. But considering the weight (~2KG) and the performance, I think it offers a desktop PC experience with just a slim laptop (before it gets too hot and throttled). That's the best laptop experience I have ever had. But the trade-off is high temperature and swollen battery, which needs to replace every 6 months.

During the fixing period, I installed an openSUSE Leap on my old HP OMEN laptop, the GTX1080 one (maybe the first gen?). And I have to say, it's not the golden year for Linux desktop users, but it's much better than several years ago, when I need to recompile the kernel just to install some audio/network driver. That's scary, you never know what will happen after the reboot.

Most apps I use can be installed via flatpak. For some Chinese ransomware (they extort my friends and force me to use them since telegram and discord are banned in China and none of my friend use those), KVM offered a great solution. With spice client and workspace, I can switch between Linux and windows by switching workspace. I think a seamless mode for KVM would be much better, but considering VMWare dropped the seamless mode support on Linux, it's not necessary for KVM too.

Also, the input method. As a Chinese user, I need to send messages to my friend on Linux, not in English, but in Chinese. The fcitx4 offers a great input method, despite it still failing under some circumstances in gnome. Tumbleweed offers fcitx5, but I was scared by the rolling update. It upgraded my fcitx4 to fcitx5, killed the fcitx, and removed the iBus. After rebooting, I got no input method to use.

After several days of adjusting the Linux and my habit got adjusted, I think I would still prefer Windows, although it's not a good OS at all. I tried gaming. Stacklands works perfectly on Linux using the proton layer. But some other games, purchased on EPIC, multiplayer online? Good luck with the third-party launcher.

And (Yes, I know this is a long post, I'm so sorry), about X11 and Wayland. I think it still needs some time (maybe several years) to offer the end users a good experience. Wayland sounds better, but with Nvidia's driver, I'd prefer x11.

So (this is the end, I swear), in conclusion, I like the experience I had on Linux in the past several days. I watched YouTube, wrote codes, sent messages with my friends, and listened to music on Spotify. They all went pretty well. OpenSUSE Leap managed to offer a super stable environment as possible they can. With 5.14 kernel, which doesn't have the better NTFS driver and seems like no backports for it. That caused a lot of issues. And with my limited Linux skill and the fear of breaking my only working system, I decided not to use NTFS anymore, instead of trying to fix it.

That's the end of my super long post. Thanks for your reading, and, Have a nice day!!!

Blackout again.

Every time there is a heavy rain, the electricity goes outage.

I can't figure out why. But I'm thinking about deploying a house-level UPS.

The only downside of the Nintendo Switch is that I can't code on it.

I started playing Octopath Traveler last year. And I'm still not finished with chapter 4.

Coding is too fun to stop, LOL.

Sold my old switch to my classmate and bought a new oled one (Japanese edition, of course, nobody would buy the Chinese edition, LOL).

My first oled display in my life. Now I'll watch Linus's TV review videos again, on this device, to appreciate the technology.

The menu already fascinated me. And thanks to the bad internet connection, I'm still downloading my games.

(Also, I upgraded from 256GB MicroSD to 512GB)