swiley @swiley@social.cleverlibre.org
- mastodon+swiley@swiley.net
swiley.net
Email mastodon+swiley@swiley.net (this makes all of my computers beep and turn on an indicator light and is always the fastest way to reach me.) I was on octodon a while ago but abandoned my account. I've never been a member of gab or parlor.
If you’d like to learn to program I would consider the SICP [1] more or less the peak of American CS pedagogy (at least as far as beginners go) along with “The Practice of Programming” once you get through that.
I play ukulele, I’m ok at reading music and decent at improv. I learned from Walter Piston’s “Harmony” and some of Adam Neely’s videos.
My main phone is a pine phone so if I don’t pick up when you call the battery is probably dead, the modem is probably dead, or I’m currently swearing at calls/pulseaudio/alsa. I’d strongly recommend sending an email instead.
Dispite what my web page says I’ve stopped uploading my scratch projects to GitHub once I started to understand the basics of collaboration with git. I was using the flamegraph as gamification/motivation but it doesn’t work as well with feature branch/squash merge workflows so I just keep most things on my VPS until I’m happy with publishing updates.
[1] https://mitpress.mit.edu/sites/default/files/sicp/full-text/book/book.html
Joined Jan 2021
swiley
boosted
🇳🇱
@marathon Ah, thanks! I was starting to get concerned.
@marathon No, I've never heard of them but they sound interesting.
@graymond I haven't looked too closely at either although it looks possible to use xmpp in a secure way between two people (the UX might not be nice though.) I've heard good things about matrix but really haven't used it at all.
@marathon People in those situations really can't afford to play games and should be using gpg or S/MIME.
If your favorite messaging service has its own smartphone app then chances are you really shouldn't use it.
@marathon Or maybe it's not self signed, I thought it was. That and someone forgetting to update the signature on the site are the only ways that could not be bad that I can think of.
@marathon Hmm yikes, so the hash on the site is definitely wrong. If they didn't publish the keys anywhere and the keys in the cert don't match any of the older releases that have been publicly verified that's definitely pretty bad.
swiley
boosted
Consent Matters: When Tech Takes Remote Control Without Your Permission
"The irony is that, decades ago, when your average person had minimal experience with computers, those inexperienced users had much more control and autonomy over them."
https://puri.sm/posts/consent-matters-when-tech-takes-remote-control-without-your-permission/
swiley
boosted
I have recently uncovered a user who seems to be opening temporary accounts at QOTO, blocking all the moderators so we dont see their posts and then posting high offensive material (nazi imagery, transphobic and hateful derogatory content, etc) and then proceeding to announce to block list moderators and possibly on the #Fediblock list in general in an attempt to get us banned.
The issue of users being able to block moderators and do **exactly** this is something I have brought up to @Gargron before probably over a year ago but he has never acted on fixing this issue and does not see it as needing fixing from what I could gather (he can interject here if he would like).
It is something we as moderators are powerless to detect or act against unless someone actually reports the content first, that is the only way we will even see it. Thankfully none of the block lists have actually acted on this and no damage to QOTO has been done. But seeing as this may continue I want to make others aware of the problem, press gargron to fix the issue once more, and also encourage **anyone** who sees such content on QOTO to please report it so we can act on it.
I can not personally confirm this but according to the block-list operator they seem to have reason to think it is @snow behind the attacks. This would be in line with the behaviors from snow I have witnessed in the past.
For the attempt by snow to spam and falsely accuse instances see here:
https://likeable.space/notice/A21ux0IbhoDJIkNxzc
For more information see these attempted block requests on QOTO that were made in this fashion:
https://schlomp.space/FediBlock/data/pulls/255/files
@icedquinn I just used the guix package heh, it's pretty buggy but it was the only voip client on Linux I was able to install that ended up working.
Welp, the only popular chat app that I knew of that did E2EE and had reproducible builds is apparently open to censorship.
S/MIME and GPG over email is the only other popular messaging system that works on your iphone and doesn't have this problem (unless XEP-0384 is widely supported)
@icedquinn I guess public channels in telegram aren't E2E? That's not intuitive.
I'm not sure it really matters though. You'll only have security with one on one chats and you can already do that with S/MIME GPG which are really the only way to do secure messaging anyway.
@marathon Absolutely not no. That is definitely not how this works. That wouldn't verify the signature anyway, just verify that the download wasn't corrupted.
The hash on the site is the hash of the *signature* of the apk contents (sans the signature/manifest files.)
You can read this as a good starting point: https://github.com/patrickfav/uber-apk-signer/blob/6f0e7b54c1fb3ce85c6f3b1442ca6382f08ec91d/src/main/java/at/favre/tools/apksigner/signing/AndroidApkSignerVerify.java#L23
@marathon TL;DR you need to just download the tool and run it against the apk.
@marathon Ok, it's not the PEM or DER cert in the meta folder, it's the hash of any (DER encoded? I don't know the default for java's certificate encoder) certificate in the iterator returned by ApkVerifier in https://android.googlesource.com/platform/tools/apksig Which I would expect to be the same as that file but apparently isn't.
@marathon Probably an X509 or PEM certificate signing the root hash of the merkle tree (which is either the MF or the SF file) that you generate according to an algorithm.
It's probably a lot of work to build it up from standard tools (including openssl) but tit looks like uber has a re implementation on their github you can use.
@marathon the .SF file looks like a Merkle tree of all the files in the apk. The root hash is what's signed.
@marathon If you're on an android there's supposedly a termux package that includes apksigner. I don't own one or have an android vm.
- mastodon+swiley@swiley.net
swiley.net
Email mastodon+swiley@swiley.net (this makes all of my computers beep and turn on an indicator light and is always the fastest way to reach me.) I was on octodon a while ago but abandoned my account. I've never been a member of gab or parlor.
If you’d like to learn to program I would consider the SICP [1] more or less the peak of American CS pedagogy (at least as far as beginners go) along with “The Practice of Programming” once you get through that.
I play ukulele, I’m ok at reading music and decent at improv. I learned from Walter Piston’s “Harmony” and some of Adam Neely’s videos.
My main phone is a pine phone so if I don’t pick up when you call the battery is probably dead, the modem is probably dead, or I’m currently swearing at calls/pulseaudio/alsa. I’d strongly recommend sending an email instead.
Dispite what my web page says I’ve stopped uploading my scratch projects to GitHub once I started to understand the basics of collaboration with git. I was using the flamegraph as gamification/motivation but it doesn’t work as well with feature branch/squash merge workflows so I just keep most things on my VPS until I’m happy with publishing updates.
[1] https://mitpress.mit.edu/sites/default/files/sicp/full-text/book/book.html
Joined Jan 2021
