Notices by Owen (owen@mastodon.transneptune.net)

Do you want to put a web page on a .local address to do something cool for your household or club? Here's the list of browser features that browser vendors have decided you're just not fuckin' allowed to use. https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Secure_Contexts/features_restricted_to_secure_contexts

Some random site halfway around the world, served over https with a robo-verified certificate, is allowed, though, so take some comfort in that.

There's a discussion thread about allowing RFC 1918 addresses and their ip6 equivalents to participate in secure contexts at https://github.com/w3c/webappsec-secure-contexts/issues/60 . It is _eight years_ old without resolution.

I can't find any discussion at all on allowing the user to designate certain origins as secure contexts. Maybe that's a thing for some browsers.

The recommendation in that thread is to run a private CA for your LAN. Anyone who has experience doing that outside of a managed (i.e., corporate) network will tell you how hilariously useless that advice is.

@gnomon I'm straight-up assuming - as I have no information one way or the other - that that blob dump was the other half of the prompting API spec Google is trying to ram through: https://github.com/mozilla/standards-positions/issues/1213#issuecomment-4347988313

RE: https://infosec.exchange/@0xabad1dea/115526505927801265

an actionable takeaway from this for me and mine is that if we see someone performing elaborate opsec rituals, it's worth understanding that they almost certainly _feel unsafe_, and furthermore that they likely also feel disconnected from most communities that could provide safety.

being there, letting someone who is scared be part of your community, and providing tangible safety when they need it, are the kinds of support that are most worth cultivating.

My day job uses Flash Slothmore as a filler image for a service most of us interact with at least once a day, and I don't think the people who put it there realize what a self-own that is.

Like, the whole joke is that Flash is _unnecessarily_ obstructive and difficult to work with, despite technically doing his job well. He's the best option there is, and it still sucks to deal with him.

@cwebber you could probably make a religion out of this

Something caused Youtube to lose track of my phone's viewing history recently - probably my point-blank refusal to log in when using the site - and the result has been interesting. Youtube now oscillates between a bare search page, or a page with some of the most feral radicalization content you can imagine, depending on what seems to be pure chance.

It's doing a great job of breaking my watch-a-youtube-video-at-bedtime habit, I tell you what.

If you have any loved ones who use Youtube as a way to follow current affairs, it is your moral prerogative to go through their recommendations periodically and "do not recommend this video" things that are too heavily radicalized.

A JS minifier that, instead of reducing byte count, replaces identifiers with terms like "PipeBomb" and "meth_price" and so on, so that your code is likely to be filtered out from statistical models' outputs.

A lot of particularly capital-brained projects for labour replacement rest implicitly on the assumption that _there will be jobs_ - somewhere else - for everyone displaced by whatever labour-reducing invention they're championing this week.

I really don't think that Khosrowshahi, for example, has any reason to _care_ whether Uber's investments into automating long-haul trucking will displace truck drivers, because surely they can find other work.

This has never been fully true, but it's diminishingly true as more and more business categories come to be dominated by staunch labour elimination.

But it'll take time - and probably violence, unfortunately - before the stakeholders in this labour-elimination project come to understand that they are threatening peoples' lives, and that the people they are threatening are not, in fact, going to take that calmly.

@mcc How would you characterize the two types?

@mcc I disagree only in detail; I agree in the large.

All software is the realization of someone else's mental model. Since it's never your own (even if you wrote it, it was you last week or last month or last year), operating under that model requires learning it. However, software should embrace and facilitate that learning, rather than treating it like a chore to be avoided.

@aphyr I am legitimately not sure where I am more annoyed by "here is our helm chart, good luck" or "here is a single static binary for you to run (assuming your system uses the same libc as ours) (assuming you trust blobs)" (looking at you here hashicorp).

@dalias Given the existence of services like nss and pam, I'm not sure statically linking libc is universally a good idea either. Discovering that one program disagrees with the rest of my system about how user IDs map to user names, or about how hostnames map to addresses, is intensely frustrating.

The classic changelog serves, among other purposes, to persuade users of the importance of installing an update. The vestigial changelog - "Bug fixes and feature improvements" - is a frank admission that we no longer feel like there's any point in doing the suasion when users don't get to say no in the first place.

I dunno, but I have a feeling that the normalization of automatic updates has relieved developers and their clients of having to consider a user's needs to a large degree. Software change is now something you do to your users, not something you persuade your users to accept.

And you may tell yourself, "This is not my rough beast."
And you may tell yourself, "This is not my hour, come at last."