Notices by frogzone@wizard.casa

@p @r @rms @silverpill @gabriel @lanodan @sun do pls tag me with eriner, id appreciate that. Id be surprised if there were no group on fedi across this space, it would be good not only to get a handle on issues such as those experienced by Sun (thanks sun), and to build a solid ecosystem of hosts.

as libre s/w becomes more popular than....other s/w, so too will attacks on it. can we afford to assume into the future that if something does get discovered that we can (EDIT: wait) for the upstream fixes to exploits. EDIT the time of eternal vigilance is due.

A few days ago I did some reading at the archlinux wiki and it was interesting to read the different methods that can be used, for different use cases. Scan-on-use etc They talk about pitfalls like heavily inefficient cases. Theres also an invented word, 'milter', and its not an acronym for Mother Id Like To something something lol. i learned something completely unrelated to the topic by reading it too. ahh the joys of reading....and reading the archlinux wiki

https://wiki.archlinux.org/title/ClamAV

EDIT including @sohrab

Book chapter on Taler as sCBDC technology (the 's' meaning synthetic)

ive not read the chapter yet but that seems like a dumb distinction.... why not just sDC (ie. synthetic digital currency). why conflate it with central banks? found the link via gnu's rss feed. dear @gabriel u might be interested.

rms has been suggesting the use of #gnuTaler for a looong time as just a way to help pay for things digitally in a more private way, eg not having to give a credit/debit card, name, address etc. and its a fine use case, iirc #taler is even supported by #btcPayServer lol. i must admit i'm more #fedimint inclined, but for people who just want to interface with a boring (ideally bitcoin-backed) local bank, i dont see any issue with taler, the main hurdle are the trashy "smart"phone themselves not allowing ethical libre firmwares and user freedom.

@silverpill @p @r @gabriel @rms @sun @lanodan

NEW TOPIC: Including some new participants due to reasons that will be obvious to them.

## Clam AV

How important is having an antivirus on linux like clamav for messaging (xmpp/fedi/etc) servers? or is there still an assumption that gnu/linux is safewithout it?

How disturbing is it that Cloudflare, and M$ appear to be the only ways to get the virus signature databases? Even the chinese mirror is cloudflare.

How positive would it be for the digital ecosystem if fediservers were to form volunteer combines where they agree to help build and distribute virus signature db files for each other. and possibly for ppl on their instance? As im sure ppl know im active in /dev/nulling cf, micro$haft, et al

just a thought, dunno.

@theorytoe @p @hn50 @realcaseyrollins ppl called it birdsite, tbh

that is before it became #birdshite

@p @theorytoe @hn50 @realcaseyrollins i asked him the same question a few years ago, P lol. i have no idea why he insists on referring to Xs marked in treasure maps i cannot/willnot read.

I love u RCR but its weird, lol

@p @r @rms @silverpill @gabriel damn! i missed it by that much. thanks for the idea, P.

This site, which is dedicated to an alleged free software community in China, is hosted on servers in Germany. It is being mirrored on i2p (fsfans.i2p), im guessing, without the express knowlegde or permission of the webmaster (William Goodspeed?). One of the more delightful pages is this one https://learn.fsfans.club/

(the learn.* subdomain is not being mirrored on i2p)

Anyway the last post on the site was made in nov last year (2025) and Goodspeed explains with BRILLIANT CLARITY some of the issues facing the free software community, and that they are moving to hosting a fediverse server instead. Interestingly they chose a PieFed instance and according to the post they can only federate with other #PieFed or #Lemmy instances (?). I was super curious so I went to visit their instance only to find that the certificate was only for samsung domains?!

Beyond that point of course I expect that the site is broken, and true to form, fetching pages doesnt work and errors on the page reference an akamai domain (errors.edgesuite.net). For those playing along at home akamai is the last 'A' in the techno-fascists acronym CAGeMAFiA. but to be honest anything beyond the certificate issue is not important, just a curiousity.

can anyone shed light on what happened to this instanve? I was not on fedi at the time, having my 19 month forced-by-circumstance hiatus, lol @p @r @gabriel @rms @silverpill ?? if not i invite u to ingore this post completely.

@silverpill @nimda ideally all but yes in areas where they might not be expected are sort of urgent. Im happy to ttry and dig up the old posts that i made a few years so. if i cant find them i will report back, i wont be able to do this right now tho.

Hi @nimda Why might no posts be appearing for the @i2p@mast(er)don.social account? I follow them now (only so i can find the post where they annouce the changover to their cloudfed website, then i will unfollow). is this instance denied their posts? masterdon.social and masterdon.online and many in the bofficial masterdon family are Fastly now.

i find it interesting that i got not a single interaction/proof-of-visability from an insight i gave to a davidrevoy@masterdon.onilne post the other day.

Fastly are likely sith now, tbh....can probably put them in the same category as CAGeMAFFiA (two 'F's)

@nimda thanks for that and for pointing out how the interface is supposed to look, the 3-dot-menu button doesnt show in my browser. i use tor in safest mode, with the NoScript addon placed back into the toolbar (the way Tor was for years before they changed it) so i can enable javascript on a per-site basis, rather than having an all-or-nothing (aka unweildy/impractical/CPU-draining approach) that Tor Browser devs have forced on users to make it basically unusable for the next generation of privacy seekers).. This means that svg do not show. but

i have recently shared an article on RSS buttons that also has a very intesting, if possibly a bit incomplete (i dont think it mentions unicode) about an SVG fallback system, and i think you might be interested in it. silverpill has seen it recently. btw you might be surprised on who gets a special mention in this article.

http://undrss2l4ynldtgjjahsd2bx5oapy2vw75cowsusu5pncz76sqga.b32.i2p/rss-button-using-div-corners.html

a few yeats ago i went through how a lot of these non-show issues can be fixed with @silverpill there are many unicode character that can be used as fallback where unicode chacters dont work a replacement png MAY, honestly i think for the sake of ease we should just try to only use unicode fallbacks even if they are not perfect replacments.

Broadly, there does need to be a focus on fixing how Safest Mode works, for privacy-seekers, i think that sttarts withhighlighting how default settings in Tor are designed to hurt the user, for whatever reason (my guess is to make Tor a niche, geek-only tool and move people over to the worse, Brave browser, remember Tor devs are paid big money by govt these days and have to do what they are told). For Tor (Safest Mode) to be useful NoScript needs to be in the toolbar. That is how to use Tor fullstop, if we recommend this at almost every opportunity, we can assume more people will have the same issues (broken svg) and have fixes in place for them.

There is no guarantee in the future that i will remember to look for an invisible button because i use tor the way it is most useful with NoScript.

I hope that this post highlights a way forward. It would be nice if ppl stopped assuming that ppl use Tor without the NoScript addon in the toolbar to reenable js. Again most veteran Tor users will do this. It is therefore on us to cater to this group, and if we support the use of Tor is becmes plainly obvoius that we need to GROW this group, because tor browser is among the only ways to safely interface with a Mitra social server, or any website that requires js.

(im using the Mitra interface atm because wizardbloat.i2p has been down for a while.)

EDIT fix missing word "recommend"

@nimda @silverpill in fact i'm going to assume that is the expoit. an end user can mathematically adapt the svg in realtime, moving a slider such that at some point along the slider the text or svg image for that matter reads to a human. if the text is never delivered in a human readable way then it prevents bots from ever learning from the content. in fact id say it would be a very good use of technology to defeat bots, lol. but it also means you will not be able to copy paste it, also.

@nimda @silverpill in conclusion, until svg are considered safe by Tor devs, we need (my recommendation) unicode fallbacks in mitra, for svg. Sad but true.

(I have tried talking to Tor devs on this issue but they for whatever reason (same as above??) do not care to identify why svg could be unsafe. It MAY be a social engineering exploit rather than a computer based exploit ie. malicious websites hiding their words from search and scraping tools by drawing the letters manually with svg???)

After how many years making a browser Tor devs / mozilla havent worked out how to continue a DL???

moseys on over to command line
torsocks wget -c 'https://example.tld/resouce-to-download'
done

@p @icedquinn @fish @vii @phnt @strypey @silverpill Ewww.... wash your phone out with soap, and maybe a solar flare.

@graf @evan @taoeffect @p @nova @tchambers @jaz That's super interesting, they lost interest in spying on your server for whatever reason, but you were still being DOS'd. I've not heard of this happening but Im sure it happens and i just don't often get to hear from someone who has been able to agitate cflare lol, and also i must admit i dont operate outerweb services. I like just knowing that cf has its limits too, lol. Thanks for recounting the story, I was going to ask but hoped someone would chime in to explain how it all unfolded, i didnt kno i was taking to the admin. Sincerely, congrats and appreciation to ALL involved including obviously the donors. Losing the web cancer is sweet news to me. I truely hope all goes well for the service into the future and look forward to seeing how things improve due to your efforts in this area.

@p @evan @taoeffect @nova @tchambers @jaz @graf iftas.org is cloudfed lol

these ppl dont even try very hard to hide that they dont actually care about basic communiction, lolol

@p @evan @taoeffect @nova @tchambers @jaz @graf

oh and by 2024 wandering.shop had moved onto amazon ('scam'azon) servers so I was actively working to help people jump off that trashheap.

you really can't go much wrong by boycotting CAGeMAFiA (clodflare, amazn, goo, elongated muskreant, m$haft, appl, falsebook, if you dot the 'i' with a circle you get oracle, akamai).

@p @evan @taoeffect @nova @tchambers @jaz @graf

btw my notes also said to try to convince ppl to leave social.coop because their CDN for delivering images was cloudfed. They couldnt hide their disingenuous nature from me.... oh and btw i jus checkd, they STILL use cloudfalre!

@p @evan @taoeffect @nova @tchambers @jaz @graf Congrats on revealing all this and thanks!

for some reason sfba.social was familiar and i checked my notes and i had written that they were "anti-crypto" which is a warning sign I have for glowies myself

btw i must congrat poa.st server for dropping cloudGlare.... it should be a given to not be cloudfalre but poa.st was cloudfed for a while and it is nice change to not have to remove poa.st people from my mentions.... i just want to acknowledge and enjoy successes like this. :)

It would surprise me if the person who came up with the terrible pentogram image for fediverse wasn't a glowie. Apparently they are/were a pro-west russian, so i'd be willing to put my money on asset/useful stooge. etc. And then it stands t reason that the accounts that MADE that terrible icon ubiquitous are most likely assets/glowworms also. As i say i think the last chance we have to reclaim the open web is to use the RSS icon for fedi, if your instance supports RSS, of course.

I have often felt that fedi was being deliberately held back and subverted so your work illustrating this fact is not so much a surprise, but its still awful.... the banksters printing the money are happy to pollute spaces like fediverse, I believe that they are quite happy to exist on fediverse themselves and enjoy what it offers them and their corporate partners/collegues, but that they are being paid to keep to mass away, god forbid thayd have to deal with more people etc.etc. as long as they are being paid they really dont care about the commons.... suspicions are confirmed. Thanks again, p.

@p it works if i copy the url into mitra but bloat didnt handle it.

What you wrote about mirroring via fedi was interesting, do fedi instance now keep enitre copies of webpages when u share them? how does one use that to access the mirrored copy?