Notices by Diego Elio Pettenò (flameeyes@mastodon.social), page 2

> Read this: Docker currently does not expose the IPv6 ports properly, as it does not interface with ip6tables. Read FAQ section and be very careful. We do NOT recommend that you enable this!

Ah yeah, there's nothing stopping IPv6 adoption at all. Everything and everybody is ready and it's just naysayers all around.

_sigh_

In today's "WordPress/Jetpack/Automattic are the ones killing blogging, not Google": Jetpack Stats is now going to be a paid feature for "Commercial Sites"

https://jetpack.com/blog/changes-to-jetpack-stats-for-commercial-sites/

Sounds fair! Makes sense! What's a commercial site?

«includes selling a product or service or showing ads or affiliate links»

Yes, the handful of affiliate links that have been on my blog over the past 19 years disqualify me from the "personal" site according to them.

Fine, I can afford it, but…

… then you look at the fine print: https://jetpack.com/support/jetpack-stats/free-or-paid/

«We define a commercial site as one that you aim to make money from. This could be through advertising or affiliate links, selling products or services, soliciting donations or sponsorships [...]»

So if you are a Free Software developer that is inviting donations or sponsorship for your work, you're also a commercial site according to them.

#WordPress

I'll keep repeating myself: it's the like of #WordPress and #Automattic that are taking every chance to make it harder to keep your own blog. Not the lack of Google Reader which – and let's be honest there – had been a horrible solution for the last year of its existence.

https://flameeyes.blog/2021/10/05/reader-is-dead-but-what-about-writers/

@dalias requirement? No. Helps to understand what people do or don't like? Yes. I already explained this https://flameeyes.blog/2022/03/01/giving-google-analytics-another-try/

Plus, this is also how I get a heads up if certain sites (and @marcan would know which) get a wind of my blog.

Just because *you* don't care, doesn't mean the rest of the world needs to look the other way.

Does anyone have a reference for some kind of unified visual language when talking about identities and permissions?

@horse @ASCIInaut I agree on making it easier (website should stop insisting I use *their* app, especially for TOTP! I'll take a push notification, maybe), but I'd rather make it less bullshit too -- send me an email with the code, you already have my email, don't ask me for a phone number.

@horse @ASCIInaut to be clear, I also have a ton of "low stake" 2FAs in my password manager because too many services are unreasonable re: 2FA and it's easier to go with the flow.

I just wish it wasn't needed.

@horse @ASCIInaut (unreasonably deadpan here) ah but social media is what we make of it ourselves!

What if we actually used it to spread the nuance that comes with concept like threat model, and discuss how to explain reasonable people when sites insist on terrible practices due to bandwagons rather than thought out security considerations?

@horse @ASCIInaut that's literally the one case I explicitly call "Security Fiction" in this context.

Read the post before passing judgement, next time?

@horse @ASCIInaut please read the post, I do indeed talk about thread models.

For those people there's no need for 2FA at all at that point, the password manager is already a suitable defence.

@grumpygamer email 2FA should work better than SMS, but password manager TOTP would just make it "security fiction" for what it's worth.

https://flameeyes.blog/2021/11/30/2fa-totp-keys-and-password-managers/