yopp

@paco@infosec.exchange @diazona@techhub.social Sadly, I have bad news about Immich. It’s sponsored by FUTO. And FUTO founder is not that far away from those names https://brennan.day/normalized-fascism-in-open-source-12-million-given-to-dhh/ https://drewdevault.com/blog/Whats-up-with-FUTO/ Learned about that thanks to @brennan

@galaxis@mastodon.infra.de looks like mastodon is not affected because they had vips version and support blocking untrusted media and blocking is enabled https://github.com/mastodon/mastodon/blob/ae4f80ee5721465dc55a08b70a9792e9db763459/config/initializers/vips.rb#L29

Cost of raw #solar cells is unbelievably stupid: ~40$ per 1000W delivered to loading port. Peak electricity price here is something like $0.12/kW•h. So even with 50% overall efficiency it breaks even after ~800 hours of runtime. That’s fucking 100 somewhat sunny days at worst. One again: after 100 (one hundred) sunny DAYS you will have absolutely free electricity basically for the rest of your life. The rest of the panel price are shipping, labor, aluminum, glue, glass, copper, couple diodes and some solder. But wait! Factories producing don’t have enough buyers and work at half of capacity. One again: raw solar is dirt cheap and no one is fucking buying them! Oh, and at the same time China is adding something like 400 gigawatts of solar capacity per year. Global annual electricity demand is up to ~30000 TW•h or something like 82TW•h per day. 60% of that is fossil fuel Say cell can generate 1W in a whole day. To cover fossil fuels production use we need 50TW of solar which is roughly $2T worth of raw cells. Big number, but global GDP is $118T. So that’s just 2.3%. But here is a thing: estimated global fossil fuels subsidies anywhere from $0.9T to $6.7T in 2024, depending on how you count. Yeah, those numbers are based on sport raw cell prices. But wafers end cells are fucking HIGH TECH part of them and like half of cost. The rest is sweat, glue and glass. Anyone who can hold a soldering iron can assemble modules in panels. Solar transition is limited not by production but by fossil fuel bribery of the politicians, who impose taxes, tariffs and other completely made-up expenses to slow solar down. If we wanted we would’ve already replaced most of fossil with solar. Fuck politicians. Fuck governments. Fuck fossil fuels and their “stakeholders”

@niconiconi@mk.absturztau.be most meaningful metric is fio with direct writes, fsync and depth 1 with write size bigger than possible dram cache size. It will basically show raw nand performance

@whitequark@social.treehouse.systems oh, and making sure your entry and exit nodes are not on same IP helps if someone snitches on your connection being VPN

@saramg@fosstodon.org You literally put a lot of effort! Wish you a printing luck: dry filament, perfect base payer, no delamination and spaghetti! I think i still have trauma from my first one. It was Ultimaker clone and i was young-ish and studip-ish and didn’t know how much presision it takes to make CoreXY work. It was very hard and expensive to buy rails, so I had not very straight shafts, random bearings, shitty caliper and a looooot of sweat to even print a magnificent cubish cube or calibration cat (benchy had a competition back then!) Divorces are weird these days, that’s for shure. Mine was back when we fought who’ll get new shiny Intel iMac and who’ll get mighty old PowerBook :D Can’t imagine how people are splitting digital stuff now. Like Steam library is expensive asset!

@fay59@tech.lgbt all clock are broken if you precise enough

@tom@tomkahe.com yay! Thanks for running this bot, it helps a lot with discovery on single user instance :)

@tom@tomkahe.com hi! Looks like @trending_bot@tomkahe.com skipped couple last updates

@carlstype@typo.social whoa, this is beyond awesome! just made a variable glyph in browser on a phone?!

What a fucked up timeline where you basically need local DPI, because everything you have must be treated as malicious, because it eventually deliver malicious payload thanks to supply chain attacks.

@patrick@retro.social yeah, part where corporate users need to protect their assets from misuse or tampering is clear and I do understand and even involved in that. But making this mandatory for consumers is not clear at all First problem is who draws the line between owner and user. In mandatory scenario it’s almost certain in long run it won’t be a user. Great example is sim-locked devices: almost all operators abuse it way after device is fully paid off. Regulations vary between countries on this front but all in all consumers are in worst place because even if they paid their device off, they still don’t have agency and fully dependent on operator will. I don’t why mandatory atteststion won’t go have the same outcome. Another example is Apple. I do feel like Find My makes me safer, but I also know it’s fake sense of security. People who are serious about stealing devices know how to sell them for parts. As long as there some value l, it won’t stop. Irony is that for legitimate users repairs now cost more, because ateestation cost money and of course corporations abusing their power for profit. What I’m trying to say is that forcing attestation creates giant inequality: private consumers can’t match the power that vendors have. And even regulations can go this far to protect them I’m all for consensual opt-in. What is happening with ReCaptcha and Apple thing is not consensual. It’s someone once again abusing their power over and it will be impossible to get out of it if this spreads.

@mjg59@nondeterministic.computer but what attestation supposed to protect from? It absolutely can’t and will never ever solve “bot” accounts. If device has a screen you can tap, it is already automated without compromising hardware integrity All you need is camera, cheapest servo and mcu, which is like 10 bucks at most

@casar@mastodon.social @whitequark@social.treehouse.systems after babysitting DANE at my mail server, I’d say it’s a good thing that it’s not going to happen. DNS is not realtime and keys rotation is a nightmare of non-predictable duration. The best you can do is to not rotate keys, so fingerprints do not change. DANE requires to establish trust in DNS first and DNSSEC can compete with IPv6 on deployment rate. Heck, even some TLDs still don’t have DNSSEC roots. As we seen this week a tiny little mistake in RR during key rotation is what it takes to bring whole TLD down. Now imagine this but with DANE on top of it. CF-scale outage in a brewing. It’s a miracle that we finally have CA that can issue certs for bare IP addresses, which can’t happen with DANE by design. There are tons of things that CA based TLS do that DANE just can’t by design. Especially it allows you to make and fix mistakes. Which will always happen. While CA-based PKI is an actively burning dumpster fire, it’s still better in practice than anything DANE can offer in theory We need some other way to establish trust between parties without central authority, but it’s one of the “millennia problems” of infosec, which is not solved yet

@whitequark@social.treehouse.systems it’s unbelievable cool and very scary, because we have no alternative that can handle even a fraction of this issuance volume. Like ZeroSSL and that’s basically it. And their share is not even visible in stats trackers :( I suspect they won’t be able to handle even a fraction of LES traffic, should something happen

@mhoye@cosocial.ca I hope they have rollback procedures for that. Hugs to everybody involved, db maintenance got sidetracked is fucking awful

And it’s fucking waste shitton of time to vet something to be deployed anywhere that touches something sensitive. And everything is sensitive when it leaks. Grrrrh

@sitnik_en@mastodon.social which model do you have?

Seriously, fuck EU politicians 10,000 dies in heatwave: lets build more data centers for AI! Here €30b 50,000 flees to Spain: disaster! Crisis! fuck this, we are closing borders! Also fuck Maroccan politicians who uses people to “put pressure”, giving zero fucks about hundreds dying and rest having a huge chance to spend rest of their lives in concentration camps without any rights

Ugly Liquid Glass rasterization artifacts are still there. Why

Each time i have to touch digital signatures for legal stuff i just want to build cabin on a hill with panoramic seaview and grow olives and weed or whatever

@mhoye@cosocial.ca How it started: Database API maintenance May 8, 2026 18:46 UTC UPDATE Done How it’s going: May 8, 2026 18:37 UTC INVESTIGATING We have been made aware of a potential incident and are shutting down all issuance.

RE: https://mastodon.social/@nixCraft/116737252965303807 And today of all days I logged in steamOS desktop mode and clicked “yes, update all packages” in this tiny little annoying dialog There are couple of simple bash scripts that check if you have compromised packages that being discovered so far: https://gist.github.com/Kidev/59bf9f5fb53ab5eee99f19a6a2fc3992https://cscs.pastes.sh/raw/aurvulntest20260611.sh

RE: https://ruby.social/@flavorjones/117003927959522056 Looks like mastodon is fine. It has untrusted media processing disabled for vips since the switch from imagemagic https://github.com/mastodon/mastodon/blob/ae4f80ee5721465dc55a08b70a9792e9db763459/config/initializers/vips.rb#L29

Decided to give OUPES a try, reviews are not terrible, so why not. 419€ + ~80€ delivery here is not bad at all. Couldn’t find lightweight the panels that fit easy to install side of balcony and without pictures of delamination, so will get them later. Not that it’s make much economical sense, but it will be cool to run my desk straight from the sun for couple hours a day! Meanwhile forecast for the Monday is already at +38°C. Weather people say heatwave be 10 days long. Yikes. I think weekend is worst time, since people are at home running their AC on top of AC’s running in offices and stores

@mjg59@nondeterministic.computer yeah, I’m totally with you on this one. But say if someone replaced cpu or nand because it failed, is this device should be considered compromised?

Hey! I’m looking to buy a “solar battery” mainly to use as UPS/backup and for kinda-sorta arbitrage, since night off-peak tariffs are 1/3 of day ones. My work desk is burning around 100w idle and 200-250w when I use it, plus extra 30-40w from network equipment. From time to time we have brief outages, usually less than hour long, but I’m aiming for 2-3 hours of runtime for desk only. Also. Given the amount and severity of heat waves if blackout happens when it’s +35°C outside I’d like to use it to run my 2kW peak rated inverter AC. On weekend we’ll have +37°C and I’ll measure consumption to get better idea how much it chugging Optionally, put up few panels on my balcony, though it gets just 4-6 hours of direct sunlight during the summer. I might have space for 500w at best. Maaaybe, I can get a green light to put a bit more at the roof of our building, but I’m not counting on that My other requirements: anti-islanding protectionbe quiet under <300w loadcharging scheduling and capacity management (charge at night, discharge during the day until X% left). Or BLE/WiFi controls, so I can hack this myselfcan be sourced in DE (I have forwarding company that can ship it to me for reasonable price) I’m looking at OUPES Mega 1 or AFERIY Nomad1800 Pro Reasons mainly: Nominal ratings are close to peak AC rated power and surge covers well over that very cheap: ~450€ for ~1kW•h)can be expanded with extra batteries. However availability of OUPES B2 battery in EU is not clear and I’m still waiting for theirs pre-sale dept response~20ms switch time My uneducated research found only real downside of cheapo power stations is self-consumption and rough edges on warranty side. Warranty is, well, not much use for me, as I’m not in EU And tbf I’m fine with ~80% round-trip efficiency and 10% discharge rate. Any recommendations? Maybe I’m missing something? Any feedback is much appreciated! #solar #solarpower #offgrid

Apparently 7.5kg of ice is enough for 3 people only for 4 days. And it’s not even a peak heatwave and i do have AC (Also i used like had of that, this 700ml ikea glasses are awesome)

@sitnik_en@mastodon.social looks like you are using two SMLIGHT radios. I’m thinking about buying their multi radio version (can’t decide between dual MG26 and CP+MG) Any particular reason for having separate devices? Thanks!

@saramg@fosstodon.org oh I miss that feeling when you can just download physical things from the internet! It’s also slow and quite loud! Like the old times

I wonder how chat control will be enforced by bare metal providers And fuck it’s hard to find a country where you can rent hardware and not step in bullshit regulations you have no way to influence. And hardware prices are not making this any easier. Please shit on your MEPs heads as much as you can and ask them to open a probe into who got all the bribes to push it

Greedy fuckers: He explained that Micron has signed 16 SCAs, most of them covering 2026 to 2030, and that they involve a commitment to buy a certain quantity of product and pay for it in a pricing band that has a floor and a ceiling price. The floor price covers the historically high gross margins mentioned above, and the ceiling price means those who commit to an SCA are insulated if memory prices go even higher. Revenue landed at $41.5 billion, a fifth consecutive quarterly revenue record and 346 percent year-over-year jump. DRAM revenue alone reached a record $31.3 billion, up 343 percent year-over-year. NAND revenue rose 361 percent year-over-year, to $9.9 billion. Net income reached $28.9 billion, and consolidated gross margin came in at 84.9 percent 84.9% margin and price lock in till 2030. Fuuuuuuck https://www.theregister.com/systems/2026/06/25/micron-locks-in-historically-high-memory-prices-for-five-years/5261854

@whitequark@social.treehouse.systems Hysteria2 is has lower latency than vless/vmess. If you go vless path, then xhttp is kinda hungry, but least visible to dpi. 3x-ui is quite nice package to manage xray, and recently got multi node management. But I have a feeling maintainer is secretly vibecoding since last month :(

@galaxis@mastodon.infra.de oh, both times by brain completely blanked this paragraph out and I went to reading skill themselves to find it. Thanks!

Upside of having ADHD: in May 2022 Bo Burnham released Inside Outtakes. I decided to watch it later in a day and well… I just found out that Bo Burnham released Inside Outtakes and had a pleasant hour

Okay, kinda-sorta social media detox helped a bit. What I’m certain is that given the state of the world and shit, it’s absolutely healthy to just shutdown for a while and spend your free time doing whatever makes you off the doom pit internet become Also killing nazis in Wolfenstain in easy mode helps a little. And it’s kinda weird that there are like just 10 games where you can actually making stuff better stuff instead of destroying everything

@galaxis@mastodon.infra.de from time to time I’m thinking about making browser extension that queues your all of your browsing history for wayback archival. And I’m trying to build a habit of linking webarchive in my notes. Otherwise links rot in few years and some notes become completely useless:(

RE: https://toot.cafe/@baldur/117025275305725826 While this is very good article about Meta amplifying bullshit, I’d like everyone to stop and think how other countries reacted to this and what political forces are in charge there Should any serious crisis happen in country not “european” enough: “send them back”, “close the borders” will be response, not a shelter and call for help.

@galaxis@mastodon.infra.de uh “this is agent skill” as vuln disclosure is something new. I honestly tried to skim over wall of “skills” text but failed to find the essence of exploitation

@whitequark@social.treehouse.systems @tubetime@mastodon.social Aksualy it’s docker run --privileged (hides in own ns)

RE: https://mastodon.me.uk/@Floppy/116997766777309382 Sadly, it looks like the whole ecosystem needs to be forked. I love ruby, it’s one of the most pleasant languages to work with. It’s really saddening that @matz@ruby.social just let this go, letting ruby slide into nazi bar. But i do understand that it’s tough place to be, because ruby and big chunk of rails development is paid by shopify, and their ceo is a buddy of three letter nazi. This is also a good example of why just having sponsor is not enough for healthy oss. Software need to have a diverse funding, that allows saying “fuck you” and stop accepting money from dickheads at moment notice

Just here to say that “I Follow Rivers” by Lykke Li was released 16 years ago Until later!