@falsifian `tag:twtxt.net,2024-09-08:SHA256:23OiSfuPC4zT0lVh1Y+XKh+KjP59brhZfxFHIYZkbZs`? :)

@falsifian

> Key rotation

Key rotation is useful for security reasons, but I don't think it's necessary here because it's only used for verifying one's identity. It's no different (to me) than Nostr or a cryptocurrency. You change your key, you change your identity.

> It makes maintaining a feed more complicated.

This is an additional step that you'd have to perform, but I definitely wouldn't want to require it for compatibility reasons. I don't see it as any more complicated than computing twt hashes for each post, which already requires you to have a non-trivial client application.

> Instead, maybe...allow old urls to be rotated out?

That could absolutely work and might be a better solution than signatures.

> HTTPS is supposed to do [verification] anyway.

TLS provides verification that nobody is tampering with or snooping on your connection to a server. It doesn't, for example, verify that a file downloaded from server A is from the same entity as the one from server B.

> feed locations [being] URLs gives some flexibility

It does give flexibility, but perhaps we should have made them URIs instead for even more flexibility. Then, you could use a tag URI, `urn:uuid:*`, or a regular old URL if you wanted to. The #url">spec seems to indicate that the `url` tag should be a working URL that clients can use to find a copy of the feed, optionally at multiple locations. I'm not very familiar with IP{F,N}S but if it ensures you own an identifier forever and that identifier points to a current copy of your feed, it could be a great way to fix it on an individual basis without breaking any specs :)

My first thought when reading this was to go to my typical response and suggest we use Nostr instead of introducing cryptography to Twtxt. The more I thought about it, however, the more it made sense.

1. It solves the problem elegantly, because the feed can move anywhere and the twt hashes will remain the same.
2. It provides proof that a post is made by the same entity as another post.
3. It doesn't break existing clients.
4. Everyone already has SSH on their machine, so anyone creating feeds manually could adopt this easily.

There are a couple of elephants in the room that we ought to talk about.

1. Are SSH signatures standardized and are there robust software libraries that can handle them? We'll need a library in at least Python and Go to provide verified feed support with the currently used clients.
2. If we all implemented this, every twt hash would suddenly change and every conversation thread we've ever had would at least lose its opening post.

@prologic It's pretty hard, actually. There will either be more friction than people will accept (BitTorrent) or it won't be decentralized in practice (LBRY/Odysee).

@bender , do you depend on first-party Bluesky servers for the client application?

@movq I was never aware of this. I see the utility but I'm glad they got rid of it.

@quark Looks neat. How does this compare to gocryptfs? Same basic concept with a different backing file format?

@slashdot Never connect a TV to the Internet and then it will work for even longer than 7 years.

@bender The whole album, it's pretty good. It's available on YouTube but it's missing from all the music streaming services (Spotify, Tidal, Qobuz, Deezer, etc). I especially like *Tenth Avenue Breakdown*.

@lyse We have some native blackberry species but around here (Northern California) we have Himalayan blackberry bushes which are very invasive. They match your description but I don't know much about the different species. If left unchecked in an area with plenty of sun, they'll smother all the lower plants and expand until they can't anymore.

@movq Right. I wonder if Usenet would have faded away earlier if it wasn't for file sharing. It's only still in use for that because the annoying parts have been papered over with easy-to-use software and the protocol offers unique characteristics that make it almost perfect for that sort of thing.

@abucci What did he do?

@movq There's a *lot* going on on Usenet, but it's all in alt.binaries and co.

@lyse Nice. There's a park here in town with giant blackberry bushes everywhere. They're my favorite invasive species.

@slashdot This is an arms race the Brazilian government (or any government, for that matter) can't win unless they effectively disconnect their entire country from the Internet.

@prologic Off the top of my head, I don't know the differences between 1.1 and 2 but I know HTTP/3 is the one that uses QUIC.

@off_grid_living I use absolute paths for my links so I use a local Web server. I use darkhttpd, which is much simpler than Apache and has just enough features for me. I don't think I've ever run into encoding issues because I make sure everything is UTF-8 like @lyse.

@prologic Do you really need FUSE for that? I think that could be done with a process watching a directory on a regular filesystem and deleting the oldest files as the combined size reaches that cap. I'm sure someone's done that already.

@bender They must be statically compiling all those Haskell libraries on Ubuntu. This seems to be how it is with every Haskell package on Arch. Pandoc has 180 of its own un-shared dependencies on my system.

@bender Shellcheck is great but I hope you don't care about a low package count for screenshots like some people.

This one got me. I try to stick to POSIX sh so I'm not super familiar with the behavior of `[[]]`. I definitely should have gotten `-eq`, though.

@bender If anything was going to be an NFT, a domain name would probably make the most sense, but I don't think that system would be any better than the current one and it would make domain squatting even worse.

@falsifian I do on my other feed, @mckinley, but it's too hard to keep it under 140 characters when you're using mentions.

@movq We've had `.home.arpa` for a while but it just doesn't feel natural to type. I've been using `.internal`.

Side note: I didn't realize the .box TLD was finally live. Looks like domains are super expensive and also NFTs for some reason. Shame. https://my.box/

@slashdot I'm surprised this took so long to become standardized.

@prologic No cloud at all. Healthchecks, which does have a hosted offering, is definitely designed for more serious organizations than "McKinley Labs". It has separate users, permissions, all kinds of crazy features I don't need at all. I definitely wouldn't be using it if there wasn't a linuxserver.io image and I'd like to use something simpler but I don't know of anything else that's completely self hosted.

@bender The status of the disks and the backup jobs from Scrutiny and Healthchecks respectively. Green means everything is fine, red or orange means it needs my attention.

@bender That's great, actually, but it's a shame you have to opt in to it.

@prologic Ah yes, the other Go reverse proxy. Caddy seems simpler to me, more like Nginx with better defaults and a built-in ACME client. Traefik seems to have way more bells and whistles for all kinds of crazy setups when I only need to map domain names to containername:port pairs.

All the "magic" might be nice in the short term, but as it becomes the default it can paper over some really questionable decisions when it's too late to change them. This can be applied to a number of things in computing but the best example I can think of is networking. (Side note: That's one of my favorite blog posts ever.)

Things start out simple and got more complicated until someone figures out how to cover up the mess. Then, since nobody wants to get in there and fix it properly and everyone else has already moved on, we just ignore what's behind the curtain and hope it all keeps working.

Definitely something going on here. Cloudflare is my main suspect.

@prologic I thought you were one of the people telling me how great it was. It is a Go project, after all. What do you usually use? I always find myself spending a lot of time making Nginx do what I want and I don't think I've ever had automatic certificate renewal work the first time.

Caddy just works. I have some self-hosted Web services with easy-to-remember subdomains that only exist on my Wireguard network with a valid Let's Encrypt (wildcard) certificate so browsers don't complain. It *should* be automatically renewed without my input but we'll see what happens. It took shockingly little effort, even considering I need to customize the Docker image and create API keys so it can solve a DNS challenge using my provider.

I'm still not thrilled about using software that does magic for you (like Docker and Caddy) but it sure makes things easy.

@bender What are you doing with it?

The end-to-end encryption means very little if you have your messages backed up in iCloud because the encryption keys are also stored with the messages in iCloud according to this FBI document. If that's the case, Apple can definitely read your messages as well as (obviously) any government agency who can make a legal request to Apple.

@movq Group chat is still pretty rough around the edges, especially if you want encryption. I don't use it with my friends. If you need group chat, it's probably better to use something else.

@movq I don't have much family and I talk to them on the phone but I've been there on two occasions with friends and Jabber.

> They attribute unrelated things to it, like “I can’t send messages to you, I don’t reach you! It doesn’t work!”

This scenario has played out the same way for me multiple times. It's uncanny.

I have some friends on Jabber now but it took time to make that happen. It helps that Conversations on Android is really good. I just hand them $5 cash and have them buy it on the Play Store so I don't have to answer questions about F-Droid and APK files.

On iOS, I recommend Siskin IM which works most of the time but I need to set it up for them because it doesn't handle captcha registration very well (fields are shown that shouldn't be and it's confusing) and it doesn't enable OMEMO by default (iirc).

I also used to refer to it as "XMPP", but I think that made it worse for me. "Jabber" is much less technical-sounding and some people remember hearing others talk about it.

@slashdot Great, now your car can slam the brakes randomly in addition to jerking the steering wheel randomly, i.e. lane keep assist. All these "safety features" add a fun new challenge to driving. You need to constantly be aware of your car's computer misinterpreting something and respond to its reaction or you're going to end up in a ditch or in the front of a 10 car pileup.

mitmproxy is not un-escaping for readability:

I swear I copied a URL from an address bar one time and I noticed it was percent encoded on the clipboard when the text in the box wasn't. It was showing me something easy to read, but when I was going to use that URL for something else it was properly encoded so it wouldn't cause exactly this type of problem.

Do browsers not percent-encode URLs automatically? They did in the past, right? For some reason I thought they still did, but they showed the original URL in the bar for readability.

I just used mitmproxy and pasted that URL and it didn't escape it at all.

One more point, not necessarily for @bender but for anyone else reading this. If you don't want to use the command line, Arch probably isn't for you. Linux Mint is much closer to a command-line-free distribution. Don't be afraid of the command line, though. The command line is good for you.

@bender Yes, that one. It's not a big deal unless you use Arch on a remote machine. You can expect some minor issues like this, but the Arch team does a good job of smoothing these things over with prompt updates and announcements like that if they can't.

EndeavourOS is alright, better than Manjaro in my opinion. If you're going to use an Arch based distribution, I would recommend just installing regular Arch. They have an install script now that makes the installation very easy if you want an average setup, but the manual installation isn't that hard if you want something more specialized.

The Arch manual installation also gives you valuable knowledge on how to fix the system if it breaks.

@eldersnake That would be really useful. I can't train myself to do `yay -Syuw` and I don't like having one package name on each line when confirming the upgrade.

@movq I actually had to hook a monitor and a keyboard up to my server. This is the instability they talk about on Arch, which I've been experiencing a little more lately.

@prologic Regardless, Sentz looks really sketchy to me and I wouldn't trust it at all. I think it would probably function properly; they probably aren't going to outright steal your money (for now), but I have reservations about the confidentiality of transactions and what might happen to the ecosystem in the long-term.

Any "cryptocurrency" created by a for-profit company cannot be trusted. Plus, I'm not seeing a link to any source code from the home page either.

It reminds me of this episode of It's Always Sunny in Philadelphia: https://www.youtube.com/watch?v=NHYX0HFJoG4

@prologic Looks like any other payment service except it's intermingled with some sketchy cryptocurrency. I would just bypass all that and use Monero instead.

@prologic I use Redirector by Einar Egilsson. It works great. You can even import and export your rules with JSON files.

* https://addons.mozilla.org/en-US/firefox/addon/redirector/
* https://chromewebstore.google.com/detail/redirector/ocgpenflpmgnfapjedencafcfakcekcd

@eldersnake A *huge* effort. Andreas Kling is the lead of the SerenityOS project and he makes great videos on his YouTube channel. It's mostly been monthly updates lately on SerenityOS and Ladybird but he also has a lot of programming videos where you get to see his process, fixing a bug or adding a feature from start to finish. I highly recommend his channel.

@prologic There is JavaScript, but not everything is implemented (properly). They're writing everything including the JavaScript engine from scratch.

It worked! I can't reply to a message (this was posted from the conversation view) and the hamburger menu when the screen is narrow doesn't work, but it's getting much closer.

@jsreed5 I had a public network block my personal Wireguard connections on port 51820 but my VPN service using Wireguard on port 1637 wasn't blocked. I don't know what they think they're accomplishing. It was at a hotel, where people might feasibly need to connect to a VPN for work.

To everyone reading this, please make sure the elderly people in your life know to be very skeptical of unsolicited messages from companies, banks, government institutions, and pop-ups that say their computer is infected.

I would recommend getting them the hell off of Windows as well if you can, installing uBlock Origin in their browser, and disabling all browser notifications. Linux Mint is a great distribution for non-technical people. Just tell them to only install software from the Software Manager application and to think of it like the app store on their phone.

@bender These sorts of scams are a huge problem and gift cards are an easy way to move money around anonymously. There are a few different common types of scams, but they usually involve someone logging into the victim's computer using a remote desktop utility like TeamViewer and asking him for money under some false pretense. If the victim won't pay, the scammer will sometimes lock down the computer so they can't use it.

Usually, it's nothing a reinstall won't fix but if they can change the password/recovery of the Microsoft account and the disk is encrypted (which is the default if you sign in to a Microsoft account on Windows 11) it can be impossible to get their data back without the help of Microsoft support, who will treat you as if *you're* the one trying to steal the account. It is important to remember that the people running these types of scams don't have much deep technical knowledge (if they did, they could get a real job) so I've never heard of that happening but it is a serious risk.

It's been known for some time that AI actually stands for "A lot of Indians".

@prologic No

@muayboranacademy Huh, a twtxt feed hosted on Google Drive.

@bender I see you host your own relay. Which implementation are you using, and how did it go setting it up?

@bender Maybe I'll get back into it at some point. I think it would be a little excessive to have a standard twtxt, a rich twtxt, *and* a Nostr feed, not to mention a regular blog and a separate "notes" section on my website.

@bender I don't have one. When I was looking into Nostr, I couldn't find a client I liked so I put it on the back burner. Which one are you using?

@prologic No pain here. There's no important data on them, and the first portion of the drives work reliably enough that there weren't any issues before I had to shelf it. This is just for fun. I don't even think I'd consider it a war game.

@mckinley It booted. I was going to do more but I had actual work to do so I shelved it. Maybe I'll come back to it another time. These drives are in really bad shape, though. They hold up udev by 30-60 seconds on every boot, even when booting the Arch install ISO, covering the console with lots of SATA errors and timeouts I don't really understand.

Badblocks via `mkfs.ext4 -cc` was taking too long on the full 1+1 TB array so I made new 250 GB partitions and neither drive had bad blocks in that range so it was just a waste of time. Maybe if I come back to it I'll do the full array and have the #ESP_on_software_RAID1">EFI system partition in RAID 1 just for fun. I didn't know that worked with software RAID.

> The key part is to use --metadata 1.0 in order to keep the RAID metadata at the end of the partition, otherwise the firmware will not be able to access it.

I had the ESP on a USB stick for simplicity's sake.

@prologic I can't really commit to that. Don't plan anything around me.

@shreyan Same here. I work relatively late so I'm never up that early.

@prologic Nice! Save some marshmallows for me.

@prologic Any of the above

@rrraksamam I'm looking forward to my all-SSD Btrfs RAID5 NAS. I think it'll be a while, though. I just paid $6.92/TB for a couple of used 12TB HDDs.

@prologic They're shutting down after 7 years. It was a great place to buy Monero with cash by mail. https://localmonero.co/nojs/blog/announcements/winding-down

@aelaraji Nice. Compiling problematic software is my #1 use of containers on my PC. I use a handful of them on my server.

@lyse Same here. Where does it not work, @movq?

@movq People just don't ask these questions. It's really a serious privacy issue, and I don't see it brought up very often. Not even in privacy-minded circles. If you're using a proprietary operating system on any Internet-connected device, you need to assume that the vendor can see everything you do on it and maybe even what you do on other devices as well..

Actually, it looks like notifications using Google's service *can* be encrypted end-to-end. I don't know if this is used much in practice or if you can tell if the notifications on *your* device are encrypted. There seems to be some conflicting information out there.

Even if the content is encrypted, though, you're still giving quite a bit of metadata to Google by using their notification service.

It looks like ntfy.sh can work either through the OS's notification service or by maintaining its own connection to the server in the background. For privacy, you definitely want to use "Instant Delivery" and self-host the server.

#how-much-battery-does-the-android-app-use">https://docs.ntfy.sh/faq/#how-much-battery-does-the-android-app-use
#what-is-instant-delivery">https://docs.ntfy.sh/faq/#what-is-instant-delivery

@movq I haven't done any app development, but I know notifications on phones are indeed dependent on cloud services run by the OS vendor which talk to servers run by the app vendor on your behalf. This is supposedly better on battery life, but it conveniently lets your OS vendor read all your notifications.

Mobile XMPP clients usually implement notifications using XEP-0537 and it goes like this:

```
Your XMPP server -> Client vendor's notification server -> Client OS notification server -> User's device
```

It's not end-to-end encrypted so servers will usually just send a dummy message through (You received a message from juliet@capulet.lit!) so you have to open the app to see the (hopefully) encrypted message.
It's a similar flow on both iOS and Android and I assume Matrix clients work the same way.

@prologic I know, right? It's a very elegant solution to the problem using standard command line utilities. It was too hard to find. I went through 3 or 4 Stack Exchange threads from my Web search before I found somebody linking to this answer. People were misunderstanding the question and suggesting all kinds of crazy methods including weird, proprietary, GUI Windows software.

@prologic I can't recommend it enough.

@movq

```
$ units -t '500 gigabytes per 9 hours' 'megabytes per second'
15.432099
```

That's a very unfortunate speed in the year 2024.

@movq That's no fun at all. I don't like to throw away working hardware either, but I wouldn't wait 7 hours (CPU-bound!) for my manual backup to complete if it could be done faster on a 10 year old laptop with AES-NI. How much data did you add?

Speaking of which @prologic, have you heard from @ocdtrekkie lately? He's active on mastodon but I haven't seen him around here in a long time.

@prologic I agree with @movq. Good documentation is better than an interactive setup process. My difficulties (#isyb2aq) were because I was just doing it for testing and I wanted it running as quickly as possible. If I was running it in a production capacity, I would read through the documentation.

If you're trying to make non-technical people set up their own Yarn pod, that's probably (unfortunately) impossible. Management software like Sandstorm make it "as easy as installing apps on your phone" (direct quote from sandstorm.org) and most people still pay Google to store their photos.

I remember you were trying to do paid hosting for Yarn pods in the past. That could work, but as I'm sure you know it's difficult to convince people to use this over X or Facebook, let alone host their own pod. I think it's going to stay a small community of fairly technical people for the foreseeable future.

@movq I do wonder that sometimes, but I try to take notes if I'm doing something complicated. Just a few lines in a text file with some context plus the command I used. `ffmpeg.txt` comes in very handy.

It's 500. I never changed it, so that's the default of either Bash or my distro. It's fine for me.

@bender That's what I suspected. I compared the text, including the alt text for the image. I guess I didn't read it carefully enough.

No worries @aelaraji, it happens to the best of us.

@aelaraji I'm definitely putting that in the list. I like tmux but I just can't wrap my head around the controls. This looks more like a tiling window manager.

@aelaraji Is that a terminal multiplexer? If so, which one? I suspect it says at the top but I can't quite read the text.

@bender Fair point... :)

@prologic Planning it ahead of time is all well and good if you have the money to buy 6 or 8 hard drives at once. I really don't, and I want to mirror the whole thing offsite anyway. Mergerfs will let me do it now, and I'll buy a drive each for SnapRAID in short order.

@bender Ha, we both looked it up at once. You win.

@bender Synology uses single-volume Btrfs on software RAID, which seems to be pretty solid in my research but that's less flexible than ZFS. https://kb.synology.com/en-us/DSM/tutorial/What_was_the_RAID_implementation_for_Btrfs_File_System_on_SynologyNAS

@bender Exactly. It's just not an option with warnings like that all over the place. Some people have had success, but I'm not risking it. https://lore.kernel.org/linux-btrfs/20200627032414.GX10769@hungrycats.org/

@prologic ZFS is fine but it's out-of-tree and extremely inflexible. If Btrfs RAID5/6 was reliable it would be fantastic. Add and remove drives at will, mix different sizes. I hear it's mostly okay as long as you mirror the metadata (RAID1), scrub frequently, and don't hammer it with too many random reads and writes. However, there are serious performance penalties when running scrubs on the full array and random reads and writes are the entire purpose of a filesystem.

Bcachefs has similar features (but not all of them, like sending/receiving) and it doesn't have the giant scary warnings in the documentation. I hear it's kind of slow and it was only merged into the kernel in version 6.7. I wouldn't really trust it with my data.

I bought a couple more hard drives recently and I'm trying to figure out how I'm going to allocate them before badblocks completes. I have a few days to decide. :)

@bender There's stagit which generates static HTML files

@prologic I remember running yarnd for testing on a couple of different occasions and both times I found all the required command line options to be annoying. If I remember correctly, running it with missing options would only tell you the first one that was missing and you'd have to keep running it and adding that option before it would work.

This was a couple of years ago, so I don't know if anything's changed since then. It's really not a big problem, because it would be run with some kind of preset command line (systemd service, container entrypoint) in a production environment.

@bender I avoid install scripts like the plague. This isn't Windows and they're usually poorly written. I think it's better to prioritize native packages (or at least AUR, MPR, etc) and container images.

@prologic That's good advice. I don't open any ports to the Internet if I can possibly avoid it. Everything is on Wireguard, even stuff that doesn't really need to be. It's super easy to set up on other people's computers, too. Even on Windows.

@prologic Both are very nice in my opinion. I don't think you could make a mistake with either, at least when it comes to looks.

@prologic I think this would be solved in the short to mid-term by fixing the mute function. Or, maybe, adding a "Hide this user from Discover" button.

@prologic Picnic CSS is my favorite one on first glance.

@prologic Are they changing unique IDs? I hate when people do that. If I ever do that with any of my feeds, feel free to mock me relentlessly.

@bender Makes sense. We definitely need the ability to mute feeds from the Discover feed.

@movq I remember your solution. It's very simple, I like it.

Yes, my backup target is my home server. I have a hard drive dedicated to Restic repositories. It's still not a real backup as I don't have anything offsite but it's better than my previous solution. I had two very old hard drives I kept plugged in to my desktop PC and I would (on very rare occasion) plug in another hard drive and copy all the files over to it. Luckily, I've never suffered any significant data loss and I would rather not start now. Once I have automated backups on each of my machines, the next project is getting those backups offsite.

@prologic I think one-way feeds are okay and we shouldn't discourage them so strongly. On the other hand, I think it's the duty of a poderator to filter out feeds that are just noise from the Discover feed. I definitely consider a truckload of one-way posts mostly in another language to be noise. Did you get rid of Gopher Chat too? I'd call that noise, for sure.

@bender Standard twtxt is a microblog in its purest form. A blog, but smaller. It's just a list of posts to read, and that's an echochamber in the same way my regular blog is an echochamber. I don't think there's anything wrong with that.

@prologic I support the delisting of ciberlandia.pt in the Discover feed due to the sheer volume of posts from there and the fact that most of them are in Portuguese with this being a predominantly English-language pod.

@prologic Why do we need to avoid posting to the void? That's pretty much what twtxt was made for. I don't like the "Legacy feed" terminology, either. I support the delisting of ciberlandia.pt but I think this change is heading in a bad direction.

I like @sorenpeter 's suggestion. It gives the users the information and lets them make their own decision instead of putting a big scary warning in their face. That's what Microsoft does, and we shouldn't be Microsoft.

@prologic How do you manage multiple remotes? Do you just run `restic backup` for each one?

I wish there was a good GUI for Restic so I could have non-technical people using the same thing I do.

@aelaraji I've never had a use for Syncthing but I hope I get one at some point so I can see how it works. Do three-way merges work on Keepass database files?

I use KeePassXC because I really only use one device. I imagine it would be challenging to rsync the database around if I needed my passwords on more machines. It's probably fine if you're deliberate enough, but I don't think it would take long before I'd lose a password by editing an outdated version of the repository and overwriting the main copy.

I like the simple architecture of Pass, and it would indeed lend itself well to a Git repository, but I don't like that service names are visible on the filesystem. pass-tomb might mitigate this somewhat but it seems messy and I don't know if it would work with Git without compromising the security of the tomb.

What's so good about Bitwarden? Everyone seems to love it. I like that it can be self-hosted. I certainly wouldn't want a third party in control of my password database.

@prologic This seems like it would drive a wedge between Yarn.social and the people on regular old twtxt.

@prologic I use LocalMonero (onion) to buy Monero with cash sent by mail. You can sell on there if you want to convert back to fiat. People also like Bisq, which is peer-to-peer software for buying and selling cryptocurrency.

To accept Monero, all you need is a wallet program. I recommend Feather Wallet. Create your wallet in there, then you'll copy the wallet files into monero-wallet-rpc for use with MoneroPay, see docker-compose.yaml.

@prologic Is it really banned? I thought the regulators just pressured the centralized exchanges to delist privacy coins without actually banning them outright.

@prologic I concur. This little community of ours is here because of you, and I'm very grateful for that. :)

@movq It's very useful. I always start my music player in a tmux session so I can SSH in, attach it, and control the music from another computer. It's also handy for letting long-running tasks on a remote machine continue in the background even if the SSH connection is broken.

@prologic Monero has stayed a little more stable than Bitcoin but it's still a cryptocurrency and it's still going to fluctuate quite a bit. It also uses proof-of-work algorithm so it still consumes quite a bit of electricity. I think the value of being able to send any amount of money, any time of the day, to anyone on the planet in 20 minutes (appears in 2 minutes, spendable in 20) **completely privately** with near-zero transaction fees exceeds the drawbacks.

Unfortunately, the characteristics that make it useful as a global currency for day-to-day transactions also make it useful for people doing illicit things. Many exchanges, fearing regulatory action, won't accept Monero for the same reason they won't accept Bitcoin from a mixer.

Monero shouldn't be banned just because people use it for bad things. It's just a tool and it can be used for good or evil. It's the same reason countries use when they ban or restrict Tor usage.

@prologic I'm in if you accept XMR

Actually, kyun.host might offer container hosting at some point.

> On-demand Linux containers.
> Run almost anything, without having to touch the command line.
> Coming Soon

https://kyun.host/services

@prologic That sounds great. The only other container-level hosting service I've heard of is PikaPods which seems much more managed than cas.run would be. It has customizable tier-based pricing and the minimum specs are 1/4 of a CPU core, 256 MB of memory, and "about 100 MB" of storage for $1/mo which seems awfully steep compared to a low-cost VPS. I don't know if PikaPods offers an IPv4 reverse proxy or not.

Monero uses cryptography to make transactions anonymous and the coins completely fungible. With most cryptocurrencies including Bitcoin, the transactions associated with an address are public and you can trace those coins all the way back to their origin. This means that not all coins are the same. For example, some exchanges won't accept Bitcoin that comes from a mixer because they assume you're doing something untoward.

With Monero, it's not possible to trace any transactions with just an address. People can't see what you're spending your money on or where your coins came from. Transaction fees using Monero are also very small. It's less than the equivalent of 1 cent in USD.

Minuscule transaction fees and anonymity make it the best choice in my opinion for buying goods and services online. Monero is much more like "digital cash" than Bitcoin, which I think is better described as "digital gold".

@movq You could always keep it running in a detached tmux session and attach it when you see the spike. Processes that were recently using the netwotk stay in the list for 10 or 15 seconds after they're finished so you don't have to catch it in the act.

@prologic $0.15 sounds great but you need to make money doing this. Is it still going to be use-based pricing or will there be tiers like conventional VPS providers?

You could get better value for money with a super cheap VPS without IPv4 connectivity but it wouldn't be worth it if you didn't need the extra resources as a VPS wouldn't be practical with such low specs. It would also require significantly more effort on the part of the operator.

I would understand paying a small premium for using the lowest-cost tier, convenience, and especially if you operated a reverse proxy with IPv4 connectivity.

@prologic $0.50/month seems reasonable. Is this for cas.run?

@movq I use nethogs for this sort of thing: https://github.com/raboof/nethogs

@prologic What is an mCore? 1/1000th of a core?

@prologic Plexamp has some really cool features. It's a shame it's proprietary and dependent on central services.

@movq Interesting. mpd + ncmpcpp seems to be a common setup among our type but I really like cmus. Whipper is my CD ripper of choice and it is excellent. It queries AccurateRip for checksums and MusicBrainz for metadata, and can encode to any format you want. It also creates a nice log file like EAC does (it can even create EAC-compatible logs with a plugin) so you can verify that it was ripped properly.

@prologic He didn't like LibreOffice Writer? Is he used to Microsoft Word or Apple Pages? I've had success getting non-technical Office refugees on LibreOffice, specifically Writer. Most people don't need any fancy features and most things are located close enough to their counterparts on Word.

I show them how to export their documents as PDF before they share them with others and I use the (somewhat) immutability of PDFs and their portability (bundled fonts, rigid formatting, etc) to sell it. Those are two real benefits, but the main reason is that I don't trust other software to handle ODTs and I don't trust LibreOffice to write DOCXes. Although, I don't know if I really need to be worried about either of them with basic documents. It's probably worth investigating.

@prologic Nice. I hope he likes it.

@prologic What does he use now?

@sorenpeter Done

@bender Check out https://darch.dk/timeline/, it's an honest-to-goodness Yarn-like Web UI. Very impressive, @darch. Do you want it listed on groovy-twtxt?

@prologic You're right, but they're not going to stop until people vote with their wallets.

@bender I'm not suggesting that people should use an old Windows version to avoid this. I'm saying that Windows in general should be considered a legacy operating system, and continued usage will only make you subject to more of this tracking and unnecessary garbage.

In other words, the situation will never improve. It will only get worse from here, so you might as well get out now while there are still plenty of life boats. Otherwise, when they do something that's really over the line, you either have to go along with it or dive right into the cold ocean.

Windows is only kept alive at this point by a lack of knowledge about the alternatives, apathy, fear, and some enterprise software and games with support in Wine improving by the day.

@prologic Only if you stick with legacy operating systems

@bender I also use the Discover tab and I do wish I could mute some of them that only post in Portugese. I just didn't know they were on Mastodon.

Ah, the Ciberlandia people are on a Mastodon bridge. I thought we got rid of that.

@@villares@ciberlandia.pt Sounds like a great use for Monero: https://www.getmonero.org/

@movq Paper shopping lists are much better than phones. They don't turn off every 30 seconds so you have to push a button and type in a code.

@xuu Nice. I've been thinking of doing something similar for my website so I can host more services at mckinley.cc.

@prologic Usable? Impressive. You can fit a lot of ISOs in 22 TB. Are you doing ZFS?

@prologic I looked up BurmillaOS and this is definitely one for my thread about unique Linux distributions. Very interesting.

> Everything in BurmillaOS is a Docker container. We accomplish this by launching two instances of Docker. One is what we call System Docker and is the first process on the system. All other system services, like ntpd, syslog, and console, are running in Docker containers. System Docker replaces traditional init systems like systemd and is used to launch additional system services.

@eapl.me @movq I have an E1505 in my box of laptops and its keyboard is pretty great, especially by modern standards. I'd say it's almost on par with that of a contemporary ThinkPad (T43).

@xuu Wow. txt.sour.is has IPv6, so are you hosting it on one of those VMs or is it a reverse proxy back home?

@movq Maybe it's just a cargo cult thing (pun intended) because it's somehow an accepted way to install a piece of software.

@quark Maybe 1.8 is a bit excessive. I'll give 1.5 a try. Thanks!

Thank you @lyse, that means a lot. :)

@movq It's possible for a Web server to detect whether or not you're piping the output into a shell and change its output based on that, which makes `curl | sh` so much worse in my opinion.

https://web.archive.org/web/20240311094552/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/

@bender That's fair and I understand if you don't want to click through to another website just to get my thoughts on WYSIWYG website builders. However, my website is much better than a WYSIWYG one. It has absolutely no JavaScript or tracking (not even Web server access logs) and it will work on just about any browser that won't die the moment it sees XHTML.

If I'm putting a lot of effort into a piece of writing, I'd rather have it on my website that I control rather than someone else's. No offense @prologic :)

@prologic Wow. I didn't know the Mills DC was that serious. How much storage do you have and how is it set up?

@stigatle What kind of hashrate are you getting on that thing?

@bender I don't mind the character limit. If I hit it and I still have more to say, it's a good reminder that I should probably write a note instead. I like to POSSE anything that might have value outside of the current conversation.

I can't believe software developers are still trying to get people to do `curl | sh`. It's easy to miss the problem if you're still in the mindset of Windows software distribution, but these people are writing software on GNU/Linux, for GNU/Linux. You would think they'd realize that this is *never* a good idea.

@bender Solo mining at 450 Gh/s, it's a 1 in 8,765,713 chance per day of mining a block, so it would take roughly 24,000 years on average. Think of it like playing the lottery. It sounds kind of fun to me.

@stigatle Neat. Are you going to try your luck solo mining?

@movq I think Browsh is fairly new but it doesn't really count as it's just a frontend for Firefox. I haven't heard of any new, real, text-based browsers.

@shreyan Yes. It uses the FreeBSD core tools. #alternative-userland">https://chimera-linux.org/about/#alternative-userland

@movq There's nothing wrong with that. I just do it because I like well-defined standards and as a sort of protest against the "Living Standards". I also take care to make my website look reasonable even when CSS isn't available, especially in terminal browsers.

@movq That makes a lot of sense. I agree it's probably a better use of time to maintain a nice, simple website.

@movq That's an excellent point, I never thought about it that way before. I have always tried to be very conservative with the CSS on my website and my class names mostly reflect what they are.

Actually, I've had a new part of my website almost completed for a while, but I'm hung up on it because flex boxes are pretty much required to do what I want with the home page. My stylesheet has always been valid CSS 2 and I'm not sure I want to ruin that.

There isn't anything too far out of the ordinary there, but I like the idea of Chimera Linux. It's a new independent distribution, free of legacy cruft, aiming to create a simple yet practical modern desktop system. Interestingly, it uses Dinit rather than Systemd or OpenRC.

There are also a small handful of what I call "micro-distributions" like Static Linux, KISS Linux, and Oasis Linux which aim to create the simplest possible desktop Linux system while still having a usable package system. Some might (justifiably) call them toy distros, but I think they're neat.

@prologic How could I forget? :)

@movq Agreed.

Whoops, I started a thread when I meant to reply to the other one. I don't think I've ever done that before.

How does Gitea store repositories? Are they just bare Git repositories on the filesystem that can be cloned separately? Also, how does it handle the upstream force-pushing an empty repository? Will that destroy your archive?

@prologic So, you're automatically downloading videos by a select few YouTube channels and putting them into Plex? Interesting. When do you think your kids will figure out how to get around your block? :)

I agree with @sorenpeter. WebFinger and WebMentions are very much in the spirit of Twtxt and both of them are already in use. If we're going to do much more than that, we should probably just use Nostr instead.

@lyse The thing that really unlocked jq for me was learning how to get a TSV output. That was a complete game changer, because it meant I could easily use it in a shell pipeline. I found it to be better than gron for that purpose. Just make an array for each item containing all the values you need and pipe it to the filter `@tsv`.

```
$ # Search YouTube using the Invidious API for "never gonna give you up" and write the results to out.json
$ curl -sGL -A 'Mozilla/5.0 (Linux; x86_64) Ladybird/1.0' -o out.json --data-urlencode 'q=never gonna give you up' 'https://farside.link/invidious/api/v1/search'
$ jq -r '.[] | select(.type == "video") | [ .title, .author, .authorVerified, .videoId ] | @tsv' out.json
Rick Astley - Never Gonna Give You Up (Official Music Video)

@lyse Blank lines help a lot.

@lyse gron does something very similar with JSON. I used to use it more, but these days I just reach for jq instead.

@lyse Regarding YAML's readability, I miss the `-` for list items *constantly* when reading YAML files. I'll get confused because I think I'm not in a list or I'm in the previous list item, then I have to go back. List items are all on the same indentation column and one tiny character is the only thing defining a new one. I don't know if others have this problem.

I spent hours creating a perfect Prosody config for my most recent XMPP server attempt (about 2-3 years ago now) and I lost that file because I deleted the VPS. That was the only important file on there and I just didn't think of it when I deleted it. I didn't have a single backup, not even an old copy I `scp`ed back to my PC for editing.

I hope I won't make that mistake again but I wouldn't be surprised if I did.

@lyse Lack of comments are definitely a shortcoming of JSON. I don't like TOML because it lets you have nested categories (`[foo] [foo.bar] [foo.baz]`) and it just feels confusing to me, even with indentation. Simple INI files are okay.

The Prosody XMPP server's configuration file is just a Lua script because Prosody is written in Lua, and that's excellent.

@lyse `key=value\n` or JSON. YAML is the worst and I don't understand why it's so popular.

@xuu You are absolutely right, that would be terrible. The whole point of Nostr is to own your identity. I don't know what I was thinking.

Okay, is there at least a JavaScript-free Web client?

@xuu That's an interesting idea. Twt hashes still need a canonical URL to work, though.

* (3) Does Nostr require clients to download much more data than, say, Twitter? I can see it being a little more because of signatures, etc. However, text compresses well and clients should cache previous posts, anyway.

* (4) NIP-96 does HTTP file upload, XMPP style. There are some other advanced features like tipping on posts, custom emojis, and at least three conventions for selling goods and services.

Of course, not everything is available with every client and some of the specs are still being worked out. It looks promising to me, though. I like its distributed model with dumb servers and smart clients. The software will get better over time.

All three of your points on usability are definitely true, especially #3. I haven't been able to find a good TUI client.

Regarding the technical points, it seems like there are mechanisms to address each of them. Please tell me if I'm wrong on any one of these. I have only been learning about Nostr for a short time.

1. Relays aren't a single point of failure because a user can (and should) post to many of them. The attacker in a censorship or sabotage scenario would have to take down every one of your relays at once. If they were taken down gradually, you could replace the bad relay with a new one and advertise that one on all the other relays your followers already use. It's much more resilient compared to twtxt.

2. Every event contains a signature from your private key, so it's hard to spoof. NIP-10 provides a method for marking a note as a reply to another note.

Something I've noticed about the Nostr people is that they aren't the same as the software minimalism people. It seems like it's all JavaScript, Go, and Rust with dependency counts in the hundreds.

@lyse

>I fear it’s a rather complicated protocol.

The core protocol looks very simple but I'm sure you can get in the weeds with extensions.

>you can’t really change your keys without losing your identity

I think you're right but that seems reasonable to me. Your public key *is* your identity, similar to certain cryptocurrencies or Tor hidden services. Why would you want to change your key without changing your identity?

@bender How so?

Hey, it worked! I just had to refresh the conversation page.

@xuu. Let's see. I just followed @bender and I only typed `@bender` just now.

@quark You're right. I thought they *were* addressed and I started doing @nick mentions again out of laziness. Thanks for pointing it out.

@eldersnake The Linux kernel package on Arch Linux weighs 130.7 MB on its own. Any live image that fits on a CD is tiny in my book.

@lyse I just might have to snag that for my ~/.local/bin. I like that magic spell using sed for `--help`. That's a really smart way to do it.

@lyse @bender I do the same. I just thought it was interesting.

@movq I see. It's interesting to see commit history visualized that way.

@movq What happened in March of 2018 with all those commits across your projects?

Congrats!

@movq Yeah, it seems like that should never happen under any circumstances but that's the best explanation I can come up with for what happened and once I fixed the space issue the other problems went away. That particular filesystem is on a LUKS device on a disk image served with NBD. The machine in question and the NBD server are both on Arch Linux so it has potentially unstable versions of all the software involved.

It's a real house of cards and I'm not surprised something like this happened. I'm keeping lots of backups. My setup is pretty unique but I stand by my original post. Running out of space on Btrfs isn't fun, even when it's functioning properly.

@movq Pretty much. In my situation I was able to delete some files and snapshots and run a couple of different `btrfs balance` commands to move some allocations around. It looked like writes weren't all committed properly to the disk but nothing told me that explicitly.

I did a system update in this state and I think I remember mkinitcpio throwing more warnings than usual but I was doing something else and I didn't pay close attention to them. This coincided with a power outage and there was a lot of inconsistency, making me think it was hardware related. It was just btrfs, as far as I can tell, and I fixed it by reinstalling all the packages on the system once there was enough room. Luckily, I hadn't done anything important with that computer after the system update.

@prologic That looks pretty nice. It seems like the pricing model is reasonable as well. They don't try to nickel-and-dime you with features most people would probably need like others I've seen. Good luck with it.

@prologic It's true that the major players in the WYSIWYG-website-for-dummies industry not only function poorly but are also proprietary SaaS garbage. However, I don't know if it's really possible to make them function any better. HTML and CSS just aren't made for that.

@prologic Probably not the most helpful reply, but I posted my thoughts in a note. Websites are really complicated and there's a lot that goes into making one. When you put too many layers of abstraction on it, you have to cut corners somewhere.

@xuu ungoogled-chromium strips out the rest of it. Librewolf is my browser of choice and it has been for a couple years now. I like it a lot. It's basically un-Mozilla'd Firefox.

@thecanine That bit about haveibeentrained.com is wild. Do you have a source for that?

@lyse I also can't find the user agent string they use, which seems like it would be important information.

I had so many complaints about this Web page it wouldn't fit in a twt. https://mckinley.cc/notes/20240122-terrible-website.xhtml

@prologic Well, he did create a file system. That would probably drive a normal person to madness, if you didn't have to be crazy to do it in the first place.

@movq Haha, me too. I could have sworn I heard a fiddle when I rebooted.

Basically NBD for DOS, that's pretty cool.

@eapl.me There is HTTPS but it doesn't seem to be enforced. My browser always connects with TLS if it's available and the message is present with or without TLS or extensions, even when using cURL. I would notice if my VPN service injected things like this because I disable JavaScript and cookies by default. I think it's unlikely I'm being MiTMed because the certificate is definitely from Let's Encrypt. Also, I don't see the point in MiTMing me just to put a JavaScript challenge on someone's personal website.

I still think it's a hosting provider thing. It doesn't really matter to me, I'm just curious.

@xuu I caught AT&T doing this last year. They were also hijacking DNS queries if I remember correctly.

@movq Today I learned this package is installed on my computer. Unnecessary dependencies are really annoying on Arch. If I switch to Gentoo this will be a major reason why.

@sorenpeter If I go to your website, it makes my browser complete a JavaScript challenge and send the result to a special location on your domain using a form called "wsidchk". After I complete that I get a cookie and I can browse your website freely. It isn't Cloudflare. I imagine it's because I'm using a VPN service with somewhat disreputable IP addresses. Is this something your hosting provider does automatically?

@sorenpeter Looks good, but how come I have to enable JavaScript and cookies to "verify" my request? It doesn't look like Cloudflare.

@lyse Ubuntu was the first distribution I used. I didn't know what I was doing and broke the bootloader trying to do something related to dual booting and I couldn't figure out how to fix it. I went back to Windows after that.

Many still recommend it as a first distribution. While I'm sure it's still well polished and easy to use, I don't like Ubuntu because of Canonical's shady practices in the past and their move toward Snaps instead of Debian-style packages.

SpiralLinux seems like the best of both worlds. I'm really very impressed. If you are looking for a distribution for some one who isn't so technical, but also something easy to fix when it breaks, consider looking into it. Use a different password for root, restrict sudo, mount /home with `noexec`, configure unattended upgrades, and I think it'd be very solid. It is just Debian Stable after all.

First Impressions of SpiralLinux: https://mckinley.cc/blog/20231029.xhtml

@lyse I read this as "files" until I realized that you probably aren't talking about JPEGs of apples.

@prologic They can't win unless they do it cryptographically, i.e. with real DRM. Even then, I think it's still easy enough to extract a Widevine L3 key from an Android phone.

An update on the NTFS situation: I got a reproducible ntfs3-related kernel panic on my server just by reading every file with md5sum on the NTFS I actually want to back up with ntfsclone. It very well could have been related to mounting it partition read-only or using a USB to SATA adapter. I'll try it again another time, probably on a machine that isn't doing anything else important. I don't know if I finally encountered the instability they talk about on Arch or if the ntfs3 driver just isn't there yet. ntfs-3g has been okay for reads in my experience, but I've had issues writing.

@xuu As it turns out, btrfs is very cool. I've always used one big root partition, but getting the advantages of root+home partitions with no downside is just one reason why I'll probably use btrfs on my next OS install. It could be a while, I'm a little sentimental about this one on ext4.

```
$ head -n 1 /var/log/pacman.log
[2021-08-15T21:36:08+0000] [PACMAN] Running 'pacman -r /mnt -Sy --cachedir=/mnt/var/cache/pacman/pkg --noconfirm base linux linux-firmware networkmanager nm-applet i3wm base-devel vim'
```

I don't have this problem :) https://mckinley.cc/blog/20220506.xhtml

I've started working on an update to that post at least 3 times in the past year, maybe now is the time to get it out.

@movq RFC 3339 is where it's at

@darch Thank you, but the first four of those have no license. I only want to include software with a posted free software license on the list. I will add twtxt-php, though.

Everyone: If I'm missing anything on groovy-twtxt please let me know.

It's also an opportunity to mess with btrfs, which I hear is also very cool.

@mckinley I am testing some of the ntfsprogs with the ntfs3 driver on a drive with unimportant data to make sure they can reasonably be expected to do their jobs. Yesterday evening, I started ntfsresize while SSHed from my laptop right before I realized I needed to go somewhere, with my laptop. Usually, I'm pretty good at starting a tmux session before doing something like that, but reptyr saved me and all the data is intact, which is very cool.

@prologic Don't forget https://git.mills.io/mckinley/groovy-twtxt !

@movq It's an e-ink display, which makes it a little more practical from a design perspective, but it's still completely ridiculous.

@prologic In that paragraph, I was comparing it to iOS devices because you cannot install another operating system on them. That is the point of Microsoft® Secure Boot after all.

Another thing about i{Pad,}OS, it's impossible to use it without an online account with the operating system vendor. Windows, of course, is getting increasingly harder to use without a Microsoft account. The goal is clear.

@prologic I wouldn't want to give away my location, now, would I?

@lyse That's already the case where I live. There are also some DMV kiosks in public places, usually grocery stores, and you can renew your registration right there. If I remember correctly, it will even print your updated registration and give you the sticker for your license plate so you don't have to wait for the mail.

That article links to this one.

So, you buy a new computer for $800 and you have to pay a subscription just to use it? There's no doubt the subscription will start out optional, but if things continue the way they're going we will get there. When that day comes, the general public will get out their credit cards and do what the computer says. I have no faith whatsoever that they won't.

Of course, by that time, I imagine you won't be able to turn off Secure Boot or enroll your own keys on most computers, making your computer an appliance completely owned by Microsoft, just like an iPad is completely owned by Apple.

@lyse The thing is, if it didn't connect to the Internet on its own, it would be basically fine. You could make a device like this that communicates directly with an app on your phone. The app would spy on you, I'm sure, but just about all of the user-facing features I can see could be done in the app alone and the plate could be updated over Bluetooth or something. You could prevent people from incorrectly changing their registration year or plate number with cryptographic signatures from either Reviver or the DMV, which I hope they're doing already.

Of course, on a phone, you have all those pesky permissions that people can turn off.

@movq Yes, you can only get a number in the US or Canada for now.

@mckinley I figured it out: Digital License Plates Considered Harmful

Wireguard is incredible.

I have an old smartphone but it doesn't leave my house. I plan to switch to jmp.chat soon and start using my laptop instead.

@movq Maybe you just got better at the game. I hope 2005 isn't considered "retro" yet.

@abucci If Google is suggesting you do something, it's probably a good idea to do the opposite.

@prologic It's more likely that someone gets unauthorized access to your computer and deletes your account through the web UI. You should probably have to type in your password to delete your account.

@stigatle I don't have anything to report. I was wondering if anyone was having a more interesting weekend. Is a busy weekend an interesting one?

@darch Maybe I don't have the right idea of what lists are. Why do they need to be in a user's public feed in the first place? I thought it was just a function of Yarn as a twtxt client that would allow one to sort their followed feeds into lists to make it easier to digest your timeline.

@darch So, the format is based on the metadata extension? Why not just `$NICK\t$URL\n`?

@abucci I'm glad it's not just me.

@lyse I will occasionally get some command (or even certain arguments for a command) in muscle memory and type it by accident instead of the one I want. It hasn't been disastrous yet, but it has cost me some time.

I also find that I compulsively type 'ls' whenever I'm in a terminal, even if I don't need it. It's strange.

I've been using Grim to take my screenshots on Sway since I started using it in April 2022 and I don't recall giving it explicit permission to do so. This issue suggests Sway doesn't yet support restricting screencopy.

@adi Huh, you're right. I never thought about that.

@adi I see where you're coming from. There is something to completely understanding a piece of software, reading all the documentation, and writing a config file by hand. However, if you aren't doing it as a hobby project and you aren't being paid a lot of money to do it "right" I definitely see the appeal of Docker. I started using it for some of the more annoying software packages when I set up my home server.

@prologic There's always Jabber :)

@abucci Thank you very much. I am paying an absurd amount to my current phone provider and it's time to start considering other options.

I came up with a few more questions.

1. Are you hosting your Jabber server yourself or are you using the hosted Snikket instance?
2. Does group texting work? The FAQ says it's in beta. If so, how does it work? Is it just an MUC?

If any other JMP users see this, please chime in.

This is the best way in my opinion, at least for small children. I wouldn't trust any of the Algorithms with my children.

@prologic Discord is awful and it's a tragedy that so much information that used to be readily accessible on forums is now locked in a Discord group.

@prologic Protocols using TLS could probably share ports via SNI multiplexing. If you're using a plain text protocol or can't use SNI for some reason, you might have the option to get exclusive use of a random port for an extra fee. You could maybe even request specific ports for a larger fee on a first come, first serve basis. One IPv4 address can go a long way.

Virtual hosting is another reason why it's so cheap to run my website. NFS puts dozens of websites on each IPv4 address.

@prologic I had to do some research for this one. The answer is yes, in theory, as long as the client or server supports XEP-0368. However, this seems like the kind of thing that would be skipped by lazy implementations. I would be interested to see how this looks in practice.

SRV records are used in the XMPP core specification to determine the domain and port to which clients and servers (for s2s connections) should connect. XEP-0368 is an extension to the spec detailing how servers and clients should handle SRV records in relation to TLS connections. It says that the "Client or server MUST set SNI TLS extension to the JID's domain part."

As an aside, SRV records alone can be used, in theory, to change the default port used in c2s or s2s connections. If the ports were assigned randomly from the hosting provider, they could be specified in the SRV records and everything would hopefully just work. Again, I don't know how well this is supported in practice.

I might have a use for something like this right now, actually. I want to set up an XMPP server for a few people without giving out my home IP address. It would probably handle 20 messages per day on average. I really don't have a use for a VPS beyond this and I would be paying for a lot more than I need.

How will ports be allocated? Web traffic can go through a reverse proxy to share ports 80 and 443, but what about other protocols? Will it be possible to request specific ports like 5222 and 5269 for XMPP?

@prologic I'm glad I could help. You're working on a service similar to NearlyFreeSpeech in its usage-based pricing model but built around docker containers instead? It seems very useful. How will you handle payment? Will there be privacy-friendly options like Monero or cash-by-mail?

To get such a low price, I am forgoing the ability to open a private support ticket. Any questions I've ever had were answered by the very thorough FAQ, but if one wanted that ability they could pay an additional $5 per month for a subscription membership.

I would also like to add that their entire Web portal works without JavaScript and it has all the features you would expect and more.

@prologic I am on the "Non-Production Site" plan with NearlyFreeSpeech which means I'm limited to 1 GiB per day of bandwidth and am occasionally subjected to "low-risk tests and betas". The implication is that there may be downtime on my site but I haven't noticed any since April of 2020 when I began hosting with them. It's 1 cent per day as a base cost for that plan.

I also pay $1 per gigabyte-month for storage and I am using 9.29 MiB which means I pay a little less than one cent per month. It used to be even less than that, but since I started using Git the complete Git history is stored on the server as well as the live copy of the site.

There is an additional charge of 1 cent per 44.64 "RAUs", their measurement combining CPU and memory usage over time. On the Non-Production plan, only resources used by processes other than the Web server are counted. I don't believe I have ever been charged for this.

Here is my billing report for 2023 so far.

@prologic They clearly have no line. I'm asking the reader where *his* line is. Many people realize that Microsoft and friends are poison but choose to stick with them anyway for various reasons. I was there, too. It's not a sustainable position.

@mckinley I had a few more words to say about this: How Microsoft's Trickery Works

@prx Nice, but I usually use https://icanhazip.com/ because it's the only one I can remember.

@movq That memory usage rivals Electron, which runs an instance of Chromium for each program. What do you need shaders for, and why can't you turn them off?

@lyse I agree with you. I don't think PDF is the right tool for the job, but it's an interesting experiment. Even the homepage of lab6.com used to be a PDF.

@movq I use https://www.html-tidy.org/

@lyse I could probably get away with HTML 3.2. I think HTML 2 is much more limited, though, and I'd be forgoing CSS.

@lyse Lab6 always delivers. You should check out some of their previous issues if you haven't already. https://lab6.com/

@movq Thank you, I'll have to follow your phlog's Atom feed. I see you're using `tag` URIs, nice. :)

That looks like a good system. Simple and effective. I ask because my current backup system is lacking and I'd like to do something about that. I don't want to use cloud storage, so I'll be moving hard drives around. I'm just not sure on what to do on the software side.

Solutions like Restic and Borg have many advantages, but the disadvantage is that your data is confined to that particular tool. I think I'm willing to make that trade to have snapshots, compression, deduplication, etc. I'm just on the fence about which one I should use.

@prologic, why did you choose Restic? How do you like it so far? If you've had to restore from the backup, what was that like?

@movq I reworked the paragraph about security and improved that sentence. Hopefully it's a little more clear.

> However, the key on the unencrypted partition is only valid for the time it takes to reboot, assuming we reboot as soon as the script completes.

@movq I get it. I wouldn't set this up for anyone else. Systems that are on all the time don't benefit as much from at-rest encryption, anyway. This is definitely an interesting solution, however, and it has worked well for me in the past 1-2 weeks. We'll see how it goes in 1-2 years.

@lyse I didn't know about `fc` either. It will definitely come in handy.

@movq You can also do `sudo !!` (or `doas !!`) if you're using Bash.

@news I guess the electric companies are the same everywhere.

@adi I remember talking about it, but I can't find a link to a tool in my bookmarks or my twtxt feeds. Sorry, man. Look up "vanity QR codes".

@prologic I have thought briefly about this. I have no idea how this could be done with the current twtxt thread paradigm.

@prologic It's significantly cheaper to open an exchange and get people to hold their money in a custodial wallet than it is to perform a 51% attack on an established cryptocurrency.

Monero in particular uses an algorithm that's supposed to be ASIC resistant and, while it can be mined on a GPU, it's more efficient to mine on a CPU. I'm curious if that makes it easier or harder for a hostile entity to perform a 51% attack.

Oh, I just saw the other thread. Don't put your *wallet* on the VPS unless you have a specific reason to do so. If you do, make sure your keys are stored on a local machine. It's fine to run a node there, but run the wallet locally and configure it to use your node if you can.

@adi Surely you can configure the wallet to use a remote node. I've heard good things about Feather Wallet if you want something friendlier. https://github.com/feather-wallet/feather

I'm worried that Yarn will become just another ActivityPub frontend. This integration threatens to split the community in two. Users of Twtxt clients without ActivityPub support won't want to follow Yarn users because they'll be engaged in conversations that are inaccessible to standard Twtxt clients. It will only force the split deeper if ActivityPub is an option to be toggled by users or pod operators.

@slashdot Tying all your Internet traffic to a Google account... What could go wrong?

@lyse You should; it's worse than you think.

@slashdot This is a very interesting tech demo, but I'll stick with human-made TV shows.

@logout I've been reading that blog for some time. I didn't know you were the one behind it. Excellent post!

@prologic I don't know where it came from originally, but it's absolutely true.

@abucci It does, but keepassxc-cli makes you type in your passphrase for literally every operation, with no way to cache it like gpg-agent does.

@eaplmx I'm using KeePassXC at the moment. I want to move to something in the terminal. Thinking of migrating to pass/pass-tomb. Anyone here have experience with that? How do you like it?

@xuu Twtxt.net has 58 going all the way back to the hello world twt. I wonder why your pod isn't picking up all those twts in between.

@win0error Looks very interesting. Is this a recreation of the original client in C?

I compiled it and followed you, but whenever I run `./twtwt timeline` it requests my followed feeds in an infinite loop. I didn't realize until I sent, probably, 150 requests, so I'm very sorry for clogging up your logs. `./twtwt view win0error` works fine.

@dima1986148 ESL or ARG?

@carsten Link? yt-dlp supports nearly 2000 sites. I'm sure you could stitch something together, perhaps with ratt and a cron job.

@xuu @prologic This looks very similar to #957.

@bender I do wish there was a TUI client but it only took a minute or so to build gtkatlantic on my system.

@darch Looks fine over on twtxt.net

@lyse As far as I know, they're still visible in the Web UI. Although, in the mobile app and youtube.com, I believe it tells you that the video isn't available without having to click on it. They don't tell you that in the RSS feed, and I agree; it gets annoying.

If we had a custom feed generator that hooks directly into the YouTube API, I'll bet we could find that information and put "[Scheduled][Scheduled=][Scheduled][Scheduled=][Scheduled][Scheduled=][Scheduled][Scheduled=]" in the title for premieres and remove it when the video is available.

@prologic Why are you questioning it? Apple knows best. You're lucky they let you use their computer at all.

@movq In time...

@abucci I disagree. I think the "modern" definition of the word has a place here. An individual exercising his power over you on a platform to suppress you, not because you've violated any sort of rule, but because he doesn't like what you say, is at least an attempt at censorship. What would you call that?

If there was a rule that you've broken, then it's content moderation. A separate discussion can be had over whether or not that rule is just.

Fortunately, twtxt is very difficult to suppress completely. As long as I can still put a text file somewhere for people to download, I can still post.

I just realized that whole thing started with this thread. How did a post sharing a dial-in firework service in the terminal become a 5-fork-deep conversation about censorship on the Internet?

@prologic Open registrations should be an option for pod admins. I would like to see a per-pod invite system, though.

@abucci Of course you can censor people without being a nation-state. It's just a question of power. If @prologic decided he didn't like what I have to say, he could add a line to the code of yarnd that automatically hides posts on all pods if it came from me. Would that not be censorship?

@abucci An NPC would be programmed to find these ideas dangerous. Hmm...

@prologic I fully agree, but my thoughts on this are a little long for a twt.

Apple doesn't care about you: https://mckinley.cc/notes/20221229-apple-doesnt-care.html

@prologic

> Should we go for multi-user and org/user? Or keep it simple?

I really don't know which would be better.

You would need user accounts for issues and to facilitate collaboration, unless you used e-mail, which isn't really a bad thing. The SourceHut model works very well.

No matter what, I would love to be able to archive issues using Git alone. You were talking about integrating git-bug or something similar, and I think that's an excellent idea.

@prologic #1106. This is probably the most strange bug I've found.

Interesting... I'll open an issue.

Test

```
@prologic, @prologic@twtxt.net, @prologic. @prologic@twtxt.net. @prologic, @prologic.
```

@prologic, @prologic, @prologic. @prologic. @prologic, @prologic.

More specifically: Will this be expanded into something like Gitea with the concept of users and organizations, or will it stay with a simple flat repository model like upstream legit or cgit?

Also, the shorthand mention syntax has struck again. Apologies, @justamoment.

I would personally love to see the Git log provided as a twtxt feed. Gitea's feed situation is still awful. I don't think anybody skimmed the Atom spec before they released the feature.

@justamoment I don't even have Web server logs enabled.

I love mitmproxy. That and nethogs are my go-to network monitoring tools.

@lyse There's also the ed(1) cloud service, `ssh ed@bitreich.org`.

@prologic Because all of those things require resources which can't just be created out of thin air. Human effort must be expended, risk must be taken, materials must be procured, and everyone involved needs to be compensated in some way for that.

@justamoment That's awesome!

@prologic I imagine it's something along the lines of the Eternal September.

@movq This is computing, we don't get rid of historical baggage.

B.

As you've said, @prologic, it's impossible to monopolize twtxt because it's just a text file format. Also, Yarnd is under the AGPL, so anyone is free to fork it if they don't like where the project is going. Fortunately, it's under great leadership and development is steered more by the community than the owner of the repository.

Don't let it get to you, man. Interoperability with vanilla twtxt is the best feature of Yarn, and it's not worth breaking that because of one person. Besides, you won't win him over even if you do.

Who's going to tell him that the metadata fields are a Yarn extension?

@Jirka You can't just post something like that without giving us any details or pictures...

Are you running IRIX on the SGIs?

@prologic You could just point people directly to yarn.social. That could be a very effective guerrilla marketing campaign.

@abucci QR codes and link shorteners can be useful, but people have been *trained* to click and scan things without doing their due diligence. Of course, mobile operating systems make it very difficult to do so because their goal is to remove as much control as is acceptable by the user.

As far as I know, you have to load the page in a browser before you can see the entire URL, giving it the opportunity to redirect somewhere else or exploit some vulnerability on your device.

I think we agree here. When the user has no control and is taught to blindly trust these things, bad things happen.

@marado We really need to stop using link shorteners and QR codes, but the damage is already done.

You can put a sticker with a QR code (and no other information) on a wall in a city and people will scan it out of curiosity. They scan it, their iPhone only tells them it goes to snapchat.com (I just checked on the latest version of iOS), and they end up on my website instead because it's an open redirect.

Granted, my website is a much better place to be than snapchat.com, but you get the idea.

@prologic I'm just joking around. It doesn't really matter to me.

@prologic This is completely accurate.

@prologic This feed is the live chat over at gopher://magical.fish/. Anyone can post to it by participating in chat, and there's no mechanism to view replies from external feeds.

@lyse The 23rd? Why even bother with a tree at that point? We would usually have one about a week into December. They last much longer if you have one of those tree bases with a water reservoir.

That's interesting, we don't follow that procedure over here. The tree goes up, presents sit under it. As a child, I got to open presents from extended family members the night of Christmas Eve. Then, presents from Santa on Christmas morning and a big dinner that night. In my family, we'd have Thanksgiving dinner (turkey, stuffing, mashed potatoes, cranberry sauce, etc) again because none of us really liked ham, which was the most popular choice of entree.

@movq @bender This isn't uncommon in the US. In my house, there were always some presents under the tree well before Christmas. There were some for my parents from each other, or for me from other family members, but there were usually one or two for me from my parents, labeled as such. On Christmas morning, Santa would bring most of my presents.

@prologic Shoot, my bad. It totally slipped my mind. I'll see you next week.

@logout

> doesn’t run Windows, just Linux

I'd consider this a feature, not a bug, but I'm glad you got it to work in the end. Where did you get the CPU and board?

@kt84 City Planner Plays is a real urban planner that plays city building games using real-life concepts, teaching the viewers about them along the way. It's very addictive, and educational too.

I would recommend starting at the beginning of one of the cities (the videos are organized in YouTube playlists). Verde Beach is my personal favorite, but you can take your pick. It's extremely gratifying to watch a city grow from the ground up.

@prologic I appreciate it, but there's really nothing to "get involved" with at the moment. It's just a shell script on my laptop that I run every day and a ~5GiB directory on my SSD. It isn't a big deal, I just talk about it because I think it's interesting and I'm having fun tinkering with it.

Eventually, I'll make the script public so anyone can easily maintain archives. There's still a lot I want to do before that, though.

@prologic Git itself is a distributed network of mirrors. It's impossible to truly kill a Git repository as long as someone still has a clone of it on their computer.

However, simple clones are inefficient on disk space and a simple `git fetch` will happily obliterate its history if the remote says so.

My goals are as follows.

1. Create high quality archives of a large number of repositories and keep them up to date.
2. Make them resilient against attacks from the inside, including (but not limited to) force-pushing an empty history and maliciously deleting branches on the remote.
3. Minimize storage and bandwidth usage, including (but not limited to) running `git gc --aggressive` when cloning and not fetching unnecessary commits, e.g. Dependabot and pull requests.

@prologic No, it's just private for now. I'll share individual repositories when they get nuked, of course. I'm open to the idea of making them publicly available, though.

I wonder if I could push to a Git remote with my current setup. That would be the simplest way to do public distribution *and* remote backups.

Also, Portal 64 kept freezing on me so I played F-Zero X instead.

@ocdtrekkie A lot of my repositories are on the list specifically to guard against BS takedown requests like when youtube-dl was DMCA'd. I started the project when I discovered Wikiless was taken down, so I have just about all of the popular self-hosted frontends as well.

Portal64 looks interesting, I haven't heard about it. I might need to get an N64 emulator going.

@prologic I haven't had any new problems. I've run into #957 a few times, but that's about it.

@ocdtrekkie I track a lot of repositories with a risk of becoming unavailable for whatever reason. The script tracks how many times in a row Git fails to fetch updates, so I can tell when a remote dies.

However, since it's so easy to add new ones, it's mostly repositories which aren't likely to disappear but carry a lot of value. For example, 143 MiB on my hard drive for the complete history of FFmpeg is a no-brainer for me.

@prologic It's a U+202E Right-to-Left Override.

@movq, I'm glad it only broke your client a little bit. Yarnd seems to have handled it pretty well.

@prologic All the way at the bottom. It's tied for 6th place with 1 repository archived.

@mckinley If you're curious, here are the top 5 domains.

```
106 github.com
15 codeberg.org
7 gitlab.com
7 git.codemadness.org
4 bitreich.org
```

@tkanos I like to ask the same question about PRISM. Just look at the reach the NSA had in 2013: #The_slides">https://en.wikipedia.org/wiki/PRISM#The_slides

Boy, I wonder what they're doing with the massive Utah Data Center which was completed in 2014.

!Slide showing that much of the world's communications flow through the U.S.

@bender No, it was known, but if you talked about it you were a Racist Spreader of Misinformation and needed to have a disclaimer below the post saying so.

@bender I've committed the cardinal sin of the Internet: Linking to a website with a conservative bias. At least they're open about it.

@marado I guess it's that time of the year again, huh?

@tkanos @abucci

> The biggest question is what is “misinformation”, I believe the answer change according your beliefs.

Exactly. I remember when it was an insane, racist conspiracy theory that COVID-19 leaked from the Wuhan lab, now it's right there on Wikipedia.

Conversely, do you remember that study from Imperial College that projected 2.2 million deaths from COVID in the US alone? Total misinformation.

@abucci

> Misinformation purveyors have very detailed strategies for how to draw unsuspecting people into an echo chamber and keep them there.

I'd say a pretty good way to get people into an echo chamber is to force them into their own space where their ideas get no pushback at all.

@eaplmx This is really cool. It works great without JavaScript, too.

To make the amount of options less confusing, how about putting each day into an HTML details element? Also, is the source available yet?

@logout Very cool :)

I have a Dual 2GHz G5 in storage. I wanted to set it up with a modern OS and have a usable non-x86 machine, but I don't have much time to tinker nowadays.

@logout I see. I misunderstood your post. You're talking about emulating PowerPC Windows, not emulating Windows on PowerPC. Congrats on getting it running on actual hardware.

Did you run Leopard for all that time on your G5?

@logout Windows can run on QEMU on Apple PowerPC machines, but I think you need a G5 Quad for it to be even remotely usable. Here's Windows 7 on a dual PowerPC G5. I've seen QEMU running Windows on a G5 with GNU/Linux as the host OS as well.

Microsoft also had their Virtual PC software for PowerPC Macs.

@akoizumi I can relate.

@prologic I thought we were punctuating our posts with the names of programming languages, since you said "Go!"

PHP!

@prologic I agree. Lua!

@prologic Here, I'll paraphrase the README for you.

a modern decentralized semantic web built atop self-sovereign identity

more information chatternet.github.io [Editor's note: 404][Editor's note: 404=][Editor's note: 404][Editor's note: 404=][Editor's note: 404][Editor's note: 404=][Editor's note: 404][Editor's note: 404=]

- Open
- Decentralized
- Self-moderating

a web of self-signed semantic documents.

Activity Pub protocol federated platforms Mastodon

self-signed data model

- No de-platforming
- No platform lock-in
- No spam from arbitrary users

a semantic, self-describing JSON data format

public-private key pair cryptography

does not rely on a specific network stack or protocol

```
wget | bash
```

```
npm install
```

Typescript

@abucci Wow, that's really cool. How is the actual data stored?

@eaplmx

> Now I can’t play either CDs or LPs since I don’t have a player.

Sure, but you still *own* that music. You can buy a player at any time and play them. You can take them to a friend's house and play them there. You can even rip all your albums to digital files and copy them to your flash modded iPod.

In terms of durability, both CDs (pressed, not burned) and LPs will last a long time if you take care of them.

Youtube, Spotify, and Amazon offer convenience, but that convenience comes at the cost of your freedom. You are not permitted to do what you want with the content you paid for. You must also understand that you **will** lose access to that content at some time, occasionally without warning, and that time may be closer than you think.

The best of both worlds are DRM-free marketplaces like Qobuz, Gogs, and HDtracks.

@darch @abucci https://xkcd.com/2365/

@prologic

> are there other examples?

Python, Ruby, Perl, Rust. Sometimes even Go. There's a little bit of this in every language with an official package manager. I'd say Python and NodeJS are the worst offenders, though.

> I feel like I pick on NodeJS / NPM too much

I don't think we pick on NodeJS/NPM *enough*.

@prologic

> “dependency hell” comes from this “exponential dependency tree” that we inevitably see in ecosystems like NodeJS / NPM

Yes, and these "ecosystems" try to put a band-aid on it by allowing packages to specify which *version* of a package they need. All that means is you get 7 different versions of the same package bloating up your node_modules folder and 6 critical vulnerabilities from one package.

Then, it's impossible to keep track of all 1200 of your dependencies and sub-dependencies, so you get a robot to do it for you: Dependabot. What happens when Dependabot dies? Absolute chaos.

NodeJS library authors could just write better libraries and avoid breaking changes every update, and NodeJS software developers in general could fix their programs when they break, but they don't. It's on the "ecosystem" to solve for this, and it inevitably does a terrible job.

@eaplmx There can't be a concrete rule for this sort of thing. I'm generally in favor of reinventing the wheel to certain extent, but using a library can be very useful if you want to focus on the end result.

When your 5 dependencies each have 5 dependencies of their own, then you have a problem.

@prologic All I know is, this problem is much less prevalent in languages without official package managers, like C or Lua.

@lyse Ah, it's always something. I'm glad I used a tag URI for the identifier. :)

Oh wait, it does. There just isn't one for 520 yet.

@justamoment I wish https://http.cat/ included nonstandard status codes.

@prologic Yes. It's some sketchy custodial cryptocurrency wallet/gambling/crypto theft platform.

@markwylde No, it doesn't *have* to be this way, but it is (almost) always this way. When a programming language makes it too easy to manage dependencies, you inevitably get microdependencies. It doesn't help that many people learn JavaScript or Python as their first language.

@support @prologic Robot detected

@prologic This is why I contain all node.js activities in an Alpine Linux chroot that I can nuke when I'm done.

@ocdtrekkie Agreed. I still think it should be on Spyware Watchdog.

@akoizumi It's also proprietary.

@axodys, when you get access, do you think you could share what sorts of unsolicited network requests it makes?

@eaplmx A leaf fell in Australia so @prologic's Internet connection died for a few minutes.

@eaplmx I had to look up some of the details on the iPod Wiki. :)

@eaplmx The 5th gen is much easier to work on than the 6th and 7th gen iPods. With those newer units, it's almost impossible to avoid ruining the back plate when opening it up. For those, you'll want to have a spare back plate before you start.

@xuu Only the 1st gen iPod had the scroll wheel. The 2nd and 3rd gen had a touch-sensitive wheel with separate buttons. The clickwheel (touch-sensitive wheel with integrated buttons) was introduced for the Mini and was used in all the main line iPods from the 4th generation on.

@eaplmx The old classic iPods are great. They're repairable, modifiable, and they sound great too. Not at all like modern Apple devices. You can replace the spinning hard drive with flash storage, with capacities up to 2 TB on a 7th gen.

They can even run a free operating system, allowing you to drag and drop music files onto the iPod (without iTunes) and play many different file formats. I use a 5th gen myself.

@prologic The issue was open for 30 minutes and 56 seconds.

@prologic Look at that turnaround time! Elon Musk would be pleased. Thank you, man.

@thecanine Yeah, I also noticed that. Here's version 3. It should be a little more accurate now.



Fosscord doesn't count.

@prologic Yes, definitely a bug. I just opened #1073 with the details.

@prologic No, it was a bug and I got halfway through the bug report before I realized the twts actually went through.

@akoizumi Agreed. I'd prefer UseMod.

If things really are that bad over at Twitter, I wish it was TikTok instead.

@abucci Here, I fixed it.

@kt84 Your friend just gave it to you? Those things usually cost some livestock. A cow, at least.

@justamoment https://www.youtube.com/watch?v=ojatBoMZubk

3 accounts in 3 minutes... Seems legit.

@prologic

> So I think the PR to add support for Twtxt to Mastodon is probably not going to happen by the looks of it

That's not what I got from reading that thread. I think it's more than possible that we'll see outbound integration with twtxt. Kudos to Jeremy Potter for submitting that patch. He seems to have deleted his account on twtxt.net so I can't mention him properly.

As for inbound integration, I think a self-hosted bridge, independent from yarnd or any ActivityPub implementation, is the way to go.

@prologic Just append `.rss` to the profile URL, e.g. `https://mastodon.example.com/@activitypubrocks45.rss`

@prologic I believe you mentioned me here because of my twt from earlier (#pfmeyva) and I wanted to clarify my position.

> your fears/worries about the “growth” may suddenly just hit us hard

I'm not afraid of the network growing, I'm actually very excited to see it grow. My concern was with keeping *my* real-life and online identities separate.

@prologic I think this is great. I'm excited to see the network grow because I believe in twtxt as an alternative to Twitter and the rest of them.

My concern from that thread was about mixing public and private identities because the network is still quite small.

@prologic Yes, they said they intend to do so, but it doesn't matter what they say.

Proprietary software claiming to “protect your privacy” cannot and should not be trusted.

@prologic The mobile browsers are both free software, but the Mac OS browser is currently proprietary.

> We plan to open source our Mac app after the beta period, like we’ve done for our iOS & Android app, and many of our built-in privacy protections are already open sourced.

https://spreadprivacy.com/introducing-duckduckgo-for-mac/

@carsten

> why not? What is wrong about that browser?

It's proprietary and DuckDuckGo has had a sketchy past.

@darch There's an atom feed: https://mckinley.cc/notes/atom.xml

@prologic, I announced it in the beginning on my main feed but I haven't been announcing each individual post. I think I will from now on.

@prologic Twtxt is anti-social social media.

I don't want to bring people here, at least those I know in real life, because I try to separate my real identity from my online identity.

This will change when the network grows bigger and there's a larger anonymity set, for lack of a better term.

Like @lyse said, this is an extremely selfish reason, but it is my reason.

@justamoment What about a Mumble server?

@eaplmx That's awesome! Is it just a page generator like mine or does it have its own Web server?

Coincidentally, my time table generator was the first useful thing I wrote in C.

@prologic That works for me, I can't make it right now.

@markwylde If I recall, the twt retention on Yarn is time-based and it can be changed by the operator of the pod.

As for @prologic's feed, it's using the Archive Feeds extension to cut down on file size.

@carsten It's just a little C program and all the offsets are hard-coded, nothing fancy.

What about Saturday 21:00 or 22:00 UTC? @prologic and @darch, could that work? You two would have the earliest and latest local times, respectively.

It would be midday here in the US, but I have the day off on Saturday. Not sure about @ocdtrekkie.

I feel like it's even harder to find a good time for everyone now that daylight savings is over. What are we doing today?

@eaplmx Thank you, but it's really nothing special. Just a C program (formerly a shell script) and all the offsets are hard-coded. It does the job, though.

@movq As far as I can tell, the duplicated effort is lessened by using an intermediate library like wlroots.

> Pluggable, composable, unopinionated modules for building a Wayland compositor; or about 60,000 lines of code you were going to write anyway.

I agree; the lack of hackability in Wayland is very unfortunate.

@prologic 00:00 UTC is a little early for me. 02:00 up to about 07:00 would work. US and Europe are off of daylight savings now, so I updated my time table.

@lyse

> Unfortunately, the reasoning behind rel="self" remains a mystery.

I don't know where it would be useful, either. I have one in each of my Atom feeds for the same reason. It's a Chesterton's Fence situation for me. It's not doing any harm, and the W3C says it should be there, so I put it there.

@lyse Sorry... :)

I'll use proper syntax from now on.

@lyse

> I always want my URL also to be my ID, so I have to duplicate that – unnecessarily in my opinion.

Interesting. I understand what you're saying, but I find the duplicated functionality of the RSS `` to be confusing. I think it would make more sense if the roles were reversed: use the `` as the ID if there's no `` and never use the `` as a permalink. Bonus points if a `` is required if a `` is not present.

Actually, when doing research for this post, I stumbled upon this blog post: How to make a good ID in Atom

I have no idea how I ended up at a blog post from 2004 that hasn't been online since 2011, but I did. Regardless, he has a point. I had never heard of tag URIs before. I think I'll start using them.

@marado As far as I can tell, the #page-6">spec only provides relative link resolution through the xml:base attribute.

> Any element defined by this specification MAY have an xml:base attribute...When xml:base is used in an Atom Document, it [establishes][establishes=][establishes][establishes=][establishes][establishes=][establishes][establishes=] the base URI (or IRI) for resolving any relative references found within the effective scope of the xml:base attribute.

This is #page-22">all it has to say on `rel="self"`:

> The value "self" signifies that the IRI in the value of the href attribute identifies a resource equivalent to the containing element.

@prologic Also:

> A new sidebar design in System Settings — instantly familiar to iPhone and iPad users — makes it easier than ever to navigate settings and configure your Mac.

Let me fix that.

> We moved all the settings because we're trying to make our desktop operating system as terrible as our mobile operating system. Good luck trying to find anything, cattle!

Alright, I promise I'm done now.

@prologic

I skimmed through that page, and one thing stood out to me above everything else.

> Simply bring iPhone close to your Mac and it automatically switches to iPhone as the camera input. And it works wirelessly, so there’s nothing to plug in.

By default? That seems like **extremely undesirable behavior**.

@akoizumi What is that?

@prologic I'd like to write about twtxt at some point but I'm not very familiar with Mastodon and ActivityPub. Maybe you should write that one :)

@prologic Why not just have a Raspberry Pi or something with an external hard drive holding all your Linux ISOs, and connect that directly to the display? Then, it could run Kodi or Jellyfin on that display. It should also be able to start up a Wi-Fi network for streaming on other devices.

Plex might be able to do this, but I'm not sure how much they insist on handling authentication on their servers.

@prologic All I can say is that it's starting to get really difficult to read *every twt* in the Discover feed.

@marado Well said!

@prologic Here's the list and the relevant lines in .bashrc are just

```
alias theo='shuf -n 1 ~/Documents/theo.txt'
echo " $(theo)"
```

I didn't make the list myself and I can't remember where I found it.

```
Who do you work for? Governments?
```

I also have a shell alias.

```
[mckinley@t430 ~]$ theo
Your emails only contain opinions.
```

@prologic Of course it is, it's Theo. I have a list of snarky responses of his from the mailing list and every time I open a terminal it prints a random one.

```
Come on guys. Don't have me OK this.
[mckinley@t430 ~]$
```

@nmke-de I've been wanting to write about this in a formal manner. I'll try to get a post out about it today on mckinley.cc.

Spoiler: Atom is better.

@carsten Proprietary software claiming to "protect your privacy" cannot and should not be trusted.

@prologic You should probably get that checked out...

I was the king of Wii Sports Resort table tennis and I'm good at air hockey. I've never tried real table tennis, but I think I could be pretty good. :)

@prologic No problem, good luck today man.

@lyse I already launch MPV directly from Newsboat. If you pass a URL at the command line, it will use stream it with yt-dlp.

After I update my feeds, I do a lot of manual filtering, marking videos I don't want to watch as read. This would stop the cache system from downloading or storing videos I don't want to watch.

> This program, that downloads all required videos found in Newsboat’s SQLite database and removes them once marked read, that would be a cronjob? No user interaction required, did I get this right?

It could definitely be a cron job, but I think I'd rather have it as a hotkey in my window manager. That way, I could run a video cache update after I'm done marking unwanted videos as read. Other than that, there would be no interaction required.

@lyse That was a very interesting read. It's fun to compare my setup to others.

I'll bet it's nice to have an offline copy of your videos. I've been thinking about a program that interfaces with Newsboat's database directly, getting the URLs of all unread articles with a specific tag.

When it runs, it would queue new videos for download with yt-dlp and delete any videos in the cache directory that I've marked read in Newsboat. From there, I'd just need a wrapper script to look for the video in the local cache before letting MPV stream it.

I was working on a prototype of this system a few weeks ago, but my implementation was just too hacky and I got sidetracked.

Also, what program are you using for the syntax highlighting in the article? I've been thinking of doing that for my site.

@eaplmx Dark, unless I'm reading a long article or some technical documentation. It's easier for me to read dark-on-light.

If it's anything really long like a book, I'd prefer a printed copy.

@iolfree As soon as they let the sink in, you could go to https://twitter.com/ and browse without being signed in. Previously, it was just a login page.

* 2022-10-25: https://archive.ph/q7b4J
* 2022-10-29: https://archive.ph/RoFt2

I think Nitter is fine. It has a ton of public instances and a relatively active development community. The number of public instances show that there's a lot of demand.

@abucci Fascinating stuff. What is this simulation primarily used for?

@lyse Oh, nice! I'll check it out later, looks like an interesting read.

@lyse You're right, I copied the last note for the boilerplate and I forgot to change the date. It's fixed now.

The `Last-Modified` header probably accounts for the time it took in between setting the timestamp in the Atom feed and pushing the changes to the Web server.

@carsten, what's wrong with the RSS feed?

@prologic Sounds extremely frustrating. Is there any weird corporate spyware on there?

@eaplmx Yes, there's a organization-wide feed at https://git.mills.io/yarnsocial.rss. The Gitea RSS integration is totally broken, but it at least lets me know when there are updates.

There's a repository feed at https://git.mills.io/yarnsocial/yarn.rss but it's even *more* broken.

@cobra It's crazy, isn't it?

@eaplmx I keep seeing your name pop up in the RSS feed. Good work, man.

@abucci Interesting. Can you tell us more?

This can be mitigated under normal circumstances by assigning branches to the dangling commits before they're removed by Git's garbage collection.

However, this sort of malicious forced push can still cause a lot of damage, some of which can be very difficult to repair. It's better for archival purposes to make a full backup and then pull in the updates. A human can sort it out from there.

@eaplmx Thanks for letting me know. It's easy to forget about topping up your account when you're paying 1 cent per day. :)

It's back up now.

@abucci Welcome to the Walled Garden.

@prologic It's not something I feel strongly about at all, I was just using it as an example. I like Gron a lot, actually.

Also, because it's so annoying to manage dependencies with C and C++, there are often flags you can set to disable functionality related to a dependency if you don't need it.

Gron has no such option. Apparently there is no reason why you *wouldn't* want a text processing program to make network requests.

As a user of programs, it makes me groan to see a program written in anything but C or C++. In just about every other language, it's too easy to manage dependencies, and two problems arise.

1. Microdependencies
2. Feature creep because you can do *x* in 3 lines of code by adding this giant dependency. (Why does gron need HTTP download support?)

I'm sure there are a lot of old accounts you could delete that have never made any contributions, but that information isn't trivial to get from the API endpoints to which I have access.

@prologic There's no script, it was mostly a manual process. I used jq, gron, grep, and awk to present the information in a reasonable way, then manually checked any accounts that looked suspicious. I looked at user descriptions, user URLs, and repositories.

It wasn't difficult to go through the data by hand after it was filtered a bit.

There are 195 registered users, only a handful of which have specified a description or URL.

There are 203 non-fork repositories, but only 27 of them are owned by entities other than `prologic`, `yarnsocial`, and `saltyim`. That `prologic` guy alone accounts for 152 of them.

@eaplmx There's always Usenet :)

On an unrelated note, I just thought of a great idea for a twtxt bot. :)

@ocdtrekkie I am part of the 81%.

@prologic

```
$ curl https://raw.githubusercontent.com/answerdev/answer/main/go.mod | grep -c '^

I also use doas btw

@prologic

> "Delete and Redirect"

That's a great idea.

@abucci This is a very important ongoing discussion that must be had. I'm glad we all agree more than we disagree.

@prologic

> I honestly think the best way to handle this as we grow/scale with more pods in the Yarn.social network is to just build up a strong positive community and just have a “zero tolerance” attitude towards abuse and just nuke offending feeds/accounts without question.

I personally disagree with this moderation policy, but it's your right to enforce your rules as you see fit.

Perhaps there should be some kind of grace period, where anyone can download the contents of a "deleted" feed for *n* days before it gets removed entirely. That way, the user has the opportunity to download his feed and move it somewhere else and his followers have the opportunity to save an archive of the feed if they so choose.

@prologic It seems very straight forward to do this automatically. When I delete my own post, how is that currently propagated to other pods?

We agree that the abuse of admin powers on his own pod is not a big concern because the software should protect the right of the users to migrate to a different pod.

@prologic To be clear, you agree with me, but you say my understanding is correct? The understanding that the delete API is about policing the activities of users on **other pods**?

@abucci I agree. It should be as easy as possible to migrate a feed between pods.

A user of a pod certainly needs to trust the operator to some extent. Abuse of admin powers by the operator of your own pod isn't a big concern in theory because it can be countered by moving to a different pod or self-hosting your feed.

However, admin abuse is a real concern when the admin of a pod you're not using gets to police the content of your posts.

@abucci

> Imagine if a pod operator decides a twt should be deleted, then this set off delete calls for that twt to all peered pods, which in turn propagate delete calls.

Fine, as long as the post is on *his own pod*. I don't think we need any kind of moderation on Pod A by the admin of Pod B. If a function like that is going to exist, it should at least be opt-in.

@prologic If I was to run a pod, and I'd like to spin one up at some point, the abuse policy of twtxt.net (or any other pod) would be completely irrelevant. My users would be bound by the abuse policy of **my pod**, whether or my abuse policy matches yours.

Users on any pod should be free to mute any feed or conversation they dislike, and pod admins should be free to "mute" entire pods if they so choose.

I may be misunderstanding you here, but the motive behind this delete API seems to be to police the activities of users on other pods.

If a pod admin decides to delete a post on his pod as you have, that deletion should eventually be propagated throughout the network. It's the same if a user chooses to delete his own post. However, you should not have any say over the deletion of a post on twt.nfld.uk. That's @jlj's decision to make.

I think @tkanos and I are in agreement here, but I don't want to speak for him.

@prologic Is this about moderation or situations in which a user chooses to delete his or her own post?

Congrats @prologic and crew! Thank you for all the work you do.

@aryak Congrats, I'm glad to see another gopherhole online. I need to set one up myself.

@movq Very interesting read. I love reading about how terrible computers are at time.

@prologic I just like to see everything that's happening in the twtverse. Although, if the current trends keep up, I'll probably have to switch to the boring old timeline.

Actually, I just had an idea. Would it be feasible to add a configuration option to exclude followed feeds from Discover? That way, we wouldn't have to filter through all the posts we've already read to find new feeds.

@prologic I do follow @news, but I usually stick to the Discover feed.

@prologic I guess I did... It's been hard to keep up the past few days.

It's okay. I think I'm the only one that uses the Discover feed, anyway. :)

@prologic Interesting, I didn't know about that.

@prologic I'm certainly glad to hear that, but I was making a joke.

@prologic twtxt.net started tracking @reddit_funny and it blew up my Discover feed...

@prologic Heh, "commit".

@dendiz Bookmarks allow you to save posts for later viewing. They're accessible from your user feed, and you can control the visibility of them in your settings.

@dendiz You can only delete your most recent post on yarnd.

@dendiz Welcome to Yarn!

@lyse Image rendering in terminals is usually done with Sixels and it's not straight forward. A Newsboat developer has confirmed that it won't be implemented any time soon because of complications with ncurses.

Photon supports image rendering with sixels. It's just a feed viewer. It have a database or anything, it just pulls in feeds specified on the command line and displays the items chronologically in a grid view.

It works fine for XKCD. It just looks a lot better in the article view because of the color limitations.

!Photon displaying the XKCD RSS feed

!Photon's article view on the most recent XKCD

I think this is a great change, but do we need to mark every human as such on the Web interface? I think it just adds clutter to the page.

I can also see people (read: me) being "trained" over time to not notice the icon because it's a human 99% of the time.

@tkanos I'm with you. I'll believe it when I see it.

Oh man, it's going nuts now.

Add this to `trackers.conf`. Source

Then, add the following to `teller.conf`:

```
[cloudflare]
balance=1
freq=2000
```

I got it going again. It's awfully quiet on my system. I wonder how difficult it would be to track connections to Cloudflare.

@abucci I thought about putting it on a hotkey in my window manager, but I think I'd drive myself crazy.

@lyse Good choices!

@tkanos, welcome to the club. https://lab6.com/rss.xml is one of my favorites, but posts are very infrequent.

I'm also a big fan of https://www.prologic.blog/feed.xml, https://codemadness.org/atom_content.xml, and https://jcs.org/rss.

@tkanos I used DDG for a while. Switched away from them because they tracked clicks. I'm not sure if they still do.

Then, I used Startpage which uses Google results. I #2021-10-01T20:59:17-07:00">switched away from them because they kept thinking I was a robot and making me solve a captcha.

Now, I'm on Brave Search. I don't like their browser much, but I think their search engine is nice. They have their own crawler, which isn't common. The results are usually pretty good, but when I'm trying to do a per-site search I switch to a Whoogle instance.

Marginalia Search is a search engine with their own crawler that prioritizes simple, readable websites.

Kagi is a paid search engine that, apparently, doesn't spy on you. However, all your Web searches are tied to your real identity because you can't pay anonymously.

@movq @akoizumi Otter Browser uses Qt Webkit, if that counts.

@prologic Thank you, I'll give it a try a little later. It looks very promising.

@abucci I didn't time all of them, I probably should have, but `xz` has its own timer. If I remember correctly, it took 7 minutes and 17 seconds on my toaster to compress 1.36 GiB, mostly text, at the highest compression level. I don't think that's all that bad.

`xz` also lets you use multiple threads, which isn't common on these tools. I didn't do it for this test because there is an extremely small size penalty for doing so and I wanted to go all-out.

Here's a good blog post that shows the differences with multi-threading. The size difference is negligible, and that test showed no measurable difference in file size between 2 cores and 32 cores. There are diminishing returns in speed, though.

@abucci Oh, wow, you can do that. RSS feeds work too, I checked. That's pretty neat.

Reddit lets you do something similar. https://www.reddit.com/r/linux+openbsd+serenityos

> Is “Gopher + TLS” still “strictly Gopher”? Nah. But neither is using UTF-8 in Gopher pages and a loooooooot of people do that.

Also, I'm the line endings for just about everything Gopher are CRLF per RFC 1436. I'd be willing to bet that a lot of hand-written gophermaps use LF.

This document was an interesting read, posted by Hiltjo in the second thread linked by @movq.

It's Bitreich's backwards-compatible standard for extensions to the Gopher protocol, including TLS.

@movq I didn't know Geomyidae supported TLS. That's a little embarrassing, I have a copy of it on my computer.

main.c, line 31:

```
#ifdef ENABLE_TLS
#include
#endif /* ENABLE_TLS */
```

@abucci RSS feeds for each account + tags in Newsboat?

@abucci I set that up a couple months ago, it's pretty cool.

2 in the morning is a great time to compare compression algorithms.

```
Ratio File size Filename Command Algorithm
1 1458553185 build/
0.451 658022612 ../node-modules/
0.322 469704387 build.tar.Z compress -k build.tar Lempel–Ziv–Welch (LZW) (oh, how far we've come)
0.185 269780511 build.tar.gz gzip -k9 build.tar Deflate
0.082 119839762 build.tar.bz2 bzip2 -zk9 build.tar Burrows–Wheeler transform
0.047 68258612 build.tar.br brotli -kZ build.tar Brotli
0.047 67989604 build.tar.zst zstd --ultra -22 build.tar Zstandard
0.046 67705992 build.tar.xz xz -zk9e build.tar Lempel–Ziv–Markov (LZMA)
```

0.046 is *really* mind-blowing. I don't need a torrent, we're approaching e-mail attachment file sizes here.

If I can get a proper static copy of MDN, I'll make a torrent and share a magnet link here. I know I'm not the only one who wants something like this. I don't think the file sizes will be so bad. My current "build" of the entire site is sitting at 1.36 GiB. (Only a little more than double the size of `node_modules`!) So, with browser compatibility data and such, I think it'll still be less than 2GiB.

Aggressively compressed with `bzip2 -9`, it's only 114.29 MiB. A compression ratio of 0.08. That blows my mind.

Now I've just realized that if `/en-US/docs/Web/HTML/Global_attributes` is saved with that filename, the Web server is probably going to send the wrong MIME type. Wget solves this with #index-_002ehtml-extension">--adjust-extension.

Man, you really don't have to do this...

@prologic What I need it to do is crawl a website, executing JavaScript along the way, and saving the resulting DOMs to HTML files. It isn't necessary to save the files downloaded via XHR and the like, but I would need it to save page requisites. CSS, JavaScript, favicons, etc.

Something that I'd like to have, but isn't required, is mirroring of content (+ page requisites) in frames. (Example) This would involve spanning hosts, but I only need to span hosts for this specific purpose.

It would also be nice if the program could resolve absolute paths to relative paths (`/en-US/docs/Web/HTML/Global_attributes` -> `../../Global_attributes`) but this isn't required either. I think I'm going to have to have a local Web server running anyway because just about all the links are to directories with an `index.html`. (i.e the actual file referenced by `/en-US/docs/Web/HTML/Global_attributes` is `/en-US/docs/Web/HTML/Global_attributes/index.html`.)

@prologic That's awfully nice of you, but you don't need to do that. I know you're a busy guy.

I'm sure I can find something if I look around some more. I can't be the only one that wants to make a static mirror of a dynamic website.

@adi Wow, that's a great idea. I wonder if MDN could be used as a data source. The Markdown would need some significant transformation done. https://github.com/mdn/content/blob/main/files/en-us/web/html/element/span/index.md

@prologic It's close, but it's just a Web scraping library. I'm looking for something of the command line variety.

@prologic I'm trying to make a static local mirror of MDN Web Docs. It's all free information on GitHub, but the whole system is extremely complicated.

<​tinfoil-hat>I think it's so they can sell more MDN plus subscriptions, making people use their **terrible** MDN Offline system that uses the local storage of your browser.<​/tinfoil-hat>

At this point, I'm willing to run a local dev server and just save each generated page and its dependencies.

I really only need it to run JavaScript so it can request the browser compatibility JSON. It's https://github.com/mdn/browser-compat-data but the MDN server, annoyingly, transforms it.

Once the BCD is rendered statically, I should be able to remove the references to the JavaScript.

That will solve another issue I'm having where the JavaScript is constantly trying to download `/api/v1/whoami`, which seemingly has no purpose aside from user tracking.

TLS is absolutely applicable to Gopher and people have done it, but there's no standard so everyone implements it differently.
It's not widely implemented in clients or daemons.

Also, lots of people are against TLS because it's too hard to implement on your own; Gopher daemons would need to depend on an external library.

If you want Gopher encrypted, the best option is to make your Gopher daemon accessible as a Tor hidden service.

@eaplmx Gopher is designed to be a simple way to access information on the Internet, as an alternative to the World Wide Web. No markup, just plain text and hyperlinks to resources.

Gemini is too simple in the wrong places, e.g. the very limited Markdown-lite. It's also too complicated in the wrong places, e.g. mandatory encryption.

Gopher's continued usage even after being "beaten" by the Web speaks volumes. I don't hate Gemini. Actually, I enjoy exploring Geminispace from time to time. I think it's a fad, though. People aren't going to use it in 30 years.

(Assertions like that, when it comes to technology, never come true. In 30 years, when Gemini takes over, feel free to come back to this twt and make fun of me. It won't be the first time an inferior protocol becomes dominant.)

@prologic It's called "cgod" and it isn't written in C *or* Go? I want my money back...

I also like Gopher more than Gemini. The problem Gemini is trying to solve is better solved by just writing static HTML 4.01 pages.

@cobra I like Geomyidae, but it doesn't have per-user Gopherspace. Gophernicus does, along with a few other bells and whistles.

@lyse I also use Tridactyl, but with a single 1600x900 screen and a TrackPoint I really don't find myself using anything but j/k, H/L, and J/K. Maybe d and C-d/C-u at times.

I haven't used Warpd at all, beyond playing with it initially.

Paging @ocdtrekkie

@jsreed5 Audacious is a free software music player that replicates the Winamp interface. It even supports Winamp skins. The Winamp style interface doesn't work too well on Wayland, though.

@akoizumi I don't use it regularly myself and I definitely wouldn't host an instance because it's written in JavaScript, but I'm still glad it exists.

Several countries either censor or have attempted to censor Wikipedia, and Wikiless is a great way to bypass it.

https://en.wikipedia.org/wiki/Censorship_of_Wikipedia

The #query-for-tags">twtxt registry specification is supposed to address this problem, but nobody uses registries either.

@ocdtrekkie @abucci I have several local Git repositories that should have remotes somewhere, but I'm talking about maintaining a local mirror of other people's projects.

I'm referring to Wikiless being hidden from public view on Codeberg, #digfawa

I was envisioning a Raspberry Pi or something pulling new updates automatically with a Cron job.

@movq HTTPS-only mode in Firefox and derivatives will automatically try HTTPS, then give you the option to connect with HTTP if the server doesn't support TLS. I'm not sure about Chromium.

I generally like that system, but it can get annoying at times. I wish there was a way I could disable the dialog (while still trying https first for unknown domains) on a per-tab basis, letting it fall back to plain HTTP without user input.

On a somewhat related note, I recently discovered a cURL option to specify a default protocol when invoked without a scheme, e.g. `curl mckinley.cc`.

In `~/.config/curlrc`:

```
proto-default = https
`````

@prologic Don't know. It'll be interesting to look at the commits when it comes back up.

@prologic TL;DR:

* Wikimedia Legal Enforcement has contacted Codeberg citing quote-on-quote "licensing / trademark infringement issues in the content"
* Codeberg has made the repository private (i.e. it can only be viewed by contributors)
* The author is making changes to the software in order to remove the infringing content

@ocdtrekkie It's alright. I don't think @prologic is around. Maybe next week.

It's been Vim for me for a long time. Previously, it was Notepad++, but now I wouldn't give up modal editing for anything.

I forgot I had htmlq installed.

```
$ curl https://github.com/zedeus/nitter/wiki/Instances | htmlq 'table:nth-of-type(2) > tbody > tr' | grep '^$' | wc -l
83
```

Agreed, but Nitter makes it better. It's probably one of the strongest of the alternative frontends. There are 83 documented, public, clearnet instances.

```
>> document.querySelector("table:nth-of-type(2)").querySelectorAll("tr").length - 1
<- 83
```

@prologic Why get locked in to that proprietary, centralized service when you can use any Nitter instance and any feed reader you want?

@akoizumi Keyboards are bloat. All you need are toggle switches connected to the GPIO pins.

@kyokonet When can I send in my application via facsimile?

@prologic That's pretty cool!

@prologic Well, you can always run a Monero node as a Tor hidden service :)

@prologic

> So it comes down to who you trust [more][more=][more][more=][more][more=][more][more=], your ISP or your VPN provider(s)?

My VPN provider, 100%. I've talked about my ISP in the past.

Besides, I don't *need* to trust them as much as my ISP. Under normal circumstances, this is the important information that your ISP can know about you:

* All of your personal information, down to a home address
* The IP addresses to which you're connecting
* Information leaked by unencrypted traffic (DNS queries, etc.)

As long as the VPN provider doesn't require any personal information, and mine doesn't, you're making it so no single party has all of that information. The IP address cloaking is an added benefit for me.

> You still leak your IP address with that TURN server however.

If your WebRTC implementation isn't broken, the TURN server sees your traffic as coming from the VPN server, just like any thing else you connect to through that tunnel. It's the same story if I open a port and make a direct p2p connection.

Out of curiosity, I tried the leak test on Ungoogled Chromium and it actually was leaking the private use internal IP given to me by my VPN provider. That doesn't happen on LibreWolf due to its security measures.

My real IP still didn't leak because my VPN client prevents any other program from using my real network interface.

@prologic

> the Internet kind of requires IP Addresses to even function in the first place

True, but a VPN can be used to mask your real IP address because all of your network traffic is relayed through another computer with a different IP address.

> p2p protocols like WebRTC require peer addresses to be able to communicate with one another

In principle, yes, but they don't need to be able to communicate directly as long as both clients can communicate with a TURN server. At least, that's how I understand it.

@prologic No, the public IP allocated to you by your ISP as opposed to the one at the other end of your VPN or proxy tunnel.

@abucci Just one more reason to get off of Chromium-based browsers.

@prologic The problem with WebRTC is that the implementations tend to try all the available network interfaces and ignore proxy settings, thus leaking your *real* IP address.

@abucci Librewolf protects from this by default. #privacy">https://librewolf.net/docs/features/#privacy

@akoizumi Prosody is actually my XMPP server of choice, and it's really pretty good. I just wish there was a decent implementation in C, or even Go.

@akoizumi The feature creep is strong with this one, but the main competitor is written in Lua.

@eaplmx Edge is worse than Chrome because it has Microsoft's spyware on top of Google's. LibreWolf is my current browser of choice.

While we're on the subject, here's a great video I found showing Microsoft's efforts to push you into using Edge.

* Original 720p H.264/AAC [93.8 MiB][93.8 MiB=][93.8 MiB][93.8 MiB=][93.8 MiB][93.8 MiB=][93.8 MiB][93.8 MiB=] [Most compatible][Most compatible=][Most compatible][Most compatible=][Most compatible][Most compatible=][Most compatible][Most compatible=]

* 720p H.265/AAC [33.1 MiB][33.1 MiB=][33.1 MiB][33.1 MiB=][33.1 MiB][33.1 MiB=][33.1 MiB][33.1 MiB=] [Least compatible][Least compatible=][Least compatible][Least compatible=][Least compatible][Least compatible=][Least compatible][Least compatible=]

* 480p VP9/Opus [36.4 MiB][36.4 MiB=][36.4 MiB][36.4 MiB=][36.4 MiB][36.4 MiB=][36.4 MiB][36.4 MiB=] [Probably compatible][Probably compatible=][Probably compatible][Probably compatible=][Probably compatible][Probably compatible=][Probably compatible][Probably compatible=]

@prologic My best guess is that he imported the old messages from another microblogging service. That would explain the invalid mentions.

@prologic The initial commit of buckket/twtxt on GitHub was in 2016, so I call BS. https://github.com/buckket/twtxt/commit/d5c9e1da0b9fa6a23f0f33e06d96fd90a242e6e1

@movq A lot of software is pretty bad, you just can't let it beat you down.

I'm still not a fan of Signal, but it's for other reasons.

If the Snowden revelations were a Russian operation to harm the credibility of the US government, it failed because not many people cared back then and most people today, even if they *know* what's going on, accept it as a normal part of life.

I think the more likely explanation is that Putin let Snowden stay to rub it in our face and recently gave him citizenship for the same reason. Anything is possible, though.

@prologic My ISP is known for invading the privacy of its users and they like to perform MITM attacks on unencrypted Web traffic. It's not total tin-foil-hattery. :)

@prologic I use a commercial VPN service most of the time to protect from my ISP. Libera won't allow you to connect if you're using a known commercial VPN IP address unless you authenticate to an account with a verified e-mail address. Tor doesn't work either, if I remember correctly.

I wouldn't mind this *so* much, but you can't register an account unless you're using an approved IP address.

@prologic Libera's insistence on giving them an e-mail and my real IP address makes me *really* not want to give them either one. Otherwise, I'd probably talk in IRC regularly.

@lyse I read that as 'monorepos' at least twice.

@admin Testing on prod, are we? :)

Hm, my references to command line options are hyperlinks to the man page but nothing is indicating that that's the case.

@will Oh, that's for HTTP Strict Transport Security. #no~15">`--no-hsts` will stop that behavior.

@will Do you mean the directories it creates when doing recursive retrieval? You can use the #nd">`--no-directories` option to stop that behavior.

@prologic It's a feed that anyone can post to with a Gopher query. Where does the spec say that one feed *must* represent a single person?

Oops, it warned me that it was longer than 140 characters and I accidentally reloaded the query page so it posted twice. You get the point, though.

@justamoment
> Personally I think that if a discussion is alive posts will be there, I don’t really mind if an old post/page lose its comments.

I disagree with that. I always enjoy reading what people have to say about blog posts, and it's not uncommon for comments to be months or even years apart. Discussion doesn't have to be "alive" for a comment to be worth reading.

@prologic I would absolutely love to see this feature.