also “you may not remove or obscure any functionality in the software related to payment to the Licensor in any copy you distribute to others.” 🤡

FUTO’s license meets neither the free software definition nor the open source definition.

a bit of context:

• I Still Know What You Visited Last Summer

• https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_selectors/Privacy_and_the_visited_selector

• https://www.theregister.com/2025/04/07/chrome_135_history_sniffing/

it’s among the many OSes you can run in an emulator in your web browser at https://copy.sh/v86/

The network never went down.

You say that but, everything I ever posted on identica (and also on Evan’s later OStatus site Status.Net, which i was a paying customer of) went 404 just a few years later. 😢

When StatusNet shut down I was offered a MySQL dump, which is better than nothing for personal archival but not actually useful for setting up a new instance due to the OStatus having DNS-based identity and lacking any concept for migrating to a new domain.

https://identi.ca/evan/note/6EZ4Jzp5RQaUsx5QzJtL4A notes that Evan’s own first post is “still visible on Identi.ca today, although the URL format changed a few years ago, and the redirect plugin stopped working a few years after that.” … but for whatever reason he decided that most accounts (those inactive over a year, iiuc, which I was because I had moved to using StatusNet instead of identica) weren’t worthy of migrating to his new pump.io architecture at all.

Here is some reporting about it from 2013: https://lwn.net/Articles/544347/

As an added bonus, to the extent that I can find some of my posts on archive.org, links in them were all automatically replaced (it was the style at the time) with redirects via Evan’s URL shortening service ur1.ca which is also now long-dead.

imo the deletion of most of the content in the proto-fediverse (PubSubHubbubiverse? 😂) this was an enormous loss; I and many other people had years of great discussions on these sites which I wish we could revisit today.

🪦

The fact that ActivityPub now is still a thing where people must (be a sysadmin or) pick someone else’s domain to marry their online identity to is even more sad. ActivityPub desperately needs to become content addressable and decouple identity from other responsibilities. This experiment (which i learned of via this post) from six years ago seemed like a huge step in the right direction, but I don’t know if anyone is really working on solving these problems currently. 😢

sometimes a footprint represents humanity

sometimes, but in GNOME’s case i think it is not intended to be a human foot but rather the foot of a mythological creature (a gnome). note that it has a squashed aspect ratio compared to a human foot, and also has only four toes.

apparently it’s also problematic in some cultures: https://wiki.gnome.org/Engagement/FootAndCulturalIssue

Have you tried https://mike-fabian.github.io/ibus-typing-booster/ ?

I have not, but I think it does what you’re looking for.

The demo video emphasizes its use as an emoji picker but it was originally created for typing Indic languages.

At first i thought, wow, cool they’re still developing that? Doing a release or two a year, i see.

I used to use it long ago, and was pretty happy with it.

fyi: GNU coreutils are licensed GPL, not AGPL.

there is so much other confusion in this thread, i can’t even 🤦

here are some related issues:

• https://github.com/LemmyNet/lemmy/issues/833 Option to disable notifications for a specific post - this was closed in favor of #1883
• https://github.com/LemmyNet/lemmy/issues/1883 Add settings to disable comment, mention, and private message notifications - here @dessalines@lemmy.ml commented “We already have one for post notifs” but i don’t see where that exists 🤔
• https://github.com/LemmyNet/lemmy/issues/3042 Add a “disable inbox replies” option of posts and comments

Nice post, but your title is misleading: the blog post is actually titled “Supply Chain Attacks on Linux distributions - Overview” - the word “attacks” as used here is a synonym for “vulnerabilities”. It is not completely clear from their title if this is going to be a post about vulnerabilities being discovered, or about them actually being exploited maliciously, but the latter is at least not strongly implied.

This lemmy post however is titled (currently, hopefully OP will retitle it after this comment) “Supply Chain Attack found in Fedora’s Pagure and openSUSE’s Open Build Service”. edit: @OP thanks for changing the title!

Adding the word “found” (and making “Attack” singular) changes the meaning: this title strongly implies that a malicious party has actually been detected performing a supply chain attack for real - which is not what this post is saying at all. (It does actually discuss some previous real-world attacks first, but it is not about finding those; the new findings in this post are vulnerabilities which were never attacked for real.)

I recommend using the original post title (minus its “Overview” suffix) or keeping your more verbose title but changing the word “Attack” to “Vulnerabilities” to make it clearer.

TLDR: These security researchers went looking for supply chain vulnerabilities, and found several bugs in two different systems. After responsibly disclosing them, they did these (very nice and accessible, btw - i recommend reading them) writeups about two of the bugs. The two they wrote up are similar in that they both involve going from being able to inject command line arguments, to being able to write to a file, to being able to execute arbitrary code (in a context which would allow attackers to perform supply chain attacks on any software distributed via the targeted infrastructure).

I wonder how much work is entailed in transforming Fedora in to a distro that meets some definition of the word “Sovereign” 🤔

Personally I wouldn’t want to make a project like this be dependent on the whims of a US defense contractor like RedHat/IBM, especially after what happened with CentOS.

deleted by creator

They have to know who the message needs to go to, granted. But they don’t have to know who the message comes from, hence why the sealed sender technique works. The recipient verifies the message via the keys that are exchanged if they have been communicating with that correspondent before or else it is a new message request.

So I don’t see how they can build social graphs if they don’t know who the sender if all messages are, they can only plot recipients which is not enough.

1. You need to identify yourself to receive your messages, and you send and receive messages from the same IP address, and there are typically not many if any other Signal users sharing the same IP address. So, the cryptography of “sealed sender” is just for show - the metadata privacy remains dependent on them keeping their promise not to correlate your receiving identity with the identities of the people you’re sending to. If you assume that they’ll keep that promise, then the sealed sender cryptography provides no benefit; if they don’t keep the promise, sealed sender doesn’t really help. They outsource the keeping of their promises to Amazon, btw (a major intelligence contractor).

2. Just in case sealed sender was actually making it inconvenient for the server to know who is talking to who… Signal silently falls back to “unsealed sender” messages if server returns 401 when trying to send “sealed sender” messages, which the server actually does sometimes. As the current lead dev of Signal-for-Android explains: “Sealed sender is not a guarantee, but rather a best-effort sort of thing” so “I don’t think notifying the user of a unsealed send fallback is necessary”.

Given the above, don’t you think the fact that they’ve actually gone to the trouble of building sealed sender at all, which causes many people to espouse the belief you just did (that their cryptographic design renders them incapable of learning the social graph, not to mention learning which edges in the graph are most active, and when) puts them rather squarely in doth protest too much territory? 🤔

i bet you’re going to love to hate this wikipedia article https://en.wikipedia.org/wiki/Monochrome_painting 😂

because it’s stupid.

you were bamboozled

presumably you find value in some things that some other people think are stupid too; it’s OK

except: pass

“Sorry, I got to return this video”

2004 is when the Blockbuster video rental chain was at its peak (cite), and VHS was still in wide use at the time having only been surpassed by DVD rentals a year earlier. Speed dial was also still a thing then, payphones still exist today, and, although complaints were filed against Bill Cosby much earlier the public wasn’t widely aware of them until 2014.

How about “John Kerry is the candidate who can prevent a second Bush term” ?

weird, i wonder why. i just checked on an ubuntu 24.04 system to confirm it is there (and it is).

i guess your computer’s power button might not be supported (out of the box, at least) by Linux’s acpi implementation :(