They/Them

Network Guardian Angel. Infosec.

Antispeciesist.

Anarchist.

Personal Website

You should hide scores on Lemmy. They are bad for you.

  • 14 Posts
  • 34 Comments
Joined 4Y ago
cake
Cake day: Jan 11, 2022

help-circle
rss


Should scores be hidden by default?
Lemmy implements a scoring system allowing people to upvote or downvote posts. You know that since you are using Lemmy :) Score can be used to increase or lower visibility of posts, in particular when using some sorting algorithms (active, hot, top). This can be used to increase the visibility of good quality posts, and lower that of low quality or irrelevant posts. Yet, from what I observe, the tool is mostly used for communities to self-administer filter bubble. Some communities seem to behave like a hive mind, massively upvoting or downvoting until either the dissident is assimilated in a very Borg way, or excommunicated. Also, scores seem to be used often to convey cheap moral judgement, without having the need to expose oneself to criticism by providing arguments to sustain their opinion. Overall, I think scores are more toxic than useful, and I would be in favor of hiding them by default, so that new comers are not put out by them. What is your opinion about this? What are the advantages of having the score visible by default? Just a clarification: the question is not "should scores exist or not?". If people find value in scores, good for them. I'm not one to dictate other people preferences. :)
fedilink

Thank you for your answer. It clearly challenges my position regarding f2p games. I completely forgot about piracy, now having the chance of earning enough to pay for stuff, but you are correct and that is a very good argument.


Again, very good argumentation. Thank you. Your comments are much appreciated.

Some people may say “having access to candy crush has made me happier” but what’s actually increased there happiness isn’t access to a video game but distraction from the world around them as an example. That can be accomplished through several means and none of them require exposing oneself to potential manipulation for profit by a company.

That particular argument gives me much to think about. 👍


Those are good arguments. I need to take some time and think on them. Thank you.


The world is objectively worse because of free to play video games.

That was not my argument. I did not say it was all pink and that nobody suffered from f2p. I talked about the overall happiness. The same utilitarian approach can be used when talking about vaccines. Some people die because they took a vaccine shot. However the overall population is better because of the vaccine.

I’m not saying that f2p games are comparable to vaccine. I’m just trying to make clear that my argument is utilitarian, and that I’m not disregarding people having issues because of f2p games.


I respect your argumentation, but I believe you slightly twisted mine. By “people with income”, I wanted to say “people with enough income to spend some on recreational activities”.

Concerning the “insane potential for returns”, I’m sorry to say that the company that I worked for and for which I developed a f2p game was a small company of 5 employees that never took off all that much. It is a business model. It is not a miraculous business model.

by your assessment its fine to exploit people for profit if they have an income

That’s the basic concept of a salary. I would agree that there are unfair salaries, sure. That’s when we can start talking about exploitation. I’m ok with salaries. I’m not ok with exploitation.


it preys the most not on the people who have money to burn but on neurodivergent folks predisposed to addictive behaviors

I would be really interested in reading studies on the classification of whales. If that assertion is true, this would change my mind about f2p in a split second.


Thank you for your answer.

Diablo Immor(t)al is a pretty terrible case when it comes to trying to squeeze as much money as possible from people. We, players, are harassed by the notifications for paying features. And it is not just a “pay to skip”/“pay to fast” system: it is also a pay to win game for the competitive scene. That’s bad.

On the other hand, it has at least 120 hours of free content…

My arguments are not in defense of Diablo Immor(t)al, though. They are in defense of Free to play in general, with reserves.


I don’t get the downvotes on this message. I can understand why the other posts might be NOK for some people, but this one? Please explain it to me.

Artists need an income. Are we all in an agreement on this? You would not ask for a musician to play a full concert every night for free, right? Why would it be fair to ask a developer to develop a game for free? Do they not deserve a salary? And where would the money come from if not from people having money to spend on games?


Yes I fully agree games should have options to allow those with jobs and busy lives to skip progression (outside of any competitive sphere) but they shouldn’t have to pay for it?!

I totally agree with that. If the game is not free, this should be considered an accessibility feature.

If the game is free, developers need to find ways to get money from the game. People with income are good targets, both on the economical and ethical standpoint :)


Maybe I am biased. I worked in the gaming industry and developed a F2P game 18 years ago… And of course we added features that encourage habit forming behavior and manipulative marketing. F2P are free but developers have to earn money at some point. I am all for OSS gaming but let’s face it: they cannot rival with games developed by for-profit gaming companies… not because they have no talent but because developing a game is a huge investment and requires a lot of people that deserve a salary.

Now the honest question is: is the world worse because there are F2P games? Sure, some people will have problems, but at the same time, many people will be happy to play the game for free.

To phrase it as a utilitarian question: does the overall happiness increase or decrease because of these games? My opinion is that overall happiness increases. YMMV :)


Why? Because they allow poor people to have fun?

“Pay to fast” allows people with jobs and not much free time to play with their jobless friends. What’s wrong with that?





“sq feature comparison with gpg”
2022, people still use and make new implementations of OpenPGP. In 2015, I was already describing OpenPGP as a horror show for cryptographers. People need to move on! The format is wrong. The implementations are wrong. The mandatory ciphers are outdated. The web of trust is mostly dead since the key servers are broken.
fedilink

“A new standard for signing, verifying and protecting software”
cross-posted from: https://lemmy.ml/post/256368 > (via https://infosec.exchange/@ScottMortimer/108243435027127879)
fedilink

A bit old, but an amazing read. Kudos to the author!
fedilink


Wow, perfect timing. I am currently struggling with efficient disk usage in my application. Thank you!


Thank you. I did not know that the state events were not encrypted. That’s very unfortunate. I think I still prefer Element/Matrix over Signal, but slightly less than before reading your message 👍


That’s a problem. But federation at least helps by giving you the choice of who will see these metadata leaks.


I would not use either of them.

Currently, a better solution, for me, is Element/Matrix, because the crypto is mostly OK and there is federation. And it is quite featureful.


Yeah, that’s what I thought. Thank you for playing 🙂


Can you provide a link to that “age signature plugin”, please?


Still bossing people around, I see. “You should not answer” “Your post belongs elsewhere”. You never change :) Your intimidation attempts are ineffective on me. You should move on.

Age plugins are not Age. Minisign is an excellent tool. It is not a replacement for Age.


Can you explain how you intend to use minisign as a replacement for age, please ? 😂



Does anybody know about a Linux distro that enforces strong firewall rules (that’s one of the control points of that linux distro security assessment) by default? I mean other than Tails which I expect does it. RFI vuln, such as log4shell, rely on outgoing connections. A linux distro with a strict firewall by default would have to be purposely poked to let such queries out. Sounds interesting to me.


Accept that you are wrong, defending your wrong arguments makes it worse for you, the more you answer the easier it is to humiliate you.

I take note of your explicit intent of humiliating me.

I also take note of your condescending tone:

  • we are talking about your intolerance accepting valid criticism

  • Weak argument.

  • to justify your weak and flawed logic.

  • Please stop wrongfully interpret more into it

Yelling at people, threatening them, humiliating them is not a civil conduct, and hereby ask for your temporary ban for violation of rule 2.


I posted that link in my company chat, where some do use Mint but most don’t (mix of Ubuntu, Manjaro, Fedora). Many were interested, and we have had a healthy discussion about some of the evaluation points, some of which we did find subjective and not very meaningful, and how Mint compared with the other distro evaluation linked at the top of the article.

Also, you are talking about firewall GUI, but it is not even one of the evaluation points. They just said that there was nothing about a firewall configuration in the configuration wizard.

Linux Mint does ask the user to enable the firewall in the graphical Welcome Wizard though.

However the evaluation points were:

[N] Is the host firewall enabled by default?

[N] Does the host firewall block all incoming/ingress traffic by default?

[N] Does the host firewall filter outgoing/egress traffic by default?

Did you actually read the article? I doubt it. If you did, you would have noticed that the article does mention the methodology, and the results for other distros, with link to them if need be. Someone using yet another distro could be interested in that methodology to improve it or post a review about their favorite distro too. Maybe that is not “Linux enough” for you. In that case, you can move on.

Thank you.


Then close other Communities, and bring this under the same argument. otherwise we can close them and put everything under here.

https://en.wikipedia.org/wiki/Faulty_generalization

When I and others post here in this community we get the same comments… post it under xyz.

So your excuse for bullying people is that you got bullied too.

Not sure what my status has to do with anything here

If a link is not to your liking, you can just skip it, or even downvote it. You don’t need to tell people what to do. Except of course if you are a mod and the post is against the rules. Then go ahead and thank you. But no.

Have a nice day as well


Considering the post also mentions a generic evaluation methodology, and provides pointers to similar studies on other distros, the stuff may actually be of interest for some people interested in Linux. Maybe not you. I am ok with that. I actually don’t care.

BTW, when did you get your mod promotion? I don’t see it. Ok bye.


Second line:

I performed the same testing on the following distros:


In that case, I would recommend Fedora Silverblue :)


What is your new user gonna do with it?

If they just want it to work and be secure, but not feel the cogs, you might be interested in looking into Chromium OS or Fedora Silverblue.

If they are a tech, you might wanna go with a flavor of Ubuntu.

If they are willing to become proficient and experienced with GNU/Linux as a distro as a tech, maybe something like Arch ou Debian?



Pretty uninformed move. Or yet another marketing stunt.

Cryptocurrencies are not bad (edit: for the climate) by essence. Some are (e.g. proof-of-work based consensus ones). Some aren’t (e.g. federated bizantine agreement).

The latter does not consume a lot of energy to reach decentralized consensus. That’s why I like XLM.

Disclosure: I do not own any crypto assets (edit: and I never did in the past either). I am just an applied cryptographer.


Also, this quote neglects the fact that many contributions are authored by employees of big tech companies, like Microsoft. The author of this quote needs to learn about how to use git log --author="@some_big_tech.com"


I have often used asciinema for demonstrations of my command line utilities and it is excellent. Definitely worth being in your toolbox.



I suppose you want protection from server compromise if you require client-side encryption. However, you should be mindful that if the code that encrypts your content is served by your server as part of a web interface, then an attacker can simply alter the code that is sent to your browser to leak your master password, or your files. If you want secure client side encryption, you cannot rely on a code that is served by your server either. You will need to install an app.


Being a network security specialist, I’ll ask these basic questions:

  • what’s the universal definition of a private network?
  • does this measure make sense in IPv6 within the global scope?
  • is it the responsibility of the browser to secure against DNS rebinding?

My answers to these questions are:

  • there is no universal definition, so this approach is doomed by design
  • no
  • heck, no; that’s the job of the webserver, by avoiding the so-called default virtual host. The Host/:authority header should always be verified, and this is sufficient to counter all forms of DNS rebinding.

I fear that ignoring tickets just makes them stack. Similarly, closing and locking tickets arbitrarily may affect your reputation. This may or may not be a problem depending on how you feel about your reputation. Still, it is worth remembering that some maintainers do care, and that they don’t want to look bad (even though most would understand).

I personally don’t think that setting a bar high to deter less motivated people from contributing is a sane approach. I suffer from poor quality bug reports every single day, at work, and yet, they often are an indicator of something that IS broken in my software. I need them.

The key difference is that I am paid for it, and that my contributors are also paid employees, that I have to work with every day, and that will learn over time. Being on the receiving end of an endless streams of negative comments, for no other reason that being willing to share some of your work, as-is, is not an appropriate retribution. And even if that was a paid job, I’m not sure one would want to keep it.

I don’t think the issue is whether contributors are tech pros or not, and whether one should do gatekeeping. I think that the point is that it is worth remembering, when you contribute an issue to a project, that the maintainer is a human being, probably giving some of its own free time, out of passion and compassion, to fix your issue, and that negative comments are plainly abusive and should probably be worded in a gentler way.


It doesn’t work
An inspired blogpost by Frank Denis on the depression that may be felt by FOSS maintainers
fedilink

Secure large file decryption using Linux, Go and Nacl
In this article, I explain the challenges of decrypting large files that do not fit in RAM and some possible solutions leveraging Linux and a good high-level crypto library written in Go.
fedilink