Creesch

joined 1 year ago
[–] [email protected] 7 points 10 months ago (1 children)

I am not quite sure why there are all these bullet points that have very little todo with the actually issue.

Researchers at the University of Wisconsin–Madison found that Chrome browser extensions can still steal passwords, despite compliance with Chrome’s latest security standard, Manifest V3.

I am not sure how Manifest V3 is relevant here? Nothing in Manifest V3 suggests that content_scripts can't access the DOM.

The core issue lies in the extensions’ full access to the Document Object Model (DOM) of web pages, allowing them to interact with text input fields like passwords.

I'd also say this isn't directly the issue. Yes, content_scripts needing an extra permissions to be able to access password input fields would help of course.

Analysis of existing extensions showed that 12.5% had the permissions to exploit this vulnerability, identifying 190 extensions that directly access password fields.

Yes... because accessing the DOM and interacting with it is what browser extensions do. If anything, that 12.5% feels low, so I am going to guess it is the combination of accessing the DOM and being able to phone home with that information.

A proof of concept extension successfully passed the Chrome Web Store review process, demonstrating the vulnerability.

This, to me, feels like the core of the issue right now. The behavior as described always has been part of browser extensions and Manifest V3 didn't change that or made a claim in that direction as far as I know. So that isn't directly relevant right now. I'd also say that firefox is just as much at risk here. Their review process over the years has changed a lot and isn't always as thorough as people tend to think it is.

Researchers propose two fixes: a JavaScript library for websites to block unwanted access to password fields, and a browser-level alert system for password field interactions.

"A javascript library" is not going to do much against content_scripts of extensions accessing the DOM.

The alert system seems better indeed, but that might as well become browser extension permission.

To be clear, I am not saying that all is fine and there are no risks. I just think that the bullet point summary doesn't really focus on the right things.

[–] [email protected] 1 points 11 months ago

It still does? That is an entirely different page and still shows the newest videos of channels you are subscribed to. At least, for me it does.

[–] [email protected] 1 points 11 months ago (1 children)

Have you tried placing the <br> tag directly after the `` closing tag?

[–] [email protected] 3 points 11 months ago* (last edited 11 months ago) (1 children)

Nextcloud can do this and replace a bunch of other google services in the process.

Looking at what you said so far though I am not entirely sure if you want to go down the route of self hosting yet. Which is okay, it involves a lot of work and knowledge to do right. Something you might not want to risk your contacts for if you are still learing. There are services that provide nextcloud hosting. Personally I am using Hetzner, a Germany based hosting provider: https://www.hetzner.com/storage/storage-share

Edit:

I forgot to mention, you'll also need to do some fiddling with your phone to sync things: https://docs.nextcloud.com/server/latest/user_manual/en/groupware/sync_android.html

[–] [email protected] 0 points 11 months ago (1 children)

I am dissapointed in that I have not been able to get a single mathematic equation produced (like famous ones), but I know they can?

Well, my understanding is that they actually can't. LLM's do "language" mostly based on what is called "next word prediction" so they basically look at the word and predict what the next most logical word would be. (Somewhat simplified). So numbers to them are not numbers but words, which is why they are fairly bad at them.

Opera has Aria, which is like the cleanest version of ChatGPT

Pass, not sure what stake the chinese owners have these days but Opera is a bit too.... feature rich in everything.

I do like working with just chat.openai.com for simple stuff. It is great at helping my debug things in areas I don't quite have all the knowledge I'd like. For example, I had to work on a shell script earlier in bash. Something I don't do often and as an added bonus it needed to work on both macOS machines and the bash version shipped with "git bash" on windows. MacOS GNU utils already function slightly differently at times, but git bash on windows is entirely broken in some areas. Where yesterday I spend an hour trying to find something relevant based on my input and the error I got through google chatGPT just managed to point out the pain point right away.

And that is where I feel chatGPT (in this case anyway) does a great job, troubleshooting issues about things that are not necessarily bleeding edge. I just presented it with a clear problem and a bit of context and asked why that could be the case. It also got it wrong a few times, but that is fine, it did safe me a bunch of time in the end.

[–] [email protected] 2 points 11 months ago (3 children)

Bing and Google Bard keep disappointing me. Bing for some reason only picks up on half of what I ask. Which is extremely odd as it is supposedly is ChatGPT based and ChatGPT gives pretty good answers on the same queries. The only problem with the latter is that a lot of it is of course outdated.

Bard might just be broken for me. I keep getting I'm a text-based AI, and that is outside of my capabilities. or similar responses.

[–] [email protected] 1 points 11 months ago* (last edited 11 months ago)

Frankly, you are taking a too binary approach to the subject of your rant. There are tons of Lemmy instances, so figuring out the right one isn't as straightforward as stumbling upon a single central platform.

This just feels like a cop out

No, I am just outlining several factors that come into play that do weigh in for people. I am not just saying it is difficult to find Lemmy instances. I am saying it is difficult to move entire communities over. I am also saying several other things than just "moving difficult". To be honest, I highly suggest you go back and ready my comment again with the intent of seeing the nuance.

[–] [email protected] 0 points 11 months ago (2 children)

This is such a cynical take. Contrary to popular belief, the vast majority of moderators do care about their subreddits or else they wouldn't be volunteering their free time. The allure of the power to remove some random person's post on the Internet, or to ban them just so they return with another account, pales in comparison to the thrill of watching your community grow and people having fun because of it. And it's not this weird selfish, hey-look-at-me-I'm-so-successful kind of thrill, it's like you joined this thing because you are interested it and now all these other people who are also interested in it are there talking about it. That's what's cool, you set off to make this place where people can talk about this thing that you think is cool and you get to watch it grow and be successful over time. Some of these communities have been around for over a decade, so, people have invested time and effort into them for over a decade.

Moving to elsewhere isn't really as easy as people make it out to be. At the moment "moving communities" means fracturing your community as there is no unified approach to doing this.

The operative word being "unified" which is next to impossible to achieve. If you get all mods to agree you will have a hard time reaching all your users. This in itself presents the biggest roadblock, ideally you'd close up shop and redirect users to the new platform. Reddit will most certainly not allow this, their approach to protesting subreddits that were not even aiming to migrate made that abundantly clear.

So this means that, at the very least, you are looking at splitting your community over platforms. This is far from a unified approach.

This isn't even touching on the lack of viable long term platforms out there. I'd love for people to move to Lemmy. But realistically speaking Lemmy is very immature, instance owners are confronted with new bugs every day, not to mention the costs of hosting an instance. That also ignores the piss poor state the moderation tooling is in on Lemmy. The same is true for many of the possible other "alternatives".
All the new attention these platforms have gotten also means they are getting much more attention from developers. So things might change in the future for the better, in fact I am counting on it. But that isn't the current state of the fediverse. Currently most of the fediverse, specifically Lemmy is still very much in a late Alpha maybe early Beta state as far as software stability and feature completeness goes.

And, yes, the situation on reddit is degrading and this latest round of things has accelerated something that has been going on for a while. But at the same time Reddit is the platform that has been around for a decade and where the currenty community is. Picking that up and moving elsewhere is difficult and sometimes next to impossible. I mean we haven't even talked about discoverability of communities for regular users.

Lemmy (or any fediverse platform) isn't exactly straightforward to figure out and start participating in. If you can even find the community you are looking for. Reddit also hosts a lot of support communities, who benefit from reddit generally speaking having a low barrier of entry. Many of those wouldn't be able to be as accessible for the groups they are targeting on other platforms.

[–] [email protected] 1 points 1 year ago

As is often the case there is more nuance to this. As others have pointed out, it is still possible to run your own mailserver if you really want to.

But, there are also other options that aren't google, microsoft or any other service.

I personally have registered my own domain and have my mail hosted by mailbox.org. If I am ever dissatisfied with them I can simply pick a different mail hosting provider and move my domain there. Other privacy minded providers can be found here: https://www.privacytools.io/privacy-email

And there are also more options if you just want reliable mail and care slightly less about overall privacy. Fastmail for example is a popular choice.

Yes, these are not free. But neither is hosting it yourself as that costs you the VPS/container to host it and a bunch more time and effort.

What it does provide you with is the ability to no longer use big tech while allowing you to mail with people still having their mail hosted there.