TechLich

It's not that it's on the 172.16.0.0/12 range. That's totally normal and used for all kinds of stuff.

It's that it's in 172.16.42.0/24 which is the default dhcp settings for a wifi pineapple. It's the /24 mask given on the .42 that's a little suspicious because that's not a common range for anything else.

Being assigned one of those specific 253 hosts with that subnet mask would definitely make me think twice.

Pretty sure it's an autocomplete (like copilot or something)

They were typing

progress != "Hold"

And the ai autocomplete suggested

progress != "Hold onto your butts!"

Hence why the completion part is in grey (it's a suggestion)

By the sounds of it their entire video team left. So not half of the channel gone, but all of it...

No, that's "Monk"

A manc is a place where you can go to deposit your money and get home loans and stuff.

What was the original text‽

It does sound very strange. What kind of anti-China content would ever help a student's application process? Most of the application documents are about things like English language competency, visa requirements and prior qualifications, not political opinions.

How about pseudonymous as a compromise? Votes could be publicly federated but tied to some uuid instead of the username. That way you still have the same anti spam ability (can see that a user upvoted these things from this instance at this time) but can't tie it directly to comments or actual user accounts without some extra osint.

It might be theoretically possible to correlate the uuids with an account's activity and dox the user in some cases, especially with some instances having a single user, but it would be very difficult or impossible to do on larger instances and would add an extra layer. Single user instances would be kind of impossible to make totally private anyway because they can be identified by instance.

I feel like this a cultural thing because that sounds wild to me.

The penalty for burglary where I am is not death, nor am I a judge or executioner.

We've been broken into a lot and it's usually just some poor asshole who wants to steal things to buy meth. It's horrible and scary and feels like a massive violation but shooting someone in that scenario just feels like straight up murder.

I guess eternal life through some profane kind of undead cyborg magic... Bad maybe?

Interesting. I remember there being fewer ads but the ones that did exist were worse. Bright colours, flashing, blink tags, 3-frame epilepsy inducing animated gifs... "You are the 10000th visitor!" Some in the mid to late 90s would pop-up new windows or even start autoplaying sound...

They've almost certainly considered doing that but I suspect it's a legal thing. Saying "Trump is a rapist" can be seen as claiming that "Trump was convicted of rape" which is not true so it gives them space to sue over a knowingly false defamatory statement (whether he'd win or not, it would be expensive and might halt the ads while it was being litigated)

Saying "Trump was found liable in a civil sexual assault case" doesn't have as snappy a ring to it and leaves Republicans saying bullshit like "well if he was really a rapist he'd be in jail/it's just corrupt civil court judges trying to make him look bad."

But saying "look at this silly footage showing that Trump is a numpty. What a silly crazy clown man" is depressingly more effective at making swing voters not want to vote for him. "Trump is evil" works for people who know he's evil but "Trump is a fool" works better for people who are willing to believe that the "evil" stuff might be overblown lies from his opponents' smear campaigns.

They're not files, it's just leaking other people's conversations through a history bug. Accidentally putting person A's "can you help me write my research paper/IT ticket/script" conversation into person B's chat history.

Super shitty but not an uncommon kind of bug. Often either a nasty caching issue or screwing up identities for people sharing IPs or similar.

It's bad but it's "some programmer makes understandable mistake" bad not "evil company steals private information without consent and sends it to others for profit" kind of bad.

"Toad in the Hood" is the gritty HBO sequel to "The Wind in the Willows" that takes place after Toad breaks out of prison.

Best is very subjective.

.world is a good general purpose instance for just about anything. I think it has the biggest population at the moment, so communities there are likely to get at least some engagement.

For "general discussion" it doesn't really matter. The instances are federated so you'll likely get general discussion in comments from lots of people from lots of instances anyway, wherever your community is based.

Some people get almost nationalistic about their chosen instances or have grudges against people from certain other instances. There's sometimes inter-instance politics with some servers defederating with others or threatening to for various reasons. It's kinda fun to watch in a popcorn drama kind of way. For the most part, the instance doesn't matter.

You can see it's still grammatically plural even when used as a singular with the other words that go around it too. "You are" instead of the singular "is".

It can even make singular things kinda behave like they're plurals. Like "The Lemmy user is posting comments" vs. "you, the Lemmy user are posting comments"

Back in the day it was "thou art posting comments" (singular) and "ye are posting comments"(plural). With "ye" becoming "you" over time. Although they also had more funky letters like ȝ and þ and stuff.

That's pretty cool!

Although that's probably what op is actually asking for, I don't think it's a modem. It's a router with an access point.

It does have SFP for a fibre connection and pcie and USB for you to potentially add a modem or whatever else you want.

I'm guessing OP is just looking for a wifi router? Otherwise we'd need to know what kind of modem they're looking for, like Cellular? VDSL? HFC? Satellite? It depends on the internet connection. Different parts of the world need very different kit.

I was going to come up with something fun and clever to keep it going but the next line of the real song starts with "cream-coloured ponies" so I think we should probably just leave it here after all.

There are some of the internet's things that we don't need to enumerate.

Not American, or really knowledgeable about it but from the outside, I think this looks like ordinary politicking.

IVF is a proxy war for abortion. Dems want the talking point that abortion bans hurt/block IVF. Republicans/Trump want to remove that talking point by saying they love IVF "we want more babies right?" and will support laws to protect it as a separate and unrelated issue to abortion.

Dems put forward a bill that not only protects it but makes insurance companies pay for it. Trump is fine with that because it benefits him but Republicans in Congress get big money from insurance lobbyists and so they can't vote for it. They also have fears that they'll piss off their homophobic supporters by making them pay for something the gays might use (insurance costs will go up to help someone who isn't me!").

Republicans put forward another bill that protects IVF without hurting their insurance company buddies but the Dems block it. Republicans then have to vote against the IVF bill and the Dems can now say "see! They really don't care about reproductive rights at all!"

Feels a bit like nobody involved actually cares about IVF at all and just wants votes and lobbyist money.

In case this take comes across too centrist: Republicans and Trump are really quite shit.

There absolutely isn't a good case and he'd probably lose because he's a rapist, but there's potentially enough wiggle room there that such a lawsuit might not get thrown out immediately which is potentially expensive and could get ads taken down while it proceeds.

I could be wrong, maybe they do run ads based on the rape but they might not think it's worth the risk for the reward if ridicule is more effective in their research.

Yep, 100%. It's probably safe to call it like it is and he doesn't have a great track record with lawsuits at the moment. That said, they might still just not want to take the risk if their research is showing that painting him as a fool who you wouldn't want in the job is more effective with people who might change their minds.

I think the idea is that there are potentially alignment issues in LLMs because it's not clear what concepts map to what activations. That makes it difficult to see what they're really "thinking" about when they generate text. Eg. if they're being misleading or are incorrectly associating concepts that shouldn't be connected etc.

The idea here is to use some mechanistic interpretability stuff to see what text activates what neurons in an LLM and then crowd source the meanings behind that and see if that's something you could use to look up some context from an ai. Sort of trying to make a "Wikipedia of AI mind reading"

Dunno how practical it is or how effective that approach is but it's an interesting idea.

Totally agree on all points!

My only issue was with the assertion that OP could comfortably do away with the certs/https. They said they were already using certs in the post and I wanted to dispel the idea that they arguably might not need them anymore in favour of just using headscale as though one is a replacement for the other.

Tailscale isn't an exposed service. Headscale is

Absolutely! And it's a great system that I thoroughly recommend. The attack surface is very small but not non-existent. There have been RCE using things like DNS rebinding(CVE-2022-41924) etc. in the past and, although I'm not suggesting that it's in any way vulnerable to that kind of thing now, or that it even affected most users we don't know what will happen in future. Trusting a single point of failure with no defence in depth is not ideal.

it's more work and may not always be worth the effort

I don't really buy this. Certs have been free and easy to deploy for a long time now. It's not much more effort than setting up whatever service you want to run as well as head/tailscale, and whatever other fun services you're running. Especially when stuff like caddy exists.

I recommended SmallStep+Caddy.

Yes! Do this if you don't want to get your certs signed for some reason. I'm only advocating against not using certs at all.

Are you suggesting that these attack techniques are effective against zero trust tunnels

No I'm talking about defence in depth. If Tailscale is compromised (or totally bypassed by someone war driving your WiFi or something) then all those services are free to be impersonated by a threat actor pivoting into the local network after an initial compromise. Don't assume that something is perfectly safe just because it's airgapped, let alone available via tunnel.

I feel like it's a bit like leaving all your doors unlocked because there's a big padlock on the fence. If someone has a way to jump the fence or break the lock you don't want them to have free reign after that point.

there's an argument that HTTPS isn't really required...

Talescale is awesome but you gotta remember that Talescale itself is one of those services (Yikes). Like all applications it's potentially susceptible to vulnerabilities and exploits so don't fall into the trap of thinking that anything in your private network is safe because it's only available through the VPN. "Defence in depth" is a thing and you have nothing to lose from treating your services as though they were public and having multiple layers of security.

The other thing to keep in mind is that HTTPS is not just about encryption/confidentiality but also about authenticity/integrity/non-repudiation. A cert tells you that you are actually connecting to the service that you think you are and it's not being impersonated by a man in the middle/DNS hijack/ARP poison, etc.

If you're going to the effort of hosting your own services anyway, might as well go to the effort of securing them too.

Yeah, that's fair enough, though I'm not sure it's very different from malicious instances creating normal user accounts?

You can see when users from an instance are all suspiciously voting the same way at the same time regardless of whether they are usernames or IDs.

There's lots of legitimate users that only vote but never post so doing it based on that doesn't seem very effective?

The second problem is solved using public key cryptography, the same way that you can't impersonate someone else's username to post comments. Votes and comments are digitally signed (There would need to be a different public key for voting to maintain pseudonymity though).

You forgot interrobang‽ The most important and incredulous reason for a compose key.

I don't think that's how it works? It's the client application that has the key for the end to end encryption, not the server. I don't think you need to trust the matrix server you use? I could be wrong, I don't know matrix particularly well.

True! It's not just a Latin thing and Slavic languages have it too. I wonder where it came from originally. Probably one of those Proto Indo European things. Though it's in some Indigenous Australian languages too (though not all) so might be even older?

Yep. Most Latin languages have gendered nouns. Italian, Spanish, German etc. All have masculine/feminine objects.

Eg. In Italian a fork is feminine (la forchetta) but a spoon is masculine (il cucchiaio). A table in your living room is a boy (il tavolo) but a table that you're eating lunch on is a girl (la tavola).

It's bizarre.

Hmmm...

That looks pretty paywally to me. That said, I'm all for people supporting independent media.