Slashdot Mirror

Tox is a free and open-source, peer-to-peer, encrypted instant messaging and video calling protocol. The stated goal of the project is to provide secure yet easily accessible communication for everyone.

https://en.wikipedia.org/wiki/Tox_%28protocol%29

https://tox.chat/

https://github.com/tux3/qTox

http://utox.org/

True, but you should be aware that by a surprising coincidence a very similar bug has been found in LibreCrypt at the same time as this TrueCrypt bug.

They should rename it "Adblock Plus Ads".

uBlock Origin woooooo!

uBlock Origin is open source. It has worked fairly well for me and is supported in most browsers. What it blocks though, like most programs, is based on the blocklists you load into it so you may have to find some to your liking if the defaults don't block enough for you. I haven't noticed any problems with the defaults lists in terms of advertisements getting through and I think it should be fairly effective when combined with Ghostery.

The 10" 2-in-1s [like ASUS Transformer Book T100] have a whole bunch of things not working in Debian

Debian is but one choice. Linux Mint or Ubuntu or openSUSE work with about everything

Key word: "about". I looked at the instructions for getting Linux Mint up on a Transformer Book, and it appears you have to buy a compatible USB NIC and plug it in so that you can download the driver for the built-in Wi-Fi. I looked up Ubuntu, and Wi-Fi is "buggy" and suspend is "not working". Nor has anyone had luck with openSUSE. Google couldn't turn up anything about PC-BSD on the T100; I can't tell whether this means it "just works" or just that nobody has tried it. I wouldn't bet on the former.

The problem, as I see it, is that by doing it in Javascript, we're introducing a new dependency: the code will only work on a browser produced in 2015.

Well you can rest easy then, because no one is writing this stuff in JavaScript.

What triggered this change is Emscripten, which is a back end for LLVM that targets ... JavaScript. Actually it targets asm.js, which runs at about 1/2 native speed in Firefox (not so fast in Chrome, because Google thinks the solution to the same problem is NaCl).

What that means is any compiler that uses LLVM can now compile to asm.js. Which means any program written in Python, Rust, Go (there are a whole pile of languages) can now be compiled to run in the browser. In particular Clang is a C compiler for LLVM. Dosbox is a x86 + MSDOS emulator, written in C. Ergo Dosbox can now be compiled to JavaScript and this run in the browser. Js-dos is a site apparently dedicated hosting games that does just that. The game console emulators are also written in C. So they to can and now have been compiled to asm.js. Because modern web browsers support WebGL, OpenGL games that have been open sourced (like Quake3) have also been compiled to JavaScript, and run spookelly well. Which is how we get to the plethora of games mentioned in the article. Pity it didn't mention the technology behind it.

But why stop a games? Sqlite3 has been recompiled for Javascript. It can do in browser SQL queries in about 2ms, and is a damned site nicer to use than wandering through a spiderweb of Javascript objects. But why stick to something sane? You can now do ffmpeg encoding in your browser.

"It's theoretically possible for dm-crypt/luks to have a MacOS, WIndows, and FreeBSD driver (which would also probably require the filesystem drivers, as ext4 isn't well supported on those either), but it's not easy."

For Windows, you mean like https://github.com/t-d-k/Libre... (previously http://sourceforge.net/project...)

The VeraCrypt commits fixing the 2 "undisclosed" vulnerabilities:
https://github.com/veracrypt/V...
https://github.com/veracrypt/V...

The VeraCrypt commits fixing the 2 "undisclosed" vulnerabilities:
https://github.com/veracrypt/V...
https://github.com/veracrypt/V...

I followed this guy and used one of these to connect and got from bare metal to single stepping blinking an LED. I leave the rest as an exercise for the dedicated student ;-)

I'm definitely all for reducing firefox's memory footprint. It's definitely a memory hog. But if you use your hosts file or DNS to do your adblocking, then it works with all browsers. Heck, if you control your router, and you put the blocking in DNS there, then you get it on all of your computers. Currently, I use unbound with https://github.com/jodrell/unb... on a cronjob to update the block list regularly, and all of my browsers are free of ads without having to figure out the best way to block ads in each browser - or having to worry about how it affects firefox's already ludicrous memory footprint.

And at this point it doesn't follow its own guidelines.

And at this point it doesn't follow its own guidelines.

Unlike Hacker News, most of us here aren't 17-year-old Ruby on Rails wannabe "CEOs" who've been tricked by all of the Rust hype. We're seasoned professionals with decades of programming, software design, system administration and network administration experience. We're comparing Rust against C++ and many other languages, and it does not fare well at all.

Rust is a disappointment. It took many years to get to 1.0. Even then, the one single implementation is shitty. Its compiler, which is implemented using Rust, is slow to the point of making C++ compilers look blazing fast. It's full of bugs, despite all the claims about Rust's safety and quality benefits and all that. The standard library is lacking, even compared to C++'s, which isn't very good either. Rust's learning curve is steeper than C++'s, especially when it comes to the ownership semantics, which makes it less practical for average programmers. The documentation is unremarkable. The syntax isn't very good, even compared other languages with a C-style syntax. The community is rather snobbish, and more focused on political correctness and codes of conduct than they are on competing with C++ and other languages. Most of its third-party libraries are woefully incomplete, outdated, or totally amateurish. Process-terminating panics are far too common when using Rust programs, including the Rust compiler itself!

Even the claims about memory safety aren't even relevant today, because you can get about the same level of safety using modern C++ techniques, all without the inconvenience and problems that you get when using Rust.

Yes, smart people here do dislike and speak out against Rust. Rust fails to compete effectively with C++ and other languages. There's no reason to use Rust when you're better off using modern C++ or some other language.

Shameless self-plug
BigDecimal ported to Javascript https://github.com/doublebacks...
If you ever need it again

Every object that can be thrown/caught must implement the Throwable interface

Then have all exceptions extend a subclass of std::exception . The guidelines mention use of a subclass as opposed to using the built-in exceptions directly.

the C++ alternative is only allocating objects on the stack and implementing destructors that clean up their resources

Also called Resource Acquisition Is Initialization (RAII), or "automatic resource destruction" if you don't want to remind readers of the record industry (RIAA).

but then you have the restriction of not being able to allocate on the heap

You can take advantage of automatic resource destruction if you wrap your object on the heap in a smart pointer type (std::unique_ptr or std::shared_ptr as appropriate) on the stack. If that isn't appropriate in a given situation, C++11 supports a scope guard idiom using std::shared_ptr and lambda expressions. The finally factory described in the Guidelines is ultimately an update of a method described in a 2000 article by Andrei Alexandrescu in Dr. Dobb's .

Every object that can be thrown/caught must implement the Throwable interface

Then have all exceptions extend a subclass of std::exception . The guidelines mention use of a subclass as opposed to using the built-in exceptions directly.

the C++ alternative is only allocating objects on the stack and implementing destructors that clean up their resources

Also called Resource Acquisition Is Initialization (RAII), or "automatic resource destruction" if you don't want to remind readers of the record industry (RIAA).

but then you have the restriction of not being able to allocate on the heap

You can take advantage of automatic resource destruction if you wrap your object on the heap in a smart pointer type (std::unique_ptr or std::shared_ptr as appropriate) on the stack. If that isn't appropriate in a given situation, C++11 supports a scope guard idiom using std::shared_ptr and lambda expressions. The finally factory described in the Guidelines is ultimately an update of a method described in a 2000 article by Andrei Alexandrescu in Dr. Dobb's .

The author of XcodeGhost released the source after they heard what was happening. It includes an apology at the bottom (in Chinese) that makes it seem like it was just a proof of concept and he had no intention of it getting out but was picked up and spread via Baidu by others.

The PoC angle would explain why it looks so damn much like any other basic analytics package. This is also likely why Apple's app scanners didn't pick it up, it doesn't do anything that's not permitted. The only weirdness is that it tries to hide from the debugger, but that's also done by legitimate apps that use DRM.

I found about about the code on GitHub from a fellow Mac/iOS developer/reverse engineer. As for getting samples of the actual infected Xcode, the author of the Palo Alto Networks article uploaded it to his DropBox account so others could confirm the findings and detect the malware. That's where I got the infected Xcode from for my own tests.

It's actually the opposite. It's much, much less malicious that people say. The source code is available.

For one, it cannot be used for phishing attacks. The UIAlertView is shows has no text input fields and it never attempts to get anything from the dialog other than the integer value of the button that was pressed.

It also cannot get the UDID of the device because it uses -identifierForVendor which is a UUID that is specific to that specific app, so it can't be used to track users. iOS can and will change it.

It can't be used to dial premium services either as iOS always shows a dialog when opening telephone URLs and iOS 9 always shows a dialog when using URLs that open another app. But the fact it can open Twitter so what? It can't do anything with that. It can't control Twitter.

This functionality was actually designed to open the App Store so the user can review/rate the app or to show users similar apps.

It's even significantly less bad than most ad/analytics packages.

It's actually the opposite. It's much, much less malicious that people say. The source code is available.

For one, it cannot be used for phishing attacks. The UIAlertView is shows has no text input fields and it never attempts to get anything from the dialog other than the integer value of the button that was pressed.

It also cannot get the UDID of the device because it uses -identifierForVendor which is a UUID that is specific to that specific app, so it can't be used to track users. iOS can and will change it.

It can't be used to dial premium services either as iOS always shows a dialog when opening telephone URLs and iOS 9 always shows a dialog when using URLs that open another app. But the fact it can open Twitter so what? It can't do anything with that. It can't control Twitter.

This functionality was actually designed to open the App Store so the user can review/rate the app or to show users similar apps.

It's even significantly less bad than most ad/analytics packages.

The Encyclopedia of Life is geared more toward the public http://eol.org/. The cool thing about the effort in the open tree of life ( http://opentreeoflife.org/ ) is that it is open data and open source driven. You can check out the code on github. https://github.com/OpenTreeOfL...

You can see how it's done in Mantle, which is going to be pretty similar to Vulkan, there's also hello triangles of Directx12 which is also similar in ways. https://github.com/Overv/Mantl...

It's not that Google or Thawte have failed to correctly revoke certificates: it's that far too many people, at far too many sites and with far too many technologies, do not actually keep their signature authorities up-to-date. Because these people don't update signature authorities, they are unable to verify numerous valid certificates. These people then simply set their automated procedures, or make it their personal practice, to accept invalid certificates.

There's a second problem: How the hell does one validate a certificate? There's no out-of-band communication - there's no way to do something as simple as googling "gmail TLS fingerprint" and getting the right answer, and I'm looking at you, Google Security Blog -- why do you not publish the signatures when you rotate the keys?

Homework assignment: Try this.

msmtp --port=587 --serverinfo --host=smtp.gmail.com --tls=on --tls-certcheck=off

Should the SHA1 fingerprint end in 7e:60 as this IBM thread or this stackoverflow thread?

Or should it, as the guy in this thread observed and I was able to replicate, end with 05:4c?

Or should it still be this guy who says it ends in 69:a8, and which I observed with my own eyes about a year ago and commented out when I saw random people on the 'net confirming they'd rotated to the key ending in 7e:60?

Yes, I know web pages can be compromised by bad actors.

And I know connections to web pages can also be MITM'd by even worse actors.

Certificates are broken without out-of-band communication, and Google has, by ignoring the issue, made it effectively impossible to do out-of-band communication. What is the correct TLS fingerprint for smtp.gmail.com? Will it be the same in 5 seconds? How many "correct" fingerprints are there?

I might be subjective as I'm the author of it, but this somewhat remind me of my http://mdoc.su/ project, which is what I call a deterministic URL shortener, or, perhaps, better yet, a semantic URL provider.

The whole source code is an nginc.conf configuration file, and is just a bunch of regular expressions and `rewrite` and `location` rules, available under an BSD/ISC licence, of course -- that's the one that comes with "no strings attached", BTW!

http://mdoc.su/
http://mdoc.su/FreeBSD-10.2/fs
http://mdoc.su/f102/resolvconf
http://nginx.conf.mdoc.su/mdoc...
https://github.com/cnst/mdoc.s...

Then I guess it is a good thing the repo is on github: https://github.com/JetBrains/i...

If you are looking for open source options you can try BlockParty - https://github.com/krishkumar/... and Adios - https://github.com/ArmandGrill.... You no longer need a developer's license to deploy software to your own iOS devices. I've been using Adios on a device that doesn't officially support content blocking (as per Apple's rules) and it works fine.

If you are looking for open source options you can try BlockParty - https://github.com/krishkumar/... and Adios - https://github.com/ArmandGrill.... You no longer need a developer's license to deploy software to your own iOS devices. I've been using Adios on a device that doesn't officially support content blocking (as per Apple's rules) and it works fine.

You can do it but that would cost you a lot of money as the amount of data stored is limited to 80 bytes per transaction and the transaction fee is proportially of the size of the transaction.
1 gig of data would be 12.5 millions transactions.
If you spend 0.00001 BTC in fee per transaction that would cost you 125 BTC or 28 426$ :)

And you could start with the motionpie distribution for the Pi, which includes 'motion', a motion detection camera program, and a way to view multiple cameras on one page.

The instructions on the last page link to this gist that states that you still need to compile your own GRUB to boot, compile your own kernel to get the keyboard working, and buy and connect a supported USB NIC in order to install Git and the driver for the built-in WLAN adapter.

If a specific app has some function that is important to you, make sure it's unchecked on tbe settings page. That UI has implemented here:

https://github.com/hushnymous/...

Have you actually tried Rust or Servo? You must not have, because if you actually had, you wouldn't have portrayed them in such a positive light.

Like Ruby, Rust is nothing but hype. This isn't surprising, of course, because some Rubyists jumped ship to Rust when it was clear that Ruby was sinking. If you buy into the hype, Rust sounds great. But if you actually give it a try, you'll find out that it's quite a different story.

For a language that's supposedly so "fast", its own compiler, which is mainly written in Rust, is fucking slow! I mean, I find C++ compilers to be slow. But Rust's compiler makes them look fast, it's so slow. Unlike with C++ compilers, where there are multiple production-grade compilers you can try, there's only one implementation of Rust. So if it's too slow for you, then you're out of luck!

The compiler and standard library, which also contains lots of Rust code, are both really buggy. Some bugs are to be expected, but in a language that's supposedly so focused on "safety", its one and only implementation has almost 2,200 open bugs! The various libraries from other developers are often pretty bad, too. Don't be surprised if you find several incomplete libraries that allege to do whatever basic task you want them to accomplish.

Then there's the language itself. It doesn't live up to the hype. The syntax is mediocre at best. The borrow checking is awkward to work with, even when you fully understand it and have experience with it. The learning curve is quite bad, even by C++'s standards, so don't expect anyone unfamiliar with it to get up to speed quickly, especially if this person is just an average programmer.

You're better off just using modern C++. The compilers are better. The libraries are better. The language is better. And if you use the various smart pointer classes instead of regular pointers, you can get almost all of the safety that Rust supposedly brings, without the pain of Rust.

It's much the same case for Servo. It's all hype and so little substance. Just doing some basic rendering isn't that impressive. Using Rust for this shitty below-demo-quality renderer isn't impressive, either. Just like how Rust 1.0 was delayed again and again and again and again, I think we will see the same thing happen with Servo. It will perpetually be behind Firefox, which is perpetually behind Chrome and Edge these days.

Rust and Servo are just distractions that have prevented Mozilla from fixing Firefox. The smart thing to do would have been for them to start using C++14 for Firefox, and using modern C++ techniques to replace their 1990s-era cruft. They would have had a better browser out sooner doing that. But instead they'll likely spin their wheels using Rust and Servo, doing a shitty job of patching them in to Firefox. It likely won't matter, though, because by that time Firefox's share of the market will have dropped to close to 0%.

There is an open source solution I used a few months back called shenidam. It's a little slow, but it works! The best use case is onboard camera audio and separate sound. You give shenidam source video and separate audio, and it matches and muxes automagically. The result: a video file with separate audio synced perfectly. Check out the website and source code on github.

Just run a batch file

https://github.com/WindowsLies...

here: https://github.com/WindowsLies...

https://github.com/allisonnico...

aardvarkjoe's Bennett blocking script

If they actually want to support open codecs

Microsoft supports Opus because they have IP in it via their purchase of Skype. And Microsoft has joined the Alliance for Open Media to participate in the development of the video codec to follow VP9, which will be built from the best features of Thor, Daala, VP10 and whatever anyone else brings to the table.

A multi-trillion dollar industry is hardly clutching at straws.

Except that multi-trillion dollar industry has nothing to do with software freedom, that is why Linux's license preamble exists and why Linux does not do the FSF's copyright assingment. You have obviously also never read Linus' discussions on why he chose the GPL (hint: it has nothing to do with software freedom), the information is all there (on lkml and others) so you are just being ignorant.

Rather, what I see from you is denial.

What you see is your distorted world-view that is not representative of the facts. You choose to be blind and that is your loss, I have given you links to help educate you but you don't want to be educated you just want to remain clueless.

More like the entire internet which these days is mostly Linux powered, and Linux got where it is in large part because of the GPL, which is the work of RMS.

This is the sort of clutching at straws that the FSF advocates do these days, cling to the success of Linux as an attempt to demonstrate relevance. Linux's use of the GPL was purely for "tit-for-tat" wrt code, that is all. None of the other freedom stuff is involved, in fact the Linux license is not GPL anyway, it has specific exemptions in the COPYING file that explicitly overrride the "freedom" restrictions of the GPL to allow non-free software to be integrated with the kernel.

If Linux had just used the GPL then it would have failed. It succeeded because it avoided RMS's idealistic provisions.

Which should honestly make us wonder if these solutions are trustworthy. What do Google or Yahoo have to gain from cutting off their own access to their users' email contents? If they're willing to not scan their users' email, they could start by no longer scanning their users' email, today.

There are many different ways for Google to subvert this system, being that it is an extension that runs in Google Chrome, stores the keys in Chrome, and will assumedly be provided and (silently) updated by Google. The OpenPGP spec itself allows for options like "--hidden-encrypt-to", so unwary users could still end up sharing all of their information with Google or whoever else.

TL;DR - Why should we trust Google or Yahoo here?

It's GPL. The community page makes that a bit clearer. Now I do believe they have some proprietary extensions for something but I can't seem to remember what now...
http://www.zentyal.org/server/
https://en.wikipedia.org/wiki/...
https://github.com/Zentyal/zen...

I used the script here from Github: https://github.com/WindowsLies...

Reading the bat file seems to take care of most of what is listed above. I did notice one of my scheduled tasks in the Media Center entries was still enabled after running the bat file, but I hope this helps.

I was looking at this recently; this should turn off and block much of it:

Turn off CEIP, Uninstall updates, and then hide telemetry updates to prevent re-install:
http://www.pcworld.com/article...
Note: my "CEIP" setting was opted-out, but I still received two of those updates. So the "you don't get these updates if you're not in CEIP" assertions are incorrect, at least in my case.

Turn off CEIP reporting services:
https://pubs.vmware.com/view-5...

I kept having that "Update Windows 10" (GWXUX) service crash, so I turned it off using the registry update at the end of this article, leaving myself the opportunity to reverse the process and upgrade later if desired:
http://www.howtogeek.com/21885...

If you want to block windows 10 telemetry using a quick and dirty private DNS server, along with ad and malware blocking, install dnsmasq on a computer (maybe a raspberry pi if you're going for cheap, I'm using a VM on a test bed computer in bridged mode for this experiment):
https://www.linux.com/learn/tu... ...and block using an amalgamation of HOSTS files from here:
https://github.com/StevenBlack...

It's a python script that gets a few HOSTS files on the net and de-duplicates them into a mega crap-blocker list. The resulting list includes tens of thousands of DNS lookups that will be blocked at the perimeter of your network, so it could cause some web pages or software to break they depend on sites blocked by these lists. You can prepare you own windows 10 specific HOSTS file using entries from http://someonewhocares.org/hos... and those listed in articles about this issue if you feel paranoid. Windows can side-step your hosts file, but not your DNS server!

Stating the obvious: you'll want to leave the quick and dirty DNS behind your firewall/router, not expose it to the Internet.

Examples of systemd breaking the kernel include the "debug" logging option, and the inevitable failures of such a complex weave of components killing PID 1.

              https://bugs.freedesktop.org/s...
              http://ewontfix.com/14/

Unfortunately, "running syslogd in parallel" doesn't work well as new daemons or services are compiled for one or the other. And I'm afraid the code to integrate with systemd logging is a tar-baby: it becomes very difficult, very quickly, to maintain separate logging, but the logging is not portable to UNIX based operating systems. And that change is breaking portability for new projects even as I write. If you're willing, take a good look at the latest httpd source code to see what's happening to logging there.

And yes, systemd is trying to replace "su". See the comments by systemd's core author, Leonart Pottering, at:

              https://github.com/systemd/sys...

It's particularly amusing in those comments that Lennart Potteroing thinks that Linux is UNIX. UNIX is trademarked, licensed, and applies only to systems that follow various POSIX standards, and there's a fascinating history of lawsuits about this involving the SCO Group, which tried to claim that Linux was a UNIX descendant. Old material on this is at:

              https://www.groklaw.net/

I can understand why hearing these issues voiced again could be tiresome, and not all concerned developers are well informed. But rejecting all concerns as being "information from trolls" ignores the very real and often unnecessary problems systemd is creating.

d3.js users can use the built in functions for HCL/Lab https://github.com/mbostock/d3...

As for not being production ready, the Joyent IaaS solution SmartDataCenter heavily uses Node.js
It is used on many public / private cloud including Joyent public one..

An almost entirely awful one that is the only choice on the browser

The gimmick here is that using the same language on both sides of the fence lets you re-use some of your code

That language doesn't actually have to be JavaScript.

If you really need the proprietary add-on bits then do what YOU'RE PAYED TO DO and build them yourself.
https://github.com/JetBrains/i...

It's YOU that chooses to give JetBrains, not them.

Link to the actual repo:

https://github.com/Netflix/sle...