Komunitas
kbin.social
Gog.com are selling DRM-free games, so there’s no copy protection, Internet activation, mandatory launcher, etc. It used to stand for “good old games”, but they also have new titles these days. Same parent company as The Witcher developers. There is a launcher, but it’s entirely optional - you can just pay prices that are generally comparable to Steam and download the installation files for a game, which require no Internet connection at all (apart from some edge cases, e.g. a very small number of multiplayer games). Gog-games meanwhile is a piracy site that redistributes these DRM-free installers to people who are not inclined to pay for the privilege. What makes them preferable to other sites is that you get the trustworthy installers from gog and do not have to fiddle with potentially malicious cracks yourself. They are also uploading to fast file hosts. One thing they are particularly useful for is preservation, games that are now delisted on gog.com and elsewhere, only available there if you have purchased them in the past. The rather decent licensed Back to the Future game from Telltale for example can’t be bought anywhere anymore (since the license for the movie franchise was only granted for a few years), but it’s still available in its most convenient shape on gog-games.
Komunitas
lemmy.ml
I didn’t add the google tools to my LineageOS install, so I don’t have the play store. Would kind of like Cash App, my bank app, etc, but don’t want to download from a random site for obvious reasons. For instance, cash app is available here. Is there a trustworthy source for these kinds of apks? Or does everyone just use websites/do without.
Komunitas
lemmy.world
The whole Project 2025 was online long before the election. Complete, for free for everyone to download and read. It’s all written down. I bet my ass that not one MAGA and very few humans read this. It starts bad and only gets worse down the road. It’s like good satire, because no one would be that stupid, that reckless, that inhumane, that sadistic or that shameless to really push through, what is described in Project 2025. I read it before the election and was sure, that that was the end of MAGA. I was so wrong, that i lost trust in common sense among humans. Turns out, that without law or rules, people really turn into animals.
Komunitas
lemmy.world
| Software | Description | |-----------------------|-----------------------------------------------------------------------------| | LocalSend | Open-source AirDrop alternative for transferring files wirelessly via Wi-Fi. | | Obfuscate | Rust-based app for quick and intuitive redactions on sensitive photos. | | Floorp Browser | Privacy-focused browser forked from Firefox with customizable workspaces. | | Dosage | Medication management app with reminders and inventory tracking. | | AB Download Manager | Cross-platform downloader supporting batch downloads and browser integration. | | Cartridges | Game launcher supporting multiple platforms and sources like Steam and Lutris. | | Zen Browser | Firefox-based browser with innovative tab management and split-view mode. | | RustDesk | Secure, cross-platform remote desktop client with self-hosting capability. |
Komunitas
lemmy.dbzer0.com
I do miss the days when you could just download a keygen and get something licensed. Nowadays most keygens are just virus/malware installation packages unfortunately, with a few exceptions. To be honest it’s probably easier and safer to just use one of the repacks from a trusted source since they are ‘precracked’ and that work has been done for you.
Komunitas
lemmy.bestiver.se
I’m in my first month of a paid GitHub Copilot Pro subscription. I had great success using GPT 4.1 to translate a Haskell project into OCaml; GPT 4 saved a couple days of effort on a week-long task. (In reality, I routinely underestimate how long projects take, so I probably saved a much larger amount of time). From there it was easy to pay for the first month of Copilot ($10 USD/mo). But I quickly realized that asking Copilot to do anything was very disruptive. I don’t do well with interrupt-driven development; I have a productive mental zone that takes several minutes to enter, and asking questions to an LLM breaks that zone. So my first month of LLMs has been trimmed down to just autocomplete in VS Code. One of my current tasks is to test a home-brewed, JSON build system. And one of my tests is to download, extract and normalize uutils (Rust-ified versions of ls, find, etc.) for multiple architectures. And no surprise, I quickly found my build scripts were repeating mostly the same thing with slight variations. I start typing the first item in a JSON array: "get-asset-file [email protected] -p coreutils-0.2.2-aarch64-apple-darwin.tar.gz -f coreutils.File.Darwin_arm64.tar.gz", and Copilot fills out the other JSON items: "get-asset-file [email protected] -p coreutils-0.2.2-x86_64-apple-darwin.tar.gz -f coreutils.File.Darwin_x86_64.tar.gz", "get-asset-file [email protected] -p coreutils-0.2.2-aarch64-unknown-linux-gnu.tar.gz -f coreutils.File.Linux_arm64_gnu.tar.gz", ... 6 more ... The auto-complete was accurate; in fact, it was more accurate than I would be. It also saved me lots of typing, and as an unapologetically lazy programmer I might call that a win. But it was not a win. The repetition was the direct result of the structural deficiency with overly simple build systems: they lack looping constructs. The proper thing to do is to use a loop over a map/table/dictionary, and in my case in particular that means I must do the grunt work of integrating some small language like Lua that can do loops. Does Copilot suggest the right thing? Of course not, at least without me prompting it first. Deeper thought: Conventional next-token prediction trains LLMs to produce words, not remove words. In our childhood training to become effective communicators, we learn when producing words is necessary; we also learn brevity. And as software engineers, we learn brevity is a good thing as we reduce repetitive lines of code into a loop. My first month: I have never seen the LLM autocomplete a repetitive block of code into a simpler loop. So, I’d love to see an explicit counter-bias during training to simplify and remove words. I could ask the LLM to simplify code. That might work (though not because the model is structurally aware of how to simplify code). Regardless, if I’m going to pay for a tool to suggest things to me, I shouldn’t have to suggest code simplification to the code suggestor. I’m going to keep paying the $10 even if I don’t find auto-complete that useful. Copilot has already paid for itself. But I’m left thinking that today’s LLMs have over-indexed on the wrong objective. Thoughts?
Komunitas
lemmy.today
encrypted over https The TLS handshake will generally – through there are some ways to avoid this, and people are banging on it – expose hostnames in the clear. So even if the IP address that you’re talking to serves multiple virtual hosts, your ISP is likely to know who it is that you’re talking to. https://en.wikipedia.org/wiki/Server_Name_Indication Even if your browser is using DNS-over-HTTP, which it may or may not be doing, most software doesn’t, so outside of your browser, DNS is generally visible. Some protocols still are not encrypted; I was looking at MUDs the other day, and few of them support encrypted connections. The networks that I’m most worried about are random WiFi access points, and VPNs solve that well. The network provider can still see which addresses and ports someone is connecting to and to where the traffic goes, and how much traffic is sent. Some network providers blacklist material – as is the case in OP’s article. For example, one of my first experiences on the Threadiverse was kbin sending me to a random discussion on policy that Ada (the lemmy.blahaj.zone admin) was having with some gay user who lived somewhere in the Middle East. Lemmy.blahaj.zone had been blocked in that country – the country presumably didn’t like something related to the server having LGBT content. The Threadiverse is semi-resillient to that – they could still connect to a federated server and see comments. But it meant that images on lemmy.blahaj.zone were blocked in that country. For another contemporary example, Russia has cracked down on politics online. Can’t block access to content without killing off VPNs, and they went after those too. For people who maintain a long-running IP address, it’s possible to cross-correlate logs from various services. So, okay, let’s say that a given IP address has been logged downloading BitTorrent content. That same IP address is linked to, at various times, use of an app where a particular unique phone ID has shown up, or maybe that a user has logged into some account service on, which is linked to personal information. Even a party who is not someone’s ISP can cross-correlate logs using the IP. A VPN doesn’t absolutely avoid that, but it makes it harder. Without a VPN, anyone can get at least a rough geographical location of a user by geolocating their IP address. IPv4 scarcity has made this harder than it once was, reduced geography/address correlation, but I expect that IPv6 will make it easier. People don’t need to write their network software securely. Your cool multiplayer network game may-or-may not be encrypted and may-or-may-not be resillient to modified network traffic. If there are buffer overflows in how Quake or whatever handles network traffic, I’d rather not let the network provider be an attack vector. This has been exploited before, and while a typical ISP probably isn’t generally a real risk, I’d trust random WiFi networks a lot less. A VPN will get cleartext traffic off their network. Probably more, but that’s some off-the-cuff.
Komunitas
hexbear.net
i can’t even really remember how long ago it was that i looked into league of legends, but it was a long time ago. i don’t think it was brand new, because lots of people were already playing it. i was looking for a game to play with friends online and so a friend of mine told me about how two guys we knew back in high school played it all the time now and we could play with them / use it as a way to keep in contact. and it was “Free” so what was there to lose? so we download it and get online, only the guys from school are not really interested in showing us what’s up because they are trying to achieve something and insisted we play some randoms for a while to figure it out and get better. and we quickly find that the options for noobs not paying money are limited. so we join a game anyway, and start getting told me we suck and are ruining the game because the acronym commands we are being issued by someone who has decided they are in charge of this “game” are inscrutable. this experience was supposed to sell us on investing more time into it so we could buy stuff in game to “be better”. i think i uninstalled it after a few hours. people look for different experiences in games. personally, my idea of free time isn’t something where i want to let some random asshole frustratedly boss me around so i can make numbers go up and have fake money to spend on becoming more comfortable with being bossed around and eventually become one of the people who bosses others around. seems a bit too much like some other game we all have to play already.
Komunitas
lemmy.world
I worked in my university’s computer lab and one time I had a girl complain that the computer wasn’t allowing her to do something (like download or save a file, this was over a decade ago) and she was frustrated. I asked her to show me what the issue was. She did what she was trying to do, a pop-up appeared and without reading it she clicked “no” and then proceeded to removed about it not working. I did it again and the pop-up was asking for permission but she kept denying it, and then complaining that it didn’t work 🤦♂️
Komunitas
ibbit.at
Both Google and Apple recently removed Red Dot, an app people can use to report sightings of ICE officials, from their respective app stores, 404 Media has found. The move comes after Apple removed ICEBlock, a much more prominent app, from its App Store on Thursday following direct pressure from U.S. Department of Justice officials. Google told 404 Media it removed apps because they shared the location of what it describes as a vulnerable group that recently faced a violent act connected to these sorts of ICE-spotting apps—a veiled reference to ICE officials. The move signals a broader crackdown on apps that are designed to keep communities safe by crowdsourcing the location of ICE officials. Authorities have claimed that Joshua Jahn, the suspected shooter of an ICE facility in September and who killed a detainee, searched his phone for various tracking apps. A long-running immigration support group on the ground in Chicago, where ICE is currently focused, told 404 Media some of its members use Red Dot. 💡Do you know anything else about these apps and their removal? Do you work at Google, Apple, or ICE? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at [email protected]. “Ready to Protect Your Community?” the website for Red Dot reads. “Download Red Dot and help build a stronger protection network.” The site provides links to the app’s page on the Apple App Store and Google Play Store. As of at least Friday, both of those links return errors. “This app is currently not available in your country or region,” says the Apple one, and “We’re sorry, the requested URL was not found on this server,” says the Google one. The app allows people to report ICE presence or activity, along with details such as the location and time, according to Red Dot’s website. The app then notifies nearby community members, and users can receive alerts about ICE activity in their area, the website says. Google confirmed to 404 Media that it removed Red Dot. Google said it did not receive any outreach from the Department of Justice about this issue and that it bans apps with a high risk of abuse. Without talking about the shooting at the ICE facility specifically, the company said it removed apps that share the location of what it describes as a vulnerable group after a recent violent act against them connected to this sort of app. Google said apps that have user generated content must also conduct content moderation. Google added in a statement that “ICEBlock was never available on Google Play, but we removed similar apps for violations of our policies.” Google’s Play Store policies say the platform does not allow apps that “promote violence” against “groups based on race or ethnic origin, religion, disability age, nationality, veteran status, sexual orientation, gender, gender identity, caste, immigration status, or any other characteristic that is associated with systemic discrimination or marginalization,” but its published policies do not include information about how it defines what types of groups are protected. Red Dot did not respond to a request for comment. On Thursday Apple told 404 Media it removed multiple ICE-spotting apps, but did not name Red Dot. Apple did not respond to another request for comment on Friday. On Thursday Joshua Aaron, the developer of ICEBlock, told 404 Media “I am incredibly disappointed by Apple’s actions today. Capitulating to an authoritarian regime is never the right move,” referring to Apple removing his own app. ICEBlock rose to prominence in June when CNN covered the app. That app was only available on iOS, while Red Dot was available on both iOS and Android. “ICEBlock is no different from crowd sourcing speed traps, which every notable mapping application, including Apple’s own Maps app, implements as part of its core services. This is protected speech under the first amendment of the United States Constitution,” Aaron continued. “We are determined to fight this with everything we have. Our mission has always been to protect our neighbors from the terror this administration continues to reign down on the people of this nation. We will not be deterred. We will not stop. #resist.” That move from Apple came after pressure from Department of Justice officials on behalf of Attorney General Pam Bondi, according to Fox. “ICEBlock is designed to put ICE agents at risk just for doing their jobs, and violence against law enforcement is an intolerable red line that cannot be crossed. This Department of Justice will continue making every effort to protect our brave federal law enforcement officers, who risk their lives every day to keep Americans safe,” Bondi told Fox. The Department of Justice declined to comment beyond Bondi’s earlier comments. The current flashpoint for ICE’s mass deportation effort is Chicago. This week ICE raided an apartment building and removed everyone from the building only to ask questions later, according to local media reports. “They was terrified. The kids was crying. People was screaming. They looked very distraught. I was out there crying when I seen the little girl come around the corner, because they was bringing the kids down, too, had them zip tied to each other," one neighbor, Eboni Watson, told ABC7. “That’s all I kept asking. What is the morality? Where’s the human? One of them literally laughed. He was standing right here. He said, 'f*** them kids.’” Brandon Lee, communications lead at Illinois Coalition for Immigrant and Refugee Rights, told 404 Media some of the organization’s teams have used Red Dot and similar apps as a way of taking tips. But the organization recommends people call its hotline to report ICE activity. That hotline has been around since 2011, Lee said. “The thing that takes time is the infrastructure of trust and training that goes into follow-up, confirmation, and legal and community support for impacted families, which we in Illinois have been building up over time,” he added. “But I will say that at the end of the day it’s important for all people of conscience to use their skills to shine some light on ICE’s operations, given the agency’s lack of transparency and overall lack of accountability,” he said, referring to ICE-spotting apps. In ICEBlock’s case, people who already downloaded the app will be able to continue using but will be unable to re-download it from the Apple App Store, according to an email from Apple Aaron shared with 404 Media. Because Red Dot is available on Android, users can likely sideload the app—that is, install it themselves by downloading the APK file rather than from the Play Store. The last message to Red Dot’s Facebook page was on September 24 announcing a new update that fixed various bugs. Update: this piece has been updated to include a response from the Department of Justice. From 404 Media via this RSS feed
Komunitas
ibbit.at
For the past couple of weeks, a community of developers who use the programming language Ruby have been closely following a dramatic change in ownership of some of the most essential tools in its ecosystem with far reaching impacts for the worldwide web. If you’re not familiar with Ruby or the open source development community, you probably haven’t heard about any of this, but the tools in question serve as critical infrastructure for gigantic internet services like GitHub, Shopify, and others, so any disruption to them would be catastrophic to those companies, their users, and vast swaths of the internet. On September 19, Ruby Central, a nonprofit organization that manages RubyGems.org, a platform for sharing Ruby code and libraries, asserted control over several GitHub repositories for Ruby Gems as well as other critical Ruby open source projects that the rest of the Ruby development community relies on. A group of open source developers who had contributed to those projects and maintained them for years had their permissions suddenly revoked. When these developers announced on social media that their access was taken away, many Ruby developers saw the decision as a betrayal of their years-long contributions to the Ruby ecosystem and open source principles more generally. Others accused Ruby Central of succumbing to corporate pressure from companies like Shopify, which they claimed wanted more control over the project. In some ways, this whole affair is an example of why this stuff gets really messy when people start getting paid I’ve spent the last week talking to people who had direct involvement with Ruby Central’s decision, the contributors who were ousted, and developers in the Ruby community. I’ve heard accusations of greed, toxic personalities, and stories about years-long feuds between people, at times in open disagreement, who ultimately govern some of these important open source tools. RubyGems.org and other critical Ruby tools have so far not been interrupted during this transition, but the incident sheds light on a basic truth about the internet and open source development: Much of the technology we use every day and take for granted is being maintained by a small number of developers who are not compensated for that work or get paid very little when compared to salaries at big tech companies. Open source development continues to make much of the internet possible, but as some of these tools become more important and financially valuable, they’re subject to more scrutiny and pressure from the community, organizations, and companies that rely on them. “In some ways, this whole affair is an example of why this stuff gets really messy when people start getting paid, and once you start introducing formal organizations and employees and nonprofits and lawyers and all this kind of complexity,” Mike McQuaid, developer of the popular package manager Homebrew, which is built with Ruby, told me. McQuaid has talked to and offered to mediate between Ruby Central and the ousted maintainers. “This is a textbook case of what happens when there’s this conflict between what companies want, what nonprofit individuals want, how much responsibility people have when they take money, who gets control and when. How much democracy versus just ‘I have the power to do something, therefore I’m going to do it.’” With Ruby developers can download and use self-contained packages of code that add different functionalities to a Ruby project. These packages are called gems, and are distributed primarily via RubyGems.org, where developers can upload gems they’ve developed or download gems from other developers. The ability to download gems and plug them into different projects is very useful and convenient for Ruby developers, but can create complications. Different gems are developed by different teams and are updated at different times with bug fixes and new features, and might not necessarily be compatible or play well with one another as they evolve. This is where Bundler comes in. As its website explains, “Bundler provides a consistent environment for Ruby projects by tracking and installing the exact gems and versions that are needed.” So, for example, if a developer is building a Ruby project and wants to use gems X, Y, and Z, Bundler will pull the versions of those gems that are compatible with one another, providing developers an easy solution for what Bundler describes as “dependency hell.” Bundler is an open source project that was initially developed by Yehuda Katz, but the GitHub repository for the project was created and was administrated by André Arko. In 2015, Arko also founded a nonprofit trade organization named Ruby Together, which raised funds from developers and companies that use Ruby in order to maintain Bundler and other open source tools. I will not mince words here: This was a hostile takeover RubyGems.org, the site and service, is governed by Ruby Central, a nonprofit founded in 2001, which also organizes several Ruby conferences like RubyConf and RailsConf. In 2022, Arko’s Ruby Together and Ruby Central merged, “uniting the Ruby community’s leading events and infrastructure under one roof,” according to Ruby Central’s site. Bundler’s and RubyGems.org’s work often overlapped both in their goals and the developers who worked on them, but operated across two different GitHub organizations, each with its own repositories. To streamline development of these open source projects, Bundler also joined the Ruby Gems GitHub organization in 2022. In 2023, Ruby Central established the Open Source Software Committee, which according to its site oversees RubyGems, Bundler, and RubyGems.org, focusing on infrastructure stability, security, and sustainability. A confusing and central point of disagreement between Ruby Central and the maintainers it ousted on September 19 is rooted in the merging of Ruby Together and Ruby Central and the difference between RubyCentral.org the service, essentially an implementation of the Ruby Gems codebase on an AWS instance, which both parties agree Ruby Central owns and operates, and the Ruby Gems the codebase that lives in the same GitHub organization as Bundler. According to a recording of a mid-September Zoom meeting which I obtained between Marty Haught, Ruby Central’s Director of Open Source, Arko, and the other ousted contributors, Ruby Central maintains that the codebase and GitHub organization became its responsibility when Ruby Central merged with Ruby Together in 2022. The ousted contributors’ position is that members of Ruby Central, like Haught, can be owners of the GitHub organization, but that ownership of the RubyGems codebase and other projects in the GitHub organization belong to the contributors, who don’t have a detailed governance model but historically have governed by consensus. Arko made this argument to me in a recent interview, but also outlined that argument in a blog post, where he also shared the merger agreement between Ruby Central and Ruby Together. It shows that Ruby Together would dissolve and that Ruby Central would be in charge of raising and allocating funds for development, but does not explicitly say Ruby Central takes ownership of the RubyGems and Bundler projects or the GitHub organization. To make matters even more complicated, Arko was at once a contributor to these open source projects, a contributor to RubyGems.org the service, an owner of the GitHub organization, and an advisor to Ruby Central’s Open Source Software Committee. In May, Arko resigned his position as an advisor to Ruby Central’s Open Source Software Committee, but continued his work as a contributor. Arko told me he resigned his advisory role because of Ruby Central’s last minute invitation of David Heinemeier Hansson, better known online as DHH, as a keynote speaker at RailsConf. Arko told me he objected to that decision because of DHH’s “horrifying, racist, misogynist, politics” and DHH’s “personal vendetta” against him. In 2021, back at Motherboard, we reported that many employees at DHH’s company, Basecamp, quit after his decision to ban any discussion of politics at work, which many employees saw as squashing discussion about race, bias, and diversity. Arko told me that DHH’s “personal vendetta” against him stemmed from Arko not wanting to support a certain feature DHH wanted added to Bundler, after which DHH demanded Arko be removed from the Ruby Together board. The current controversy erupted on social media on September 19, when one contributor to the open source projects in the RubyGems and Bundler GitHub organization, Ellen Dash, announced that Haught, Ruby Central’s Director of Open Source, revoked GitHub organization membership for all admins on the RubyGems, Bundler, and RubyGems.org maintainer teams. At that moment, their permissions and access to the GitHub organization were revoked, meaning they could no longer make any changes or contributions to the code, and Haught, representing Ruby Central, took control. “I will not mince words here: This was a hostile takeover,” Dash said in a public “goodbye” letter she shared online. “I consider Ruby Central’s behavior a threat to the Ruby community as a whole. The forceful removal of those who maintained RubyGems and Bundler for over a decade is inherently a hostile action. Ruby Central crossed a line by doing this.” The news was seen by many developers in the Ruby and open source community as betraying the dedication and labor that Dash, Arko, and other maintainers put into these tools for years. Ruby Central, meanwhile, describes the move as one centered around security. “With the recent increase of software supply chain attacks, we are taking proactive steps to safeguard the Ruby gem ecosystem end-to-end,” Ruby Central said in an explanation of its decision. “To strengthen supply chain security, we are taking important steps to ensure that administrative access to the RubyGems.org, RubyGems, and Bundler is securely managed. This includes both our production systems and GitHub repositories. In the near term we will temporarily hold administrative access to these projects while we finalize new policies that limit commit and organization access rights. This decision was made and approved by the Ruby Central Board as part of our fiduciary responsibility. In the interim, we have a strong on-call rotation in place to ensure continuity and reliability while we advance this work. These changes are designed to protect critical infrastructure that power the Ruby ecosystem, whether you are a developer downloading gems to your local machine [or] a small or large team who rely on the safety and availability of these tools.” 404 Media has covered the kind of recent supply chain attacks targeting open source projects that Ruby Central is referring to. Earlier this month, a critical JavaScript development tool Node Package Manager (NPM), was targeted by a similar supply chain attack. But not everyone in the Ruby development community bought the explanation that security was at the heart of the recent moves. One reason for that is a public statement from a Ruby Central board member and treasurer Freedom Dumalo. On Substack, Dumalo apologized for the sudden change and how it was communicated. “If Ruby Central made a critical mistake, it’s here,” he wrote. “Could these conversations have been happening in public? Could the concerns we were hearing from companies, users and sponsors have been made more apparent? Probably. But I remind you we don’t have a ‘communications team’, no real PR mechanism, we are all just engineers who (like many of you I’m sure) go heads down on a problem until it’s solved.” Dumalo reiterated that RubyGems and Bundler are critical infrastructure that are now increasingly under the threat of supply chain attacks, and said that the companies that rely on them “count” on Ruby Central do everything it can to keep them and their users safe. However, Dumalo also said that Ruby Central was under “deadline” to make this change. “Either Ruby Central puts controls in place to ensure the safety and stability of the infrastructure we are responsible for, or lose the funding that we use to keep those things online and going,” Dumalo wrote. In a September 22 video message in response to criticism about its decision to remove maintainers, Ruby Central’s executive director Shan Cureton described a similar dynamic. She said “sponsors and companies who depend on Ruby tooling came to us with supply chain concerns” and that “Our funding and sponsorships are directly tied to our ability to demonstrate strong operational standards. Without those standards in place, it becomes harder to secure the support needed to keep maintainers paid, organize events, and provide resources for developers at every stage of their journey.” Since Shopify is one of the primary sponsors and funders of Ruby Central, this led some in the Ruby community to believe that Shopify was exerting pressure on Ruby Central to make this change. “That is not how it happened, and I wish I had been more careful with my wording in that blog post,” Dumalo told me in a Linkedin message when I asked him if Ruby Central was under pressure from Shopify to make these changes. I just don’t think that there’s any other plausible explanation than Shopify demanded this. After I gave Dumalo my number so we could do a phone interview, I got an email from Cindi Sutera, who was recently brought on as a spokesperson for Ruby Central. "Ruby Central’s mission is to keep the infrastructure that Rubyists rely on stable, safe, and trustworthy,” she told me. “As part of a routine review following organizational changes, we identified a small number of accounts whose privileges no longer matched current role requirements. The Board voted that it was imperative to align access with our privilege policy to keep the infrastructure that the Ruby community depends on stable. This is our mission.” Sutera said that the board approved “a temporary administrative hold on certain elevated permissions” while it finalized operator agreements and governance roles. “To move quickly and transparently, we imposed a clear deadline to complete operator agreements and close gaps,” she said. “We could have communicated earlier that we felt it necessary to move quickly and wish we could have given the community more time to prepare for this action. And now, here we are committed to completing this transition for the stability and security of the Ruby Gems supply chain. More updates are coming as we work through security protocols and stabilization efforts.” “There’s literally only one company providing the money that is keeping Ruby Central open, and it is Shopify,” Arko told me. “And so I just don’t think that there’s any other plausible explanation than Shopify demanded this.” When I asked Arko why he thought Ruby Central removed him, if it wasn’t for security reasons, Arko said: “totally unprovable speculation is Shopify’s CEO is best friends with DHH, who hates me.” DHH is also a Shopify board member. “Thanks for the invitation, but not my place to weigh in a lot on this while they’re working through these changes,” DHH told me in an email when reached for comment. “But I support them taking steps to secure and professionalize the supply chain work they’re doing.” Shopify did not reply to a request for comment. As this episode spread on social media, I talked to several people associated with Ruby Central who told me the board was acting in the interest of the RubyGems and the Ruby community. Two sources who asked for anonymity for fear of retaliation said that Arko was difficult to work with, questioned how he used funds raised by Ruby Together, and claimed that a new Ruby version manager he’s working on, rv, means he has a conflict of interest with his work on RubyGems and Bundler. Arko acknowledged to me he heard he’s been difficult to work with in the past. He said that sometimes he’s been able to reach out to people directly and resolve any issues, and that sometimes he hasn’t. He rejected the other allegations, and said that Ruby Together’s financials have always been public. “It has always been fully public, and the amount has been fixed at $150 an hour for 10 years,” he said, referring to the amount contributors got paid to work on Bundler. Arko added that nobody has ever been paid for more than 20 hours a week, and that the most he’s been able to raise in a single year is $300,000 to pay eight different contributors. “Nobody has gotten a raise for 10 years.” “As a matter of policy, we don’t discuss individual personnel,” Sutera, the Ruby Central spokesperson, said when I asked if Arko was removed from the GitHub organization because of his previous behavior. “Our recent actions were organization-wide governance measures aimed at aligning access with policy. Our priority is maintaining a stable and secure Ruby Gems supply chain.” McQuaid, the developer of Homebrew and who followed the controversy, told me that even Arko’s harshest critics wouldn’t deny the contributions he’s made to the Ruby community over the years. Regarding Arko’s blog post about his removal, McQuaid told me it’s good that Arko is crediting other people for their contribution and that he’s following open source principles of community and transparency, but that “his ‘transparency’ here has been selective to things that benefit him/his narrative, he seems unwilling or unable to admit that he failed as a leader in being unwilling or unable to introduce a formal governance process long before this all went down or appoint a meaningful successor and step down amicably.” The fundamental disagreement here is about who “owns” the GitHub organization that houses Bundler and RubyGems. Technically, Ruby Central was able to assert control because Hiroshi Shibata, a member of the Ruby core team and one of the contributors who has owner-level permissions on the GitHub, made Haught, who revoked the others’ access, an owner as well. Any owner can add or remove any other owner, but when Ruby Central’s board voted to make this change Haught acted immediately and removed Arko, Dash, and others. However, Arko fundamentally disagrees with the premise that Ruby Central has the right to govern the GitHub organization in any way, and believes that it has always belonged to the group of contributors who had access up until September 19. Arko said that even if Ruby Central gave him his permissions back, he would not consider the matter resolved until Ruby Central stopped claiming it owns Bundler “but I am definitely not going to hold my breath for that one.” “When people really care, they’re passionate and they’re enthusiastic and they argue, and that often looks like drama,” McQuaid, the developer of Homebrew, said when I asked what he thinks this entire affair says about the state of open source development. “But if I had to pick between having the enthusiasm and the drama or losing both, then I’d probably pick the enthusiasm and the drama, because in some ways, the system is somewhat self correcting. Even the stuff that’s going on right now, people are having essentially a very public debate about what role do large companies or nonprofits or individual maintainers have in open source. To what extent does someone’s level of contribution matter versus what type of person they are? I think these are valuable discussions to be having, and we’re having them in the open, whereas if it was in a company, this would all be in a meeting room or with an HR department or in a leadership offsite or whatever.” From 404 Media via this RSS feed
Komunitas
lemmy.ca
Description from the developer: Pinepods is a podcast server that’s self hosted. It aims to be a multi-client version of what you might already have on your phone that allows you to listen anywhere. Host pinepods and get a web client, mobile apps, desktop apps, even a CLI app. Your progress syncs between all these. It supports gpodder sync for use with your existing apps if you want (though I’ve put 100 plus hours into the mobile apps and really would appreciate people at least giving them a go) and it has tons of features. Think Notifications on release, smart playlists, multi user, sharing, chapter support, YouTube channel to podcast support. Loads of stuff, and loads more still to come. With 0.8.0 the mobile apps are now on Google Play and the Apple app stores, and the api has been fully rewritten in rust. It’s a lean mean podcasting machine. And actually the real current version is 0.8.1. Excerpts from the Changelog: Introducing PinePods 0.8.0 – The absolute biggest Pinepods release to date. Pinepods mobile clients are officially released! Additionally the backend api has gotten a complete rewrite in rust! 📱 Official Native Mobile App Flutter-Based App – Brand new official mobile app built with Flutter for iOS and Android Cross-Platform Synchronization – Seamless sync between mobile, web, and other Pinepods clients (More to come on other very soon) Offline Support – Download episodes for offline listening with intelligent storage management Native Mobile Features – Background playback, lock screen controls, notification management, and mobile-optimized UI Professional Distribution – Will be available on both iOS App Store and Google Play Store along with open stores such as f-droid and izzyondroid The android apk will be attached to the github release. As well as released to the Google Play Store, f-droid, and izzyondroid Shortly after the 0.8.0 release. I need to get this release out in order to get them on the android stores fully. Links: iOS App Store 🦀 Complete Rust API Transformation Python Elimination – All Python dependencies have been completely removed from the container, resulting in a dramatically smaller and more efficient deployment Horust Process Management – Switched from supervisor to Horust for robust, lightweight process supervision and startup management. This is part of removing the python dependency and also utilizes more great rust based dependancies Internal Task Scheduler – Background processes now run directly within the Rust API service using tokio-cron-scheduler, eliminating the Celery dependency entirely Enhanced Reliability – Background tasks are more reliable with better error handling, automatic retries, and integrated logging Streamlined Container – Significantly reduced container size and complexity with the removal of Python runtime and associated dependencies 🔧 Infrastructure & Reliability Improvements Horust Service Management – All services now managed by Horust with proper process supervision, automatic restarts, and clean shutdown handling Integrated Background Processing – Podcast refresh, nightly maintenance, and cleanup tasks now run as scheduled jobs within the main Rust API service Database Operation Reliability – Improved server backup and restore operations with better error handling and validation Timezone Configuration – Runtime timezone configuration without container rebuilds, properly affecting all time-sensitive operations Simplified Deployment – Reduced container complexity and startup time with streamlined process management 🏗️ Development & Performance Pure Rust API – Complete rewrite of the Python API in Rust for improved performance, memory efficiency, and type safety Eliminated Dependencies – Removed Python runtime, Celery worker system, and associated packages from the container Better Resource Usage – Significantly reduced memory footprint and CPU usage with native Rust performance Improved Error Handling – Better error messages, logging, and debugging capabilities throughout the system Type Safety – Enhanced reliability through Rust’s type system and memory safety guarantees 🐞 General App Fixes and Improvments Better Youtube Support – The youtube search api is now embeded in the standard Pinepods Search api. This makes searching Youtube much faster and more consistent. Multi-Select Episodes – On the page for any given podcast you can now select and take actions on any given number of episodes. This allows you to mark all episodes of a given podcast as complete in one fell swoop. Arrows also appear on the episodes allowing you to mark all episodes newer or older than a particular episode. Playlist Limits – System Playlists are now limited to a max of 1000 episodes. This will take the most relevant 1000 for the playlist. Playlist Fixes - Also fixed an issue with the Almost Complete playlist where the completed percentage wasn’t working correctly. Category Fixes - Categories throughout the app have been improved. Sometimes they would previously show as a strange looking vector. This will no longer occur. Premium Feeds - Premium feeds should now be fully functional everywhere. Backup/Restore Database - The Backup and Restore functionality has been 100% totally rebuilt. This should fix some issues that it previously had with actually restoring. There’s also an option to schedule backups now. So that they run on a regular basis. The restore option will automtically see these backups as options to restore from. Subscribed People Fixes - The functionality around subscribed people has gotten some major fixes as well. This should fix numerous bugs related to people subscription Match Podcast Index IDs - There’s a new option in settings to match a podcast to it’s podcast index counterpart. Having this ID correct will allow for more consistent host following. Auto Complete Options - There’s also been an option added to playback settings in the settings area to auto complete an episode if it gets to a certain amount of seconds to the end of it. For example, you can set it to 30 seconds and if an episode is within 30 seconds of the end it will automatically mark it complete. Authenciation options added to NTFY Notifications - The NTFY notification settings now support username and passwords or authentication tokens. These can be skipped entirely still if you have no auth. Additional OIDC Settings - Experimental name claim settings added to to OIDC setup area. Name, email, user, roles claim options. As well as admin and user roles have all been added. 🕸️ Website Rebuild The Pinepods Website has gotten a complete revamp! It’s looking much nicer! Many more docs have been written as well. There’s documentation for just about every option in Pinepods. If you find something missing please let me know! Pinepods is a podcast server that’s self hosted. It aims to be a multi-client version of what you might already have on your phone that allows you to listen anywhere. Host pinepods and get a web client, mobile apps, desktop apps, even a CLI app. Your progress syncs between all these. It supports gpodder sync for use with your existing apps if you want (though I’ve put 100 plus hours into the mobile apps and really would appreciate people at least giving them a go) and it has tons of features. Think Notifications on release, smart playlists, multi user, sharing, chapter support, YouTube channel to podcast support. Loads of stuff, and loads more still to come. With 0.8.0 the mobile apps are now on Google Play and the Apple app stores, and the api has been fully rewritten in rust. It’s a lean mean podcasting machine. And actually the real current version is 0.8.1.
Komunitas
ibbit.at
Randomness is hard. To be precise, without dedicated hardware, randomness is impossible for a computer. This is actually important to keep in mind when writing software. When there’s not hardware providing true randomness, most rnd implementations use a seed value and a pseudo random number generator (PRNG). A PRNG is a function that takes a seed value, and turns it into a seemingly random value, and also produces a new seed for the next time a random value is needed. This could be as simple as a SHA256 sum, where the hash output is split to become the next seed and the random value. The PRNG approach does still have a challenge. Where does the initial seed come from? There are a few common, if flawed, approaches, and one of the most common is to use the system clock. It’s not a bulletproof solution, but using the microsecond counter since the last system boot is often good enough, because there are a lot of them to choose from — the entropy is high. With that brief background in mind, let’s talk about what happens in VBScript. The Randomize call is used to seed that initial value, but Randomize has some quirks. The first is a great feature: calling Randomize a second time with the same seed doesn’t reset the PRNG engine back to the same initial state. And second, when called without a value, Randomize uses the number of system ticks since midnight as the PRNG seed. There are 64 ticks per second, giving five-and-a-half million possible seeds, or 22 bits of entropy. This isn’t great on its own, but Randomize internally typecasts that number of ticks into a narrower value, with a maximum possible of time-based seeds set at 65,536, which is a lot easier to brute-force. We don’t know the exact application where the researchers at Doyensec found VBScript generating secure tokens, but in their Proof of Concept (PoC) test run, the generated token could be found in four guesses. It’s a terrible security fail for basically any use, and it’s a deceptively easy mistake to make. GoAnywhere Exploit The folks at WatchTowr have a report on a blistering 10.0 CVE in the GoAnywhere Managed File Transfer (MFT) product. This vulnerability was first published on September 18, and the WatchTowr crew took a look at it, and had questions. This bug is a deserialization attack that can land even without any authentication. It can result in command injection, and the latest update from GoAnywhere vendor Forta vaguely indicates that it is being used for attacks in the wild. But this is particularly odd: before the vulnerable interface deserializes, it first checks for a valid signature. And WatchTowr researchers couldn’t find a leak of a valid private key. So how was the vulnerability in use in the wild? Lucky for us, there’s a part two to this story, but not all of the mysteries are explained. This CVE is indeed being exploited in the wild, with the earliest known exploit being September 10th. Since there was a full week between the earliest known compromise and the release of the patch, it seems unfortunate that it took WatchTowr this long to confirm that this vulnerability was actually exploited in the wild. Cisco and Public SNMP Two million Cisco systems are at risk from CVE-2025-20352. This is a remotely accessible flaw in the handling of Simple Network Management Protocol traffic. The attack does require valid credentials, but the attack works using SNMPv1, v2, or v3. While SNMPv3 has more secure user credentials, the earlier SNMP versions just used “community strings”, a text based password that was often set to “public”. This vulnerability seems to lead to either a crash or a Remote Code Exploitation (RCE). It’s not entirely clear how difficult it is to achieve RCE, but it’s noteworthy that RCE here is run as root, a level of access not usually available even to administrators of Cisco equipment. So far there’s no indication that this was used in the wild, but now that some information and a patch is available, it’s likely not going to take long for someone to reverse-engineer the vulnerability and weaponize it. More Spilled Tea Remember the Tea Spilling from a couple months ago? The Tea app had an unsecured Firebase database. It turns out that wasn’t an isolated incident. [Mike Oude Reimer] has been working on OpenFirebase, an auditing tool for FireBase installs. And to prove the point, did an audit on 400 of the most popular Android apps from a trio of categories in the play store, and found 150 Firebase servers that granted unintended access of some sort. That’s a bit stunning, that over one in three Android apps have insecure Firebase servers associated with them. Github Malware Delivery There’s a malware campaign that has happened in the last couple weeks, based around Search Engine Optimization and GitHub repositories. The instructions peddle malicious commands to users looking for popular software on the Mac, like LastPass and others. I was prepared to write about how Ad Blocking is really a form of security protection, as these campaigns are often delivered via advertising, but this one seems to primarily be based on real search engine placement. This isn’t the only malware campaign that takes advantage of GitHub’s reputation as a trusted source of software. A phishing campaign was also recently spotted, where spam messages were added as GitHub issues, with the spammers tagging their victims, and offering fake Y Combinator sponsorships. Since the messages were sent via GitHub, most spam blockers treated them as legitimate. This campaign was a bit more clever than most, making use of domain typo-squatting, with the y-comblnator.com domain used as part of the campaign. The goal here being draining the crypto accounts of people sufficiently fooled by the messages. Bits and Bytes Is nothing sacred? In addition to GitHub, malware appears to be distributed via Steam, in updates to games. The most recent example was the Block Blasters game, which was on Steam for nearly two months before shipping malicious code. How can you figure out whether an image is AI, or has been manipulated with AI or other tools? There’s quite a few approaches, but one of the interesting ones is to look at the JPEG artifacting. If part of the image has ever been compressed via JPEG, this results in blocky artifacts that are hard for the human eye to spot, but easy to see with the right tools. And finally, in a blast from the past, Supermicro has another pair of vulnerabilities that could allow malicious firmware on server Baseboard Management Controller (BMCs). The way these images are signed is slightly odd, with the various portions of the file signed independently. The attack is to treat these sections like cards in a deck, and shuffle malicious slices into the stack. The verification routine thinks all the important pieces are signed, but during a real boot, the malicious code runs instead. Patches coming soon. From Blog – Hackaday via this RSS feed
Komunitas
programming.dev
The free community version of Rustdesk Server (a competitor to the Teamviewer remote access software) is AGPL licensed. https://github.com/rustdesk/rustdesk-server The paid, proprietary Pro version builds on top of the community edition by adding extra features such as user authentication and a web backend for administration. There exists a repo for the pro server: https://github.com/rustdesk/rustdesk-server-pro But it only contains install scripts and no actual source code of the application. The github releases page of this repo however, contains the compiled code of the proprietary pro version and is available for anyone to download for free. Analyzing the disassembly of the pro and open source binaries shows that the pro version is definitely based on the open source version. The company previously associated with Rustdesk, Purslane Limited of the UK, is no longer in operation since 2023. The project has no CLA and so the dozens of previous contributors still hold the copyright to their code and have not given permission for it to be used in a proprietary version. There have been multiple requests for the source code of this pro version, but either there was no response or the issue was closed without comment. EDIT: The repo owner has completely deleted the issue, here is a screenshot: https://0x0.st/KaqD.png To me this just proves they know what they’re doing is wrong.
Komunitas
piefed.social
cross-posted from: https://ibbit.at/post/58642 It wasn’t all that long ago that we were anticipating the imminent arrival of Subnautica 2. The sequel to the superb underwater survival game has yet to appear, though, and the founders of Unknown Worlds have been ousted by owner Krafton, leading to a messy legal dispute between the two parties. One of the reasons given for the termination was the state of the game. The founders believed that it was ready for an early access launch and planned to go through with it; Krafton, meanwhile, believed it wasn’t ready for its debut and that the founders had been shirking their duties. But there’s been a surprising U-turn, with Krafton significantly changing its argument. The lawsuit is now in the discovery phase, so Fortis Advisors, which represents the ousted founders, sought discovery to see if Krafton held evidence to back up its claims. “But despite its obvious relevance, Krafton feigned astonishment during the parties’ meet and confers at how it could possibly be part of Phase I,” Fortis said. Essentially, Krafton said that documents relating to the readiness of the game were irrelevant to the termination—which is what this phase of discovery is focused on—despite this being the reason cited in the termination notices, which was also repeated publicly and in court. “The termination notices of the founders gave one reason for their termination,” said Fortis, “and that was the supposed lack of readiness of Subanutica 2 for release. Krafton reiterated that basis for its actions repeatedly.” Fortis called it a “seismic shift in the case” and “a little bit bewildering”. This was also echoed by the judge, Lori W. Will, when the parties met for a ruling on the filed motions, saying: “Well, that’s something that we definitely need to get to the bottom of today, because that is precisely what was cited as the reason in the answer.” Krafton’s representatives were not clear about why this argument has been taken off the table, only that it has been, and that it’s no longer why they are saying the founders were terminated. Instead, Krafton is focusing on the argument that the founders “abandoned their posts” and “deceived” their employer. Causing more confusion is the accusation that the founders downloaded files and kept devices with confidential information on them. This only came to light after the termination, so its relevance has been questioned. Krafton’s position is that this justified their termination after the fact, and it filed a motion to forensically inspect the founders’ devices. The founders, meanwhile, contend that they had a right to those documents and devices, and that the motion is too invasive—and to the latter point, the judge agreed. Fortis also alleged that Krafton hasn’t been playing ball, pushing back against some of its requests for discovery and refusing to confer. It claimed it needs emails and documents that relate to the earnout (the founders have accused Krafton of intentionally delaying the game so it wouldn’t have to pay a $250 million earnout) but Krafton is only willing to provide data from two people high up in the company, rather than employees who were “on the ground”. Another point of contention is what documents Krafton is willing to provide: specifically, only where the word “earnout” intersects with the word “termination”. “That’s very narrow,” the judge replied. “That sounds like a really terrible email for someone to write, and it’s hard for me to imagine that they’d be that blunt about it.” Krafton also argued that the plaintiff requested too many custodians—people who possess relevant data—and that it would take too long. The judge agreed the number was too high, but that the two parties would need to confer—something that Krafton had previously declined to do after it changed its argument. “That’s very frustrating,” the judge said. The discussion of the motions ended with both parties agreeing to confer, at least, and confirmation that game readiness was not the reason why the founders were terminated. Still, the whole thing remains rather messy, and it continues to be unclear why Krafton has made a U-turn when it was so adamant before that the state of Subnautica 2 was one of the reasons the founders were fired, which only happened after discovery was sought. What does seem clear, though, is that this likely won’t be resolved any time soon. 2025 games: This year’s upcoming releasesBest PC games: Our all-time favoritesFree PC games: Freebie festBest FPS games: Finest gunplayBest RPGs: Grand adventuresBest co-op games: Better together From PCGamer latest via this RSS feed
Komunitas
ibbit.at
By Carmen Wilson, Director of Operations at Demilitarise Education (dED), September 19, 2025 The demilitarise education movement in the UK has achieved a recent policy win! After sustained campaigning and public consultation, the University of Sussex is set to adopt a policy that fully excludes arms companies from its investments. After going through consultation and engagement by both the wider and immediate university community, the draft policy has passed and is now with the University Council for final approval in October 2025. This is a major step forward, and it reflects the power of collective advocacy. As part of the consultation process, Demilitarise Education (dED for short) submitted detailed comments rooted in the principles of peace, transparency, and ethical education. Our submission helped shape the draft and push for stronger commitments aligned with the dED Treaty — a practical framework to help universities end all investments and partnerships with the arms trade. This article will provide a breakdown of how this policy win was achieved and what more we can do to advocate and ensure accountability to ethical divestment from the global arms trade. How We Got Here: The Context & Timeline This marks a significant moment for campaigners who have long called on higher education institutions to cut ties with the arms trade. It demonstrates how sustained advocacy, transparency, and community engagement can lead to concrete policy change. Timeline of Events April 2024 – dED gave a policy-reform focused workshop to student and staff campaignersMay 13, 2024 – Encampment for Palestine launched on campus, followed by engagement with the Vice Chancellor and negotiationsFebruary 2025 – Sussex announces review of Socially Responsible Investment PolicyMarch 2025 – dED responded to the open consultationJune 2025 – Next round of consultation for University members onlyJuly 2025 – University Council final approval of the policy draftOctober 2025 – New policy version set to be published A Detailed Breakdown In February 2024, Sussex announced that its Council (the University’s governing body) would form a working group of student and staff representatives, and review the university’s Socially Responsible Investment Policy. The statement emphasised the need to ensure the policy considered “changing global contexts and investment opportunities, it was agreed that a review would be carried out to ensure that the policy aligns with our institutional values and remains sector-leading.” We were happy to see the university engaging with the wider community, showing a commitment to both transparency and inclusion in the policy review process. In March 2025, dED submitted a detailed response to the open consultation. The policy framework contained 10 guiding principles, including one particularly important addition: Guiding Principle #5 — Excluded Investments “Armaments — production of weapon systems or their critical components. The University will not invest in any organisation where there is confirmed involvement in the production of weapons regulated or prohibited by international convention (controversial weapons); antipersonnel mines, cluster munitions, chemical, biological and nuclear weapons, or the supply of their key components.” dED’s Recommendations Building on this foundation, dED proposed stronger commitments rooted in transparency, inclusion, and long-term accountability, the core values set out in the dED Treaty. Among the recommendations were: Emphasis on human rights and recognition that arms investments undermine the UN Sustainable Development Goals (SDGs). Through arms divestment, the University can actively work towards the achievement of the SDGs through social impact investment.Full arms exclusion by removing turnover limits and clearly defining ‘arms companies’ by using the SIPRI and Defence News Top 100 arms-producing companies as the source lists, ensuring exclusions extend beyond controversial weapons. Changing “minimise exposure” to “eliminate exposure,” demonstrating a complete commitment to divestment.Extending exclusions to companies supplying arms to countries in violation of UN international law.Transparency and accountability measures: public disclosure through publishing full policies as downloadable PDFs, disclosing third-party fund managers, their policies, and alignment with university values, and sharing meeting minutes with the wider university community. A clear and transparent divestment process, including at least one-third reductions per year, with progress reported annually in financial statements.As public institutions, universities should be held accountable beyond immediate university stakeholders, with clear governance over investment decision-making — including frequency, criteria, and oversight mechanismsInclusion in governance: ensuring diverse student and staff participation (beyond union representatives), regular opportunities to comment before and after each review, and open consultations with the wider community.Ethical compliance with charity obligations, reminding trustees that investing in arms companies contradicts the university’s charitable purpose and duty to provide public benefit. Engagement and Next Steps On June 18th, the university hosted an engagement session with staff and students to discuss the draft. dED members attended and contributed to the dialogue. The draft policy was then presented to the University Council in July for discussion and revision, and is scheduled for final approval in October. The full draft policy can be read here. Why This Win Matters Investments in arms companies violate the university’s charitable purposes and public benefit responsibilities. Sussex’s approach demonstrates the value of diverse inclusion and public engagement. It shows that when universities open space for dialogue, community voices can strengthen policy and push institutions toward greater accountability. This outcome also reflects the momentum of wider public advocacy, including dED’s recently launched Open Letter Campaign, which has so far mobilised over 600 university students, staff and alumni to call on UK universities to end their partnerships with arms companies. Sussex’s willingness to listen and act is a reminder of what collective pressure can achieve and the importance of policy change, turning commitments into action to secure accountability in the long term. Stand with Us This is a win. But it’s also a model for how change happens: together, and from the inside. It’s the dED Treaty in action. We’re building a higher education system that lives its values — of peace, transparency, inclusion, and global justice. But we’re just getting started. Support the campaign to help us achieve more wins like this one – If you’re a student, staff member or alumni of a UK university, add your name to this historic call and help ensure that universities live up to their values Open Letter: A Call to End University War Complicity Many UK universities still invest heavily in the arms trade. Together, we can hold them to higher standards. Add your name to our Open Letter and help ensure that universities live up to their values of peace, transparency, and global responsibility. Don’t worry, if you’re not affiliated with a UK university, you can sign our petition co-hosted with World BEYOND War. The post Policy Win at Sussex: Kicking Out the Arms Trade Through Ethical Investment appeared first on World BEYOND War. From World BEYOND War via this RSS feed
Komunitas
lemmy.world
So just to illustrate, I went to the normal FileZilla download page and downloaded the Win64 package. Then I submitted it to VirusTotal. https://filezilla-project.org/download.php?platform=win64#close https://www.virustotal.com/gui/file/dbde8a4bd71bb1fbc0511cdb657dfeffdaedc513aa425f856043532a7cba6fce
Komunitas
manganiello.social
After some brainstorming with @[email protected], @[email protected] and a few accounts from Gaza Verified in these days, I have decided to set up an automated backup solution for all the content that verified accounts are uploading to the Fediverse. What Palestinian accounts are uploading to the Fediverse is priceless. It’s invaluable first-hand evidence of a genocide that many are trying to hide and erase. It’s the kind of stuff that one day could be shown in a museum, or used as evidence against Israel in its pending international trials. We must ensure that it is properly preserved. We can’t just assume that Fediverse admins will always be cooperative in keeping those accounts online (as the case of @[email protected] proved yesterday). In Mahmoud’s case the account was only hidden. But if sufficient external pressure is applied to instance admins there may be cases were accounts are just permanently deleted, without even getting a chance to download a backup of their data, and without means to neatly migrate their profiles and followers to another instance. Our duty towards history preservation and towards the Palestinian accounts entrusting us with their words and images imposes us not to lose this content. Tonight I will start working on a solution that will periodically scrape their feeds and automatically archive any new content (post, attachment or follower) to my S3 bucket (a self-hosted MinIO instance in my house). What I need is: If possible, explicit permissions from the Gaza Verified accounts for me to create a permanent record of their online activities Permissions from instance admins to run these scrapers on profiles on their instances (except for mastodon.social’s case, where the staff rarely responds and there’s already a lot of scraping activity anyway, so in their case I can afford to feel better sorry than safe) If possible, support from other self-hosting enthusiasts. I don’t want to be the single point of failure in historic preservation. The more redundancy, the better. I am planning to release the code for the scraper, and probably also a Web UI that allows to easily index and browse content. Once ready, I may probably ask for some volunteers to join and help running the scraper in as many locations as possible. @[email protected] #gaza #selfhosting
Komunitas
lemmy.world
This is why I’ve never liked the idea of flatpak, it really seems like the Windows way of doing things. It honestly still kind of surprises me that Linux people really wanted to download random binaries from non-trusted distributors that contain a copy of every library that software needs to run. wedontdothathere.jpg
Komunitas
pawb.social
I’ll do you one better: I’m using Debian Stable for gaming and there’s nothing bad to report. Based on my experience I’d recommend that you use Stable first, unless you feel you really need Sid. I previously ran Arch Linux, but after switching to Stable and manually sourcing a few critical cutting-edge applications through e.g. Flatpak, it feels the exact same. I don’t feel like running the entire system as bleeding edge is a good idea when you can just run a couple dozen things as cutting-edge instead. If you plan on using Sid instead of Stable, most of the following will not apply: Lutris has its own Deb repo if you need the latest updates, or it’s available as a Flatpak. If you use Flatpak Lutris and want to use MangoHud, you’ll need to install the Flatpak version with flatpak install flathub org.freedesktop.Platform.VulkanLayer.MangoHud (I don’t think it shows up in the normal store) The one gotcha I’ve found regarding Debian Stable and gaming is that Mesa will fall out of date as the release cycle goes on and probably won’t be backported. The solution is that running games via Flatpak (Lutris, Steam, etc.) uses Flatpak’s Mesa instead, which is cutting-edge. You can also try to compile a local Mesa version with this script, and you can manually trigger games to use this version instead of the system version. It does work, but it’s more complicated and a little bit more messy. I use the Xanmod “Main” kernel for a more recent kernel that isn’t too bleeding-edge - it stays on the previous Linux kernel version until a few point releases have come out. CoreCtrl is available as a bookworm-backport. I manually backported it myself but it looks like it’s official now. I’m running Wayland and KDE, with no issues to report (even with gaming) I’ve manually compiled Libstrangle for FPS limiting, but I’ve found that I can use MangoHud to transparently limit FPS as well, by using the following environment variable: MANGOHUD_CONFIG=fps_limit=YOURFPSHERE,fps=0,frame_timing=0,cpu_stats=0,gpu_stats=0,background_alpha=0. When I want MangoHud to act as normal, I switch it to MANGOHUD_CONFIG=readcfg which uses my normal config instead. Notably, Libstrangle cannot be used with Flatpak Lutris, so FPS limiting will need to be done with MangoHud if you want to limit Linux games. DXVK games can be limited with DXVK_FRAME_RATE as well, if that’s all you need. I make heavy use of Flatpaks for any user applications that I need to keep more modern If it’s not available as a Flatpak, I tend to use Homebrew to keep any other critical applications up-to-date (usually some CLI tools) I use cargo through rustup to keep some rust programs updated I use deb-get with a couple programs that aren’t on any real repos in order to get updates I’ve compiled a couple backports by following this guide in a stock Debian Stable VM, then copying the .deb files back out to my main system. So far this has been super easy, but I don’t want to do this unless I have to. If a program needs to be manually compiled, I try to install it using checkinstall. checkinstall basically fake-runs an installation and notes where everything goes, then stuffs it all into a .deb for you for a proper installation that can be uninstalled later. It’s a little buggy and doesn’t always work, but if it does it’s preferable. I rarely am forced to compile something that actually needs to be installed to system, but I’ve used it a few times with good success. (Do not make a FrankenDebian) I can’t think of anything else regarding Debian Stable that I’ve done at the moment. Anything else has just worked as I’m used to on a bleeding-edge distro like Arch Linux. Debian’s large package base has really helped me with obscure programs that I used to need to compile manually with Arch Linux.