ticoombs

joined 2 years ago
MODERATOR OF
 

A nice in-depth article on game hacking

[โ€“] [email protected] 4 points 1 week ago (1 children)

Lemmy is still saving thumbnails and (previously) sometimes the whole image! The majority of image issues have been cleared up in my opinion and it works very well. Nearly all of our hosts allow hotlinking as it's basically required for our use cases.

Lemmy also knows when the image is another Lemmy instance (through "magic", or just cross posting). So if you upload once and then use that same link on all other posts then that would still be the same.

The problem I think you have is your usecase also includes posting externally to Lemmy. & to some extent, you don't want those images tied to your Lemmy account. If my users post via my instance then they are welcome to also hotlink the images externally. This is only possible because Reddthat uses a CDN and caches the images as much as possible.

Even if we didn't use a cdn there are plenty of VPS' and proxy software that we could use which would transparently function in the same way. You could even setup your own VPS, some image hosting software like https://chibisafe.moe/ or https://github.com/nokonoko/Uguu or https://github.com/hauxir/imgpush

To sum up:

  • post once to Lemmy instance and then use that image everywhere
  • use a random image host that allows hotlinking to do the same
  • get your own VPS, setup an image upload and use that (and maybe get a domain too!)

The 3rd option you can do completely anonymously via crypto.

[โ€“] [email protected] 1 points 1 week ago

๐ŸŽ‰๐ŸŽ‰๐ŸŽ‰

[โ€“] [email protected] 5 points 1 week ago* (last edited 1 week ago) (2 children)

It will probably be due to your language settings. You probably unticked Uncategorised. Turn that back on and see if you can see all the posts again.

[โ€“] [email protected] 1 points 3 weeks ago (1 children)

This got reported for being AI generated. I cross checked with 2 different ai checkers and both got 100% validity...

[โ€“] [email protected] 3 points 1 month ago (1 children)

Our upgrade is done, so please try adding the image(s) when you can

[โ€“] [email protected] 7 points 1 month ago

I'll be posting some of them which I find are interesting!

 

My talk explores the trajectory of iOS spyware from the initial discovery of Pegasus in 2016 to the latest cases in 2024.

The talk will start with an analysis how exploits, infection vectors and methods of commercial spyware on iOS have changed over time.

The second section of the talk is all about advances in detection methods and the forensic sources which are available to discover commercial spyware. This talk will also include a Case Study about the discovery and analysis of BlastPass (one of the latest NSO Exploits).

The third part will discuss technical challenges and limitations of the detections methods and data sources.

Finally, I will conclude the talk with open research topics and suggestions what Apple or we could technically do to make the detection of commercial spyware better.

The commercial spyware landscape on iOS has evolved significantly since the discovery of Pegasus in 2016. In this talk, weโ€™ll explore that evolution through four main areas:

  1. Spyware Evolution (2016-2024): By analyzing key exploits, tactics, techniques, and procedures (TTPs), infection vectors, and indicators of compromise (IOCs), weโ€™ll trace how spyware has advanced in sophistication, highlighting changes that have led to todayโ€™s complex threats.
  2. Advancements in Detection: As spyware has grown more sophisticated, so too have detection capabilities. Weโ€™ll review the main actors, public organizations and tools that have shaped spyware detection. This part will also include a case study on my discovery and analysis of a sample NSOโ€˜s BlastPass Exploit chain.
  3. Current and Future Challenges: Looking forward, weโ€™ll examine the pressing challenges in spyware detection and speculate on how commercial spyware might evolve in response to new security measures and technologies.
  4. Recommendations for Research and Detections: Finally, Iโ€™ll offer recommendations for advancing research and detection methods and capabilities to combat commercial spyware.

Attendees will gain a comprehensive view of the past, present, and future of spyware on iOS, along with actionable strategies for future research and collaboration.

Licensed to the public under http://creativecommons.org/licenses/by/4.0

33
submitted 1 month ago* (last edited 1 month ago) by [email protected] to c/[email protected]
 

We present fatal security flaws in the HALFLOOP-24 encryption algorithm, which is used by the US military and NATO. HALFLOOP-24 was meant to safeguard the automatic link establishment protocol in high frequency radio, but our research demonstrates that merely two hours of intercepted radio traffic are sufficient to recover the secret key. In the talk, we start with the fundamentals of symmetric key cryptography before going into the details of high frequency radio, HALFLOOP-24, and the foundation of our attack.

High frequency (HF) radio, also known as shortwave radio, is commonly used by the military, other government agencies and industries that need highly robust long-distance communication without any external infrastructures. HF radio uses frequencies between 3 and 30 MHz. These frequencies enable skywave propagation, where the radio signals are reflected by electrically charged particles in the upper atmosphere. While this effect enables communication across very large distances, historically, it required trained and experienced operators to establish a radio link.

This dependence on operators was reduced by the introduction of the automatic link establishment (ALE) protocol. In a nutshell, an ALE-enabled radio establishes a link to another radio by selecting a suitable frequency according to a propagation model and then transmitting a call frame. If the frequency is good, the other radio receives the frame and the two radios perform a handshake to set up a link. The encryption of these ALE frames is known as linking protection. It is primarily meant to protect unauthorized users from establishing links with radios in a network or interfering with established links. Additionally, encryption of ALE frames also protects the network from certain types of traffic analysis, which is the analysis of operating data such as network structure, frequencies, callsigns and schedules. The first ALE standard did not specify a cipher, but specified how to integrate a stream cipher with ALE. Later standards introduced the 56-bit key Lattice/SoDark cipher, which is now recommended to be replaced with HALFLOOP whenever possible.

HALFLOOP, which is standardized in US standard MIL-STD-188-14D since 2017, is essentially a downscaled version of the Advanced Encryption Standard (AES), which effectively is the most used encryption algorithm today. While this downscaling led to many strong components in HALFLOOP, a fatal flaw in the handling of the so-called tweak enables devastating attacks. In a nutshell, by applying a technique known as differential cryptanalysis, an attacker can skip large parts of the encryption process. In turn, this makes it possible to extract the used secret key and hence enables an attacker to break the confidentiality of the ALE handshake messages and also makes an efficient denial-of-service attack possible.

These attacks are described in the two research papers, Breaking HALFLOOP-24 and Destroying HALFLOOP-24. They were initiated by the presentation of the Cryptanalysis of the SoDark Cipher, the predecessor of HALFLOOP.

Licensed to the public under http://creativecommons.org/licenses/by/4.0

 

Let's bring in the new year with some maintenance.

We are going to update Lemmy to the latest version 0.19.8

To perform this there will be a downtime of 30 to 45 minutes while our database updates.

Unless everything goes wrong we'll be up within the hour.

See you on the other side.

Tiff


Edit 1:
We are all done!

Edit 2:
Frontends didn't start correctly and should be sorted now

[โ€“] [email protected] 3 points 1 month ago (1 children)

It's certainly not too big, as we can upload 25MB images without issue!

This is probably a bug with Lemmy as we have not upgraded to the latest version. 0.19.8 has a thumbnail issue that was resolved so it's possible that it's related.

I'll schedule it for Tuesday around 00:00 UTC.

Hopefully once that is done it will be all sorted!

 

What's your plans for today, tomorrow, and the next year?

[โ€“] [email protected] 11 points 1 month ago

Thank you for the update and it's good to hear your upcoming plans. Being one of those people in Australia (Reddthat) it will be good to see if it actually works as it's designed too!
I'd love to save $7/m to not have a server dedicated to batching the federation traffic ๐Ÿ˜…

When you lay out the timelines for 0.19.3 onwards no time at all has gone by, and having to deal with the issues after .3 has certainly not been fun as an admin. (And I'm only a small server compared!)
Being such a huge player in our Lemmyverse, thanks for taking the time to plan this out as I know how much testing has been done to get us this far.

It's always a nice experience chatting to the LW team!
Hope your updates go smoothly!

[โ€“] [email protected] 2 points 1 month ago

We got there in the end ๐Ÿ‘ and welcome aboard!

[โ€“] [email protected] 2 points 1 month ago (2 children)

Oh wow... I miss interpreted your intention. I thought you meant promote as in, using that post as a way to promoting someone to join, not that you wanted to be promoted into the position!

Sorry for the mix-up and glad to have you on board. It's been actioned!

[โ€“] [email protected] 2 points 1 month ago

Appointed ! Happy to have you here

[โ€“] [email protected] 2 points 1 month ago (4 children)

Yeah saying I endorse the request to find moderator.

Keep in kind that all reports on Lemmy get sent to the admins of the reported user, and wherever the community is hosted. So even if you report a post or comment in woman's hockey, it will always be seen by Reddthat admins (& the moderator). So I and the other Reddthat admins already see every report (for our instance).

Also anyone on Lemmy can be a moderator of it, it doesn't just have to be the people on Reddthat, so you might want to post to the actual community asking if anyone wants to be a moderator.

I'll pin it to the community and hopefully you get some traction, or you yourself can be the mod for the interim and then you can pin it yourself :)

20
submitted 1 month ago* (last edited 1 month ago) by [email protected] to c/[email protected]
 

Read the whole thread, great look at the original Pentium and some pretty pictures to match!

30
submitted 1 month ago* (last edited 1 month ago) by [email protected] to c/[email protected]
 

Hello Reddthat-thians!

As always here is our semi-whenever there is news update. I would, as always like to thank you all for being here and for the kind support we received last time I made an update.

We hit a few couple of milestones this last quarter:

  • Our first BTC transaction was received! Thank you anonymous!
  • Lemmy released two versions (which we have yet to update too, more below)
  • I only restarted the services once the whole quarter as I thought we were down/stuck.

Lemmy 0.19.7

The latest update brings some fixes to Lemmy as well as ~~new features such as Private/Invite only communities. I can't wait to see what this does to help people find safe spaces and to self regulate.~~ Edit: that's in 0.20.0. The only new features (worth talking about imo) are parallel sending and allowing people to have 1000 characters in their bio.
This update is not live yet as the update requires a 30-60 minute database update that I want to test on a backup to make sure we can safely update. Other big instances have already done the update and most things went successfully so I'm confident that we can update without much fuss but I'd like to actually enjoy my holidays rather than spending 4 hours debugging db migrations! So, testing first.

Users

Something I think we struggle with is our proposition. As we have an opinionated view on what our community should be which doesn't always resonate when trying to sign up. With "only" 100 users active daily compared to other servers with over 1k it puts into perspective that not everyone agrees with our policies, but there are certainly people who do!

As such I'm open to ideas on growing our userbase or ideas on rephrasing our signup page, and sidebar.

Australian Social Media Laws

Here is the biggest news. Last week the Australian Government passed a new law that requires Social Media to no longer be accessible for kids under the age of 16. As such we will need to design a system & possibly modify Lemmy to be compliant with these laws.

I will not debate whether this is good or bad, because at the end of the day, we only have a few options: comply with these laws, don't comply and turn off reddthat, sell / handoff to another admin.
This has been a fun side project for me and I want to continue it. As such I'm looking into ways to comply with the local laws to ensure that Australian minors are blocked.

For Reddthat, this law requires social media to take "reasonable" steps to ensure children under the age of 16 are not be given an account. They do not define what reasonable means and leave it up to the social media platforms to define it. Really helpful for those indie social media platforms...

Unfortunately, like myself, I was thinking that we might technically not be defined as a social media platform thus skirting around the rule. The law defines a social media platform as any site whose primary or significant purpose is to connect 2 or more users, allows end-users to link to or interact with other end-users, and that allows end-users to post content.
So Lemmy, Mastodon, Blusky et al will be affected.

Researching it more leads to the idea which puts the onus on social media companies to continually verify accounts, so they take a proactive step to verify accounts that are believed to be accessed by minors under 16. Thus you need to prove you are above 16 years old. The cherry on top? You are not allowed to use a government issued ID to do it.
Thinking back to when you were 16 years old, what forms of identification did you have? A driver's licence? Maybe a passport? A school ID card? The last one (school ID) would be the only valid id you could use to verify yourself that isn't government issued in this instance. And good luck if you don't go to school anymore and started in the workforce when your 16.

Needless to say this is going to be a recurring theme over the next year and I will keep you all informed about it with our updates.

Future Features

A general outline of what I'm hoping to achieve is more controls in Lemmy to:

  • have accounts in a 'monitored' state
  • have a way to customise approval processes
  • have accounts use a trust rating based on age, post/comment numbers, etc.
    • this would help with spam as well (obviously this would need a lot of factors)
  • have automod built in (or actually setup correctly for us)

Obviously these are things that will need Lemmy development to help facilitate and I'll be creating a few issues over the weeks once I've fleshed out what a solution might look like.
If you have ideas please share! let's start the conversation on what the processes would look like to help solve our issues.

Financials

Thanks to the big donation drive from last time I posted we are still looking healthy enough in the financials to last until May next year! Which is good as our server plan renews in April. At that time we will be downgrading to a smaller instance as we may have over exaggerated when purchasing last April. We'll obviously know more closer to April next year about our financials and what we can afford to ensure we are cost neutral (if possible!).

Our LemmyWorld proxy also is an extra cost that we never budgeted for and has been ticking away successfully. Maybe by April LW will have upgraded to >0.19.5 which will give us parallel sending allowing us to remove the proxy.

Our object storage is humming along but costs are creaping up. I'll be doing an audit and possible look into doing a cost analysis to see if other object storage solutions would be cheaper. But for less than $20/m it's probably not even worth my time...

As a reminder we have many ways to donate if you are able. A recurring donation of $5 is worth more to me than a once of $60 donation. Only because it allows me to forecast the year and work out when we need to do donation drives or relax knowing everything in it's current state will be fine.

Note: while you still can transfer me Bitcoin, I have removed it as an option because of the current transaction fees. Monero or Litecoin offer transaction fees as low as $0.005 so they are the preferred options compared to the $5 transaction fee of Bitcoin.

Conclusion

You are awesome. Posting, Commenting, and interacting with communities on Reddthat or through Reddthat makes it enjoyable every time to write these updates. So keep being awesome, even if you are a lurker!

If I were not hosting in Australia I would still be required to conform to laws if I were to allow Australian people to use Reddthat. Blocking all of Aus would be an option. But we need to ask ourselves does that fall under our values or ideals? (No obviously). Neither does requiring people to verify they are over a certain age. But we'll see what's to become.
This is the same as how CPPA or GDPR are still enforcable while we are all the way on the other side of the world.
This doesn't require a knee jerk reaction but requires serious thinking, whiteboarding and well thought out communication.

As always,
Cheers,

Tiff

PS Happy Holidays!

 

A nice in-depth post on the hardware too!

view more: next โ€บ