Reverse proxies aren’t DNS servers.

The DNS server will be configured to know that your domain, e.g., example.com or *.example.com, is a particular IP, and when someone navigates to that URL it tells them the IP, which they then send a request to.

The reverse proxy runs on that IP; it intercepts and analyzes the request. This can be as simple as transparently forwarding jellyfin.example.com to the specific IP (could even be an internal IP address on the same machine - I use Traefik to expose Docker network IPs that aren’t exposed at the host level) and port, but they can also inspect and rewrite headers and other request properties and they can have different logic depending on the various values.

Your router is likely handling the .local “domain” resolution and that’s what you’ll need to be concerned with when configuring AdGuard.

It isn’t, because their business practices violate the four FOSS essential freedoms:

1. The freedom to run the program for any purpose
2. The freedom to study and modify the program
3. The freedom to redistribute copies of the original or modified program
4. The freedom to distribute modified versions of the program

Specifically, freedom 4 is violated, because you are not permitted to distribute a modified version of the program that connects to the Signal servers (even if all your modified version does is to remove Google Play Services or something similar).

This particular scenario involves the MacOS desktop app, not the phone app. The link is showing just an image for me - I think it’s supposed to be to https://stackdiary.com/signal-under-fire-for-storing-encryption-keys-in-plaintext/

That said, let’s compare how it works on the phone to how it could work on MacOS and how it actually works on MacOS. In each scenario, we’ll suppose you installed an app that has hidden malware - we’ll call it X (just as a placeholder name) - and compare how much data that app has access to. Access to session data allows the app to spoof your client and send+receive messages

On the phone, your data is sandboxed. X cannot access your Signal messages or session data. ✅ Signal may also encrypt the data and store an encryption key in the database, but this wouldn’t improve security except in very specific circumstances (basically it would mean that if exploits were being used to access your data, you’d need more exploits if the key were in the keychain). Downside: On iOS at least, you also don’t have access to this data.

On MacOS, it could be implemented using sandboxed data. Then, X would not be able to access your Signal messages or spoof your session unless you explicitly allowed it to (it could request access to it and you would be shown a modal). ✅ Downside: the UX to upload attachments is worse.

It could also be implemented by storing the encryption key in the keychain instead of in plaintext on disk. Then, X would not be able to access your Signal messages and session data. It might be able to request access - I’m not sure. As a user, you can access the keychain but you have to re-authenticate. ✅ Downside: None.

It’s actually implemented by storing the encryption key in plaintext, collocated with the encrypted database file. X can access your messages and session data. ❌

Is it foolproof? No, of course not. But it’s an easy step that would probably take an hour of dev time to refactor. They’re even already storing a key, just not one that’s used for this. And this has been a known issue that they’ve refused to fix for several years. Because of their hostile behavior towards forks, the FOSS community also cannot distribute a hardened version that fixes this issue.

They probably have experience with Spring

I understand that

I’m not convinced

It’s largely the first one, at least according to The Man Who Killed Google Search.

See also the Hackernews discussion and this follow-up article by the same author (with links to an article with Google’s response, summaries of other discussions on the topic, etc.)

the proof is in the pudding with this one

It isn’t.

as you must also ask yourself why E15 is banned during summer months in the first place.

I did. And I shared that in my comment above.

Your source doesn’t share any data on the topic, even just as a summary, but it links to summertime smog, which links to “smog-causing pollutants”, which says:

Section 211(h)(1) of the Clean Air Act prohibits the sale of gasoline that has a Reid Vapor Pressure greater than 9.0 psi during the “high ozone season,” which runs from June 1 to September 15. (RVP is a measure of volatility; high-RVP gasolines release more volatile organic compounds into the troposphere where those VOCs contribute to ozone formation.) Gasoline-ethanol blends below E50 are more volatile than straight gasoline and cannot readily meet the 9.0 psi RVP requirement. Congress created a “one-pound waiver” at Section 211(h)(4) that increases the RVP limit from 9.0 psi to 10.0 psi, but—and here’s the catch—the waiver is only available to “fuel blends containing gasoline and 10 percent denatured anhydrous ethanol.” That is, only E10 can take advantage of the one-pound waiver. Although E15 is slightly less volatile than E10, its RVP still exceeds 9 psi. It needs a one-pound waiver to meet Section 211(h)’s RVP limit in the same way that E10 does, but it is not eligible for one under current law.

The article’s justification for why E15 isn’t legally permitted is that there’s a law against it, which is circular logic. From the environmental protection perspective, it doesn’t sound like there is data suggesting that E15 on its own is worse for the environment than E10. If the only argument is a legal one, it’s not a good argument.

If you can answer that question you’ll likely find the information you’re looking for.

I did, and I shared that answer in my comment above, too - but it’s not the answer you seem to think it is.

Do you disagree that the US isn’t supporting Israel, then, or do you disagree that what Israel is doing to Palestinians amounts to genocide?

Some reading for you in case you’re somehow not familiar with the topic:

• https://jewishcurrents.org/a-textbook-case-of-genocide
• https://en.m.wikipedia.org/wiki/Palestinian_genocide_accusation
• https://www.ohchr.org/en/press-releases/2023/11/gaza-un-experts-call-international-community-prevent-genocide-against
• https://worldwithoutgenocide.org/genocides-and-conflicts/israel-palestine-conflict-history-causes-and-international-law
• https://news.un.org/en/story/2024/03/1147976
• https://www.972mag.com/lavender-ai-israeli-army-gaza/
• https://www.bbc.com/news/world-middle-east-67922346

Even if the international courts don’t rule that Israel is committing genocide, that will necessarily have been influenced by the United States’s close ties to Israel, so that they haven’t yet said whether it is or isn’t genocide is irrelevant. According to the evidence we have, it is.

That said, see also the intro of https://en.m.wikipedia.org/wiki/Native_American_genocide_in_the_United_States

Others, like historian Gary Anderson, contend that genocide does not accurately characterize any aspect of American history, suggesting instead that ethnic cleansing is a more appropriate term.

I’ve seen that same statement by people opposed to the use of the word “genocide” when talking about Israel’s genocide of Palestine, and it’s just as credible there as when “historian Gary Anderson” said it. At best, such a stance is pedantic; at worst, it supports Israel’s genocide by denying and enabling it.

Afaict from reading that (and one of the sources, and its source) it boils down to the fuels’ “RVP levels” (which have an impact on volatility and the amount of VOCs given off) being past a particular threshold. E10 is also past that threshold, but it has an exception that E15 doesn’t have. However, by that same measure, E15 is less volatile than E10.

The author also expressed concern about expanding corn production as a result of expanded E15 and that there haven’t been sufficient studies on the impact of E15 on the environment (particularly in the summer months). But that’s also paired with a statement saying that “consumers don’t want E15,” which detracts from the previous arguments; if true it means their impacts, if any, would be minimal.

I didn’t read every link from that page but none gave a better reason.

My takeaway is that it sounds like we don’t have any data showing that E15 is worse than E10, so the obvious move is to actually start funding those studies.

I also found https://foe.org/blog/2012-05-understanding-e15/ which is very anti-E15; however I wasn’t able to verify their claims because none of the linked articles loaded for me.

If your Java dev is using Jackson to serialize to JSON, they might not be very experienced with Jackson, or they might think that a Java object with a null field would serialize to JSON with that field omitted. And on another project that might have been true, because Jackson can be configured globally to omit null properties. They can also fix this issue with annotations at the class/field level, most likely @JsonInclude(Include.NON\_NULL).

More details: https://www.baeldung.com/jackson-ignore-null-fields

“Glue is not pizza sauce” seems like a common fact to me but Googles llm disagrees for example.

That wasn’t something an LLM came up with, though. That was done by a system that uses an LLM. My guess is the system retrieves a small set of results and then just uses the LLM to phrase a response to the user’s query by referencing the links in question.

It’d be like saying to someone “rephrase the relevant parts of this document to answer the user’s question” but the only relevant part is a joke. There’s not much else you can do there.

Third, a redirect is obvious

A redirect isn’t necessary if you control the DNS servers. If you control the DNS servers, you can MITM the website for any visitor because you can prove that you own the domain to a certificate authority and generate a new, trusted HTTPS cert. (Depending on specifics this may or may not foil the anti-phishing capabilities of Passkeys / U2F.)

They aren’t. From a comment on https://www.reddit.com/r/ublock/comments/32mos6/ublock_vs_ublock_origin/ by u/tehdang:

For people who have stumbled into this thread while googling “ublock vs origin”. Take a look at this link:

http://tuxdiary.com/2015/06/14/ublock-origin/

"Chris AlJoudi [current owner of uBlock] is under fire on Reddit due to several actions in recent past:

• In a Wikipedia edit for uBlock, Chris removed all credits to Raymond [Hill, original author and owner of uBlock Origin] and added his name without any mention of the original author’s contribution.
• Chris pledged a donation with overblown details on expenses like $25 per week for web hosting.
• The activities of Chris since he took over the project are more business and advertisement oriented than development driven."

So I would recommend that you go with uBlock Origin and not uBlock. I hope this helps!

Edit: Also got this bit of information from here:

https://www.reddit.com/r/chrome/comments/32ory7/ublock_is_back_under_a_new_name/

TL;DR:

• gorhill [Raymond Hill] got tired of dozens of “my facebook isnt working plz help” issues.
• he handed the repository to chrismatic [Chris Aljioudi] while maintaining control of the extension in the Chrome webstore (by forking chrismatic’s version back to himself).
• chrismatic promptly added donate buttons and a “made with love by Chris” note.
• gorhill took exception to this and asked chrismatic to change the name so people didn’t confuse uBlock (the original, now called uBlock Origin) and uBlock (chrismatic’s version).
• Google took down gorhill’s extension. Apparently this was because of the naming issue (since technically chrismatic has control of the repo).
• gorhill renamed and rebranded his version of ublock to uBlock Origin.

Is it possible to force a corruption if a disk clone is attempted?

Anything that corrupts a single file would work. You could certainly change your own disk cloning binaries to include such functionality, but if someone were accessing your data directly via their own OS, that wouldn’t be effective. I don’t know of a way to circumvent that last part other than ensuring that the data isn’t left on disk when you’re done. For example, you could use a ramdisk instead of non-volatile storage. You could delete or intentionally corrupt the volume when you unmount it. You could split the file, storing half on your USB flash drive and keeping the other half on your PC. You could XOR the file with contents of another file (e.g., one on your USB flash drive instead of on your PC) and then XOR it again when you need to access it.

What sort of attack are you trying to protect from here?

If the goal is plausible deniability, then it’s worth noting that VeraCrypt volumes aren’t identifiable as distinct from random data. So if you have a valid reason for having a big block of random data on disk, you could say that’s what the file was. Random files are useful because they are not compressible. For example, you could be using those files to test: network/storage media performance or compression/hash/backup&restore/encrypt&decrypt functions. You could be using them to have a repeatable set of random values to use in a program (like using a seed, but without necessarily being limited to using a PRNG to generate the sequence).

If that’s not sufficient, you should look into hidden volumes. The idea is that you take a regular encrypted volume, whose free space, on disk, looks just like random data, you store your hidden volume within the free space. The hidden volume gets its own password. Then, you can mount the volume using the first password and get visibility into a “decoy” set of files or use the second password to view your “hidden” files. Note that when mounting it to view the decoy files, any write operations will have a chance of corrupting the hidden files. However, you can supply both passwords to mount it in a protected mode, allowing you to change the decoy files and avoid corrupting the hidden ones.

It sounds like you want these files to be encrypted.

Someone already suggested encrypting them with GPG, but maybe you want the files themselves to also be isolated, even while their data is encrypted. In that case, consider an encrypted volume. I assume you’re familiar with LUKS - you can encrypt a partition with a different password and disable auto-mount pretty easily. But if you’d rather use a file-based volume, then check out VeraCrypt - it’s a FOSS-ish [1], cross-platform tool that provides this capability. The official documentation is very Windows-focused - the ArchLinux wiki article is a pretty useful Linux focused alternative.

Normal operation is that you use a file to store the volume, which can be “dynamic” with a max size or can be statically sized (you can also directly encrypt a disk partition, but you could do that with LUKS, too). Then, before you can access the files - read or write - you have to enter the password, supply the encryption key, etc., in order to unlock it.

Someone without the password but with permission to modify the file will be capable of corrupting it (which would prevent you from accessing every protected file), but unless they somehow got access to the password they wouldn’t be able to view or modify the protected files.

The big advantage over LUKS is ease of creating/mounting file-based volumes and portability. If you’re concerned about another user deleting your encrypted volume, then you can easily back it up without decrypting it. You can easily load and access it on other systems, too - there are official, stable apps on Windows and Mac, though you’ll need admin access to run them. On Android and iOS options are a bit more slim - EDS on Android and Disk Decipher on iOS. If you’re copying a volume to a Linux system without VeraCrypt installed, you’ll likely still be able to mount it, as dm-crypt has support for VeraCrypt volumes.

• 1 - It’s based on TrueCrypt, which has some less free restrictions, e.g., c. Phrase "Based on TrueCrypt, freely available at http://www.truecrypt.org/" must be displayed by Your Product (if technically feasible) and contained in its documentation.”

“Supposed to” according to what?

If you’re in the US, Federal labor laws explicitly allow “meal periods” to not be paid, though short breaks must be paid. Neither is required to be offered to employees, though.

Source: https://www.dol.gov/general/topic/workhours/breaks

State laws differ, of course, and many states - e.g., California - have much more employee-friendly laws. However, even in CA, a meal period must be offered but isn’t required to be paid (unless it’s an on-duty meal break).

it’s still not a profitable venture

Source? My understanding is that Google doesn’t publish Youtube’s expenses directly but that Youtube has been responsible for 10% of Google’s revenue for the past few years (on the order of $31.5 Billion in 2023) and that it’s more likely than not profitable when looked at in isolation.

Tons of laptops with top notch specs for 1/2 the price of a M1/2 out there

The 13” M1 MacBook Air is $700 new from Best Buy. Better specced versions are available for $600 used (buy-it-now) on eBay, but the base specced version is available for $500 or less.

What $300 or less used / $350 new laptops are you recommending here?

theoretically they can

Is this a purely theoretical capability or is there actually evidence they have this capability?

it’s already been proven that they can tap into anyone’s phone

Listening into a conversation that you’re intentionally relaying across public infrastructure and gaining access to the phone itself are two very different things.

The use of proprietary software in literally everything

1. Speak for yourself. And let’s be real, if you’re on Lemmy you’re 10 times more likely to be running Linux.
2. Proprietary != closed source
3. Do you really think that just because something is closed source means that it can’t be analyzed?

the amount of exploits the NSA has on hand

How many zero-day exploits does the NSA have? How many can be deployed remotely and without a nontrivial action by a user?

what’s stopping the NSA from spying this much?

Scale, capacity, cost, number of employees

—-

I’m not saying we shouldn’t oppose government surveillance. We absolutely should. But like another commenter pointed out, I’m much more concerned with the amount of data that corporations collect and have.

It’s more like paying the ticket without ever showing up in court. And at least where I live, I can do that.