The strenghts and weaknesses of atproto and activitypub.
There is a lot bluesky gets right, and a lot it gets wrong, the same is true with Activitypub.
(Some) strengths of Atproto
Atproto is content-addressed, and portable. This means that posts can exist independantly of their original server.
Instead of giving posts a https uri, which will stop working if a user moves servers or their server disappears, they give them at uris.
For example, this post on bsky.app: bsky.app/profile/ponder.ooo/po…
Has the at:// link is: at://did:plc:i4bfh2tyxihe2ksplmtcoopk/app.bsky.feed.post/3lk4yrmyugc2f.
The post does exist over https at https://porcini.us-east.host.bsky.network/xrpc/com.atproto.repo.getRecord?repo=did:plc:i4bfh2tyxihe2ksplmtcoopk&collection=app.bsky.feed.post&rkey=3lk4yrmyugc2f.
Atproto is very easy to build apps on. For example, tangled.sh, frontpage.fyi and flushes.app are all apps built on atproto.
Atproto allows more flexibility in what an app can do, as opposed to lemmy or mastodon's api.
Atproto is better documented. The ActivityPub spec leaves a lot up to the reader.
Atproto has some really good moderation tools for users. People can make public blocklists of users, and people can subscribe to labellers, people or services which give users/posts a label.
Weaknesses of Atproto
almost everyone is on bluesky's PDSes. I thought mastodon.social and lemmy.world were bad, but the people on alternate PDSes altogether adds up to only a few thousand.
Its decentralised identifiers are actually completely centralised!
DID:PLC, their DID method, originally stood for placeholder, but they renamed it to Public Ledger of Credentials.
To use it, you have to use plc.directory.
You can use a DID:WEB DID, but if your website linked to it goes down you lose your identity.
(I find it extremely funny that its not actually a requirement for a decentralised identifier to be decentralised. )
Everything on the network has to be public to work.
since relays have to be able to collect all the information on the network for Appviews to be able to make use of that information, anyone can find out who's blocking someone, or who is on a list, or who's following who, with no way of hiding that information.
Private accounts and posts are impossible to do on atproto.
Since everything is public, DMs (for now) are centralised. They do seem like they want to change that though.
Strengths of ActivityPub
AP (ActivityPub) is better distributed. While it has large servers (like mastodon.social or lemmy.world (and threads, but we don't talk about threads)) the majority of users are not on those servers. There is no single point of failure. If bluesky disappeared tomorrow, atproto would still exist, it would just have a negligable amount of users.
One node in the network lets you do everything, as opposed to bluesky which has three parts (You can do stuff without a relay though). This means you can trust a lot less of the network.
ActivityPub scales better than ATProto. Atproto scales quadratically, meaning that having a lot of nodes in the network harms performance.
AP scales horizontally, meaning it works better with a lot of small servers.
ActivityPub can keep stuff private, like blocks and posts.
Though, a lot of implementations can leak posts.
Weaknesses of ActivityPub
The spec leaves so much out. They didn't propose a way to make sure requests between servers are validated, so mastodon chose HTTP signatures.
They didn't add any way of looking up handles, so mastodon chose webfinger.
A posts's id is its https uri, this means thatif a server goes down, stuff can't be fetched. A user can't move their followers if their server goes down (you can on ATproto). There is a standard to fix this, FEP-ef61, but it breaks compatibility with a lot of implementations.
Missing information is a problem. Its not really a problem on lemmy, but on mastodon likes and replies from other servers may not make it to your server at all (you can fetch replies in newer versions of mastodon though).
All this aside, I do think the two can coexist. I don't see anything like lemmy working on atproto. ActivityPub seems closer to social networking, as opposed to social media.
Something like facebook would be impossible to make on atproto, because not everything is made to be public.
I am hoping for a bridge, but good (bridgy is opt-in, making it useless).
like this
The surprising advantages of a colony on Titan
Let's Colonize Titan
Saturn's largest moon might be the only place beyond Earth where humans could liveCharles Wohlforth (Scientific American)
[Article] Human breathing patterns are as unique as our fingerprints
Just like fingerprints, your breathing patterns may be a unique identifying feature. Scientists have found they can identify people with 96.8% accuracy using only their breathing patterns. And it's not just simple identification, researchers say they can even predict Body Mass Index (BMI), state (sleeping or awake), and cognitive traits (anxiety or depression) from the way you breathe.
Human breathing patterns are as unique as our fingerprints
Just like fingerprints, your breathing patterns may be unique. Scientists found they can identify people using only breathing patterns. And it's not just identification, researchers can predict BMI, and anxiety or depression from the way you breathe.Jay Kakade (New Atlas)
Emmanuel Macron’s Bid to Divide the Left Is Paying Off
One year since the New Popular Front won a surprise election victory, France’s left looks more divided than ever. This month’s Socialist congress showed how much the party is at loggerheads with Jean-Luc Mélenchon’s France Insoumise.
Democratize AI or Make the AI Oligarchy an Inevitability
Artificial intelligence technologies are leading us to a critical juncture, forcing a fundamental rethinking of both work and the welfare state. This is a field where early surrender, allowing capital to shape the future, is not an option.
Hurricane-killing particles could sabotage storms before they grow
There have been some wildly ambitious schemes to knock the power out of hurricanes and cyclones over the years. Now, scientists believe they have come up with a way to successfully subdue these destructive storms, long before they have a chance to reach land.
Hurricane-killing particles could sabotage storms before they grow
There have been some wildly ambitious schemes to knock the power out of hurricanes over the years. Now, scientists believe they have come up with a way to successfully subdue these destructive storms, long before they have a chance to reach land.Bronwyn Thompson (New Atlas)
Trump’s Iran War Is a Betrayal We All Saw Coming
It took less than half a year for Donald Trump to renege on the promises he incessantly made on the campaign trail and plunge the country into another dumb, potentially bloody Middle East war no one wants.
After Trump's Bombing, Sanders Condemns 'Lies' Over Iran Nuclear Threat
U.S. Sen. Bernie Sanders condemns Trump's lies justifying bombing of Iranian nuclear facilities, warns against repeating history of disastrous wars based on falsehoods. #NoMoreWar
After Trump's Bombing, Sanders Condemns 'Lies' Over Iran Nuclear Threat
"We cannot allow ourselves to be dragged into another Middle East war based on lies."julia-conley (Common Dreams)
Zohran Mamdani vs. New York Landlords
The real estate industry is pouring millions into Andrew Cuomo’s mayoral campaign in an effort to stop the robust pro-tenant candidacy of Zohran Mamdani.
The Liberals Are Bailing Out Canada Post Management Again
The federal government is doing management’s bidding by undermining CUPW and forcing a vote on a substandard offer.
Moth flying into the hot light bulb: Bzzt Gets fried
190 Millions years of evolution lost to human progress, onwards!
Calls for Impeachment Grow as Trump Floats 'Regime Change' in Iran
President Trump floats regime change in Iran as calls for impeachment grow in response to U.S. strikes on Iran.
Calls for Impeachment Grow as Trump Floats 'Regime Change' in Iran
The striking of Iranian nuclear sites without congressional approval, said Rep. Alexandria Ocasio-Cortez, "is absolutely and clearly grounds for impeachment."eloise-goldsmith (Common Dreams)
adhocfungus likes this.
US | House Bans WhatsApp on Congressional Staff Devices Over Security Concerns
The U.S. House chief administrative officer has banned WhatsApp from congressional staffers' government devices citing data vulnerability concerns. The cybersecurity office deemed the messaging app "high-risk" due to lack of transparency in data protection, absence of stored data encryption, and potential security risks, according to an email obtained by Axios.
Met Police chief 'shocked' by planned Palestine Action protest in London
Met Police chief 'shocked' by planned Palestine Action protest in London
The force says it cannot legally stop Monday's protest in support of the pro-Palestine group.Jacqueline Howard (BBC News)
‘Never give up nuclear weapons’: what Israel-Iran conflict tells North Korea
How Israel-Iran conflict hardens North Korea’s nuclear resolve
With lessons drawn from Ukraine and now Iran, Pyongyang’s commitment to its ‘irreversible’ nuclear status is firmer than ever, analysts say.Park Chan-kyong (South China Morning Post)
What is the best degoogled tablet for an artist?
cross-posted from: lemmy.world/post/31808224
Please see the cross-post as it is updated.
What is the best degoogled tablet for an artistwhat is the best tablet for iodeOS, GrapheneOS and LineageOS
- with smooth stylus support that is as good as apple pen
- palm rejection
- pressure sensitive stylus
- works well for krita / excalidraw / xournalapp
- latency
- at least 16GB RAM and 256GB storageFor iodeOS, it doesn't seem to support any tablet device officially
- iodéOS official supported devices - iodéFor GrapheneOS, the only choice is google pixel tablet (or maybe pixel fold). However
- pixel tablet have latency issue
- based on Google Pixel Tablet Review - YouTube
- pixel fold does not support stylus
- workaround This Stylus Pen works with the Google Pixel Fold - YouTube
- Can someone share their GrapheneOS pixel tablet experience on krita / excalidraw / xournalapp?For LineageOS
- What tablet+stylus+LineageOS has the best performance?
- What tablet+stylus+LineageOS has the best balance between price and performance?
- Can someone share their stylus experience on krita / excalidraw / xournalapp?Sincere thanks
cross-posted from: lemmy.world/post/31808224
Please see the cross-post as it is updated.
iodéOS official supported devices - iodé
The models below are officially supported by the iodé team. Don’t see your device in the list? Don’t panic! We also support a iodéOS GSI. You can also find here a list of unofficially supported models by the iodé community.iodé
What I don’t get is why lefty Canadians were so against Alberta leaving Canada.
Sounds like a plus to me…
Israel strikes Iran's Evin prison in Tehran
Israel strikes Iran's Evin prison in Tehran
Israel said its carrying out strikes inside Iran with 'unprecedented intensity,' destroying numerous security offices and damaging the gate at Tehran's infamous Evin Prison. DW has the latest.Jon Shelton (Deutsche Welle)
Iyo vs. Io — OpenAI and Jony Ive get sued
Iyo vs. Io — OpenAI and Jony Ive get sued
In May, legendary Apple designer Jony Ive hooked up with OpenAI to announce an unspecified gadget. [WSJ, archive] To promote this complete vaporware, OpenAI released a video of Sam Altman and Ive b…Pivot to AI
US strikes on Iran did not violate international law, NATO’s Rutte says
)
Map shows where President Barack Obama dropped his 20,000 bombs | The Independent
Outgoing US leader carries out 3,000 more strikes in 2016 than year beforeHarriet Agerholm (The Independent)
Belgium: Activists blockade access to 2 companies they accuse of “complicity with Israeli genocide in Gaza”
The protest started at around 7:45 am on Monday. Protesters blocked the entrance to the Syensqo chemical company in Brussels and OIP Sensor Systems in Tournai (Hainaut Province). OIP Sensor Systems is entirely owned by Elbit, an Israeli arms company.
At Syensqo in Brussels the activists blocked all the access routes to the company and painted the front of the office building red. The company supplies parts for Israeli drones.
"Syensqo knowingly supplies a key component for a weapon known for its use in Israeli war crimes. Syensqo cannot deny its complicity in the ongoing genocide”, the activists said in a statement.
Meanwhile, in Tournai, activists entered a warehouse used by OIP, where they painted equipment that is being stored inside red.
Activists blockade access to 2 companies they accuse of “complicity with Israeli genocide in Gaza” | VRT NWS: news
Activists blocked access to 2 companies with links to Israel on Monday morning. They accuse the companies of complicity in what they describe as “genocidal acts” of the part of Isreal in Gaza.VRT NWS
"Mass layoff" provision in Trump bill sparks alarm: "Deeply concerning"
'Mass Layoff' Provision in Trump Bill Sparks Alarm: 'Deeply Concerning'
"This [bill] would basically give [Trump] carte blanche to refashion the entire federal government," Ben Olinksy told Newsweek.Sophie Clark (Newsweek)
if you want to force your way into World War 3 this seems like a brilliant idea.
Feels more like a speed run, the actors of this conflict don’t have many days left.
A 50,000-Year-Old Block of Ice Paints the Most Chilling Picture of the Future Ever
A 50,000-Year-Old Block of Ice Paints the Most Chilling Picture of the Future Ever
The highest CO2 levels in 50,000 years is still 10 times less than our current anthropogenic climate nightmare.Darren Orf (Popular Mechanics)
Tensor Manipulation Unit (TMU): Reconfigurable, Near-Memory Tensor Manipulation for High-Throughput AI SoC
Tensor Manipulation Unit (TMU): Reconfigurable, Near-Memory Tensor Manipulation for High-Throughput AI SoC
While recent advances in AI SoC design have focused heavily on accelerating tensor computation, the equally critical task of tensor manipulation, centered on high,volume data movement with minimal computation, remains underexplored.arXiv.org
How the Rubin Observatory Will Reinvent Astronomy
How the Rubin Observatory Will Reinvent Astronomy
IEEE Spectrum takes you inside the most advanced sky-mapping instrument ever built—and reveals its stunning first imagesEvan Ackerman (IEEE Spectrum)
How the Rubin Observatory Will Reinvent Astronomy
How the Rubin Observatory Will Reinvent Astronomy
IEEE Spectrum takes you inside the most advanced sky-mapping instrument ever built—and reveals its stunning first imagesEvan Ackerman (IEEE Spectrum)
It's true but I prefer my criticisms without ad hominems
Where's the source for discrediting the statement?
geneva_convenience doesn't like this.
"Can you prove Iran doesn't have nukes? Because Israeli intelligence told me they do!"
geneva_convenience doesn't like this.
Met Police linked to Israel as it gears up for pro-Palestine protests
Met Police linked to Israel as it gears up for pro-Palestine protests
Senior Metropolitan Police officers are regular attendees at a think tank closely tied to Israel’s military and intelligence services and have accepted hospitality from its embassy in London.JOHN McEVOY (Declassified Media ltd)
'There Is No Intel': Trump's Attacks on Iran Were Based on Vibes, Sources Say
Trump’s Attacks on Iran Were Based on ‘No Intel’: Sources
Trump’s decision to strike three Iranian nuclear facilities was not based on new intelligence, administration officials say.Andrew Perez (Rolling Stone)
geneva_convenience likes this.
Is there a way to block browser JavaScript from executing commands that retrieve sensitive information from my local machine, while still allowing JavaScript that is only used for rendering web pages?
As a security-conscious user, I've used NoScript since Firefox's early days, but its restrictive nature has become frustrating. I'm often forced to go unprotected just to access websites with multiple scripts running on different domains, which defeats the purpose of using NoScript and balances security and usability that it once provided.
Is there a way to block browser JavaScript from executing commands that retrieve sensitive information from my local machine, while still allowing JavaScript that is only used for rendering web pages?
by sensitive information I'm referring to
- local machine time
- local machine ram
- local machine operating system + version
- local machine hardware
- Serial Number
- Hardware ID
- UUID
- Windows Device ID
- Windows Product ID
- ...
greatly appreciate any insight
EDIT:
could be possible solution
discuss.grapheneos.org/d/16025…
- ~~LibreJS: GNU LibreJS aims to address the JavaScript problem described in Richard Stallman's article The JavaScript Trap.~~
- JShelter: Mitigates potential threats from JavaScript, including fingerprinting, tracking, and data collection. Slightly modifies the results of API calls, differently on different domains, so that the cross-site fingerprint is not stable. Applies security counter-measures that are likely not to break web pages. Allows fine-grained control over the restrictions and counter-measures applied to each domain.
Most of those things cannot be collected through JavaScript.Local time can.
RAM can only be approximated to protect user privacy. Edit: And it’s not available on Firefox.
OS+version are already in your browser’s user-agent string that is sent out with every request you make.
Machine hardware cannot be enumerated. JavaScript can try to guess your GPU based on what it can do with WebGL.
There is no way to get a serial number or similar.
To spoof timezone/OS+version/browser+version ... and disable WebGL, use sereneblue.github.io/chameleon…
- lemmy.world/post/31885153
Vanadium and what to use on desktop - GrapheneOS Discussion Forum
GrapheneOS discussion forumGrapheneOS Discussion Forum
Never found a better plugin - chameleon
sereneblue.github.io/chameleon…strongly recommend
like this
Harsh question: Do you have a real need to prevent this data from being collected, or are you investigating just for ~~funsies~~ best practice advice? There are a lot of posts like this where people overestimate the threat model they have and insist on needing to block things that are nearly impossible to, or at least have significant tradeoffs like you are dealing with now.
Javascript is also not the only source that sites can use for these pieces of info from your machine. Local time in particular can be estimated by looking up the rough location of your IP address then matching to a time zone.
Anyway.
I would assume you could technically fork localCDN (replaces remote javascript libraries with local copies) and then manually edit the local javascript library copies to remove the calls you are concerned about.
There's also options like uBlock Origin's methods of only whitelisting specific scripts. Much more flexible than NoScript. You can block scripts that are third party and only allow site specific ones fairly easily, without digging deep into the settings.
Bear in mind that your specific combination of installed extensions can also be a unique identifier though.
Do you have a real need to prevent this data from being collected
maybe
or are you investigating just for best practice advice?
yes
There are a lot of posts like this where people overestimate the threat model they have and insist on needing to block things that are nearly impossible to, or at least have significant tradeoffs like you are dealing with now
could you explain why it is nealy impossible from only blocking javascript from attaining "local machine operating system + version
"? I don't think this kind of information is relevant for webpage displaying. I dont think webpage will break if we ban js from doing so
I would assume you could technically fork localCDN (replaces remote javascript libraries with local copies) and then manually edit the local javascript library copies to remove the calls you are concerned about.
that could work I guess when I have enough js knowledge
There’s also options like uBlock Origin’s methods of only whitelisting specific scripts. Much more flexible than NoScript. You can block scripts that are third party and only allow site specific ones fairly easily, without digging deep into the settings.
is it possible to adjust uBlock Origin whitelisting and disallow js that retrieve "local machine operating system + version
" from running?
Bear in mind that your specific combination of installed extensions can also be a unique identifier though.
Does this mean website can see all the extensions I installed?
Some browsers have built in fingerprint resistance techniques you can enable:
support.mozilla.org/en-US/kb/r…
I wouldn't entirely trust it, but enabling this feature in strict mode would tick a few of your listed boxes.
Resist Fingerprinting | Firefox Help
Firefox's Advanced Preferences to resist fingerprinting can help prevent websites from uniquely identifying your device but can cause problems. Learn more.support.mozilla.org
FundMECFS
in reply to irelephant [he/him] • • •For Activitypub, a weakness is that the server has to host all the visible content to the server. So for example if lemmy got really big, and you wanted to host a tiny server but are subscribed to most lemmy comms, your server ends up hosting and fetching a copy of everything posted in these communities, which can add up to A LOT, in terms of network usage, and computational power. (For example see the debacle where an Australian sever (I think aussie.zone) struggled with this and was weeks behind fetching content from lemmy.world since so much content comes from that instance).
This probably would scale pretty terribly if it got anywhere near the size of reddit.
ATProto gives a scalable solution to this (but comes with tradeoffs). Where you can create your own “instance” PDS (Personal Data Server), without hosting all the posts federated to you, since this is hosted by a “relay” which does most of the heavy lifting computationally. So it ends up with a solution that looks more centralised (since there is less incentive to host relays, so fewer relays), but also much more friendly to people who wanna host their own “PDS” and therefore control their data. This is also very helpful with scalability and solves some of the weird federation quirks activitypub has (ie. you can’t see a lemmy community or mastodon account until someone on your instance subscribes or follows it).
irelephant [he/him]
in reply to FundMECFS • • •Yes, this does help, but atproto as a whole still doesn't scale well:
Source: dustycloud.org/blog/re-re-blue…
As well as this, if there was a reddit-like atproto AppView, setting up multiple instances of it would still result in the same problems.
Re: Re: Bluesky and Decentralization -- Dustycloud Brainstorms
dustycloud.orgFundMECFS
in reply to irelephant [he/him] • • •But this is assuming private messages no?
When 99% of the public traffic is on posts that will federate to most servers, this model becomes irrelevant.