Skip to main content



FOSS JS extension? (blocking by default non-FOSS JS)


I am a long-time NoScript extension (noscript.net/) user. For those who don't know this automatically blocks any javascript and let you accept them (temporarily or permanently) based on the scripts' origin domain.

NoScript as some quality-of-life option like 'accepting script from current page's domain by default' so only 3rd parties would be blocked (usefull in mobile where it is tedious to go to the menu).

When I saw LibreJS (gnu.org/software/librejs/) I though that would be a better version of NoScript but it is quiet different in usage and cares about license and not open-source code (maybe it can't).

Am I the only one who thought about checking for open-source JS scripts filtering (at least by default)? This would require reproducibility of 'compilation'/packaging. I think with lock files (npm, yarn, etc) this could be doable and we could have some automatic checks for code.

Maybe the trust system for who checks could be a problem. I wanted to discuss this matter for a while.

reshared this

in reply to Kajika

This entry was edited (1 year ago)
in reply to 9point6

I believe you missed the point, I am not in defense of Security through obscurity (en.wikipedia.org/wiki/Security…), quiet the opposite.

The point: "[...] risk for the service owner as it gives an easily parsable way for an attacker to check [...]" is well known and not the discussion here. You can choose close source for 'security' this is opensource community so I am wondering about such a tool.

This entry was edited (1 year ago)
in reply to Kajika

Maybe I have missed your point, but based on how I've understood what you've described I think you may have also missed mine, I was more pointing out how the practicalities prevent such a tool from being possible from a few perspectives. I lead with security just because that would be the deal breaker for many service owners, it's simply infosec best practice to not leak the information such a tool would require.

Your filtering idea would require cooperation from those service owners to change what they're currently doing, right?

Perhaps I've completely got the wrong end of the stick with what you're suggesting though, happy to be corrected

in reply to 9point6

Thanks for your answer.

First I don't even grasp what a "service owner" is.

Second, for JS front-end openness there are already a bunch of app (web, android) that are open-source and secured. Everything has dependencies nowadays, this doesn't prevent good security. Think all the python app and their dependencies, rust, android... even c\c++ packages are built with dependencies and security updates are necessary (bash had security issues).

I think with JS scripts it's actually even easier to have good security because the app is ran in our web browser so the only possible attacker is the website we are visiting itself. If they are malicious then the close-sourced JS script is even worse. Unless you count 3rd party scripts embedded that bad dev uses in their website without even thinking about trusting them. That is also awful in both open or close source environment.

So even having imperfect security (which happens regardless to openness), who is the attacker here? I would rather run js script on my end if the code can be checked.

in reply to Kajika

in reply to 9point6

OK I got it, you are completely out of the loop here.

You do not grasp the idea of NoScript and other JS filtering extension. This is not about server code, your all arguments is baseless here.

By the way JS refered to Javascript and not NodeJS.

Anyway I got you whole company/business talk about "keeping the service available, secure, performant" and "GDPR [...] bankrupting fine"... yeah lemmy.world.

in reply to Kajika

This entry was edited (1 year ago)
in reply to Kajika

I'm a full-stack software developer working in the financial sector, their statement is factual.

Companies will never want to take on liability that has the potential to bankrupt them. It is in their best interest to not reveal the version of libraries they are using as some versions may have publicly known vulnerabilities, and it would make it incredibly easy for attackers to build an exploit chain if they knew the exact versions being used.

Securing client code is just as important as securing server code, as you don't want to expose your users to potential XSS attacks that could affect the way the page gets displayed, or worse, leak their credentials to a third party. If this happened in the EU or some parts of Canada, and it's been found that the company reduced their threat model "for the sake of openness", they would likely be fined into bankruptcy or forced to leave the market.

Unfortunately, this is one of those cases where your interests and ethics will never be aligned with those of service owners as they are held to a certain standard by privacy laws and other regulations.

in reply to Kajika

Can't say that what you are looking for is common. This is the first time I've heard this requirement bring described.

Librejs started a long while back. I'm no js historian but I reckon things have changed a ton in jsland since then. My guess is that there assumption is that since JavaScript files are just scripts, they contain the source code and therefore all it checks for is is the license.

I don't know at which point things like obfuscation through minification and systems like webpack came along. I'm only theorising but I feel librejs has not been able to keep up with the times.



Som en konsekvens av Elon Musks övertagande av Twitter urartade plattformen. Moderering avskaffades i praktiken och högerextremism, rasism och antifeminism med mer abredde ut sig.

blog.zaramis.se/2024/08/22/elo…

This entry was edited (1 year ago)
in reply to Det Glada Tjugotalet

Att modereringen upphört innebär i detta sammanhang att hatbudskap från högern med fler inte längre modereras bort. Det var i sammanhanget inte viktigt att gå närmare in på det. Utan det viktiga här var effekterna av Elon Musks övertagande.
in reply to Anders_S

X eller Twitter missgynnade dessutom vänstern långt innan Musk tog över. Så det är inget nytt. Även Facebook, Instagram och Threads missgynnar vänstern så just den detaljen är inte en unikt för X. Till och med Googlesökningar missgynnar vänstern (framförallt pro-palestinsk vänster).


Resume work from backup on another device?


reshared this

in reply to utopiah

Thank you for the detailed response!
Yes, the what data and how to not create conflicts has been troubling me the most.

I think I might first narrow it down with test VMs first, to skip the transfer part, before I actually use it “in production“.

in reply to unskilled5117

Honestly a very imperfect alternatives but that's been sufficient for me for years is... NextCloud of documents.

There are few dozen documents I need regardless of the device, e.g national ID, billing template, but the vast VAST majority of my files I can get on my desktop... which is why I replied to you in depth rather than actually doing it. I even wrote some software for a "broader" view on resuming across devices including offline, namely git.benetou.fr/utopiah/offline… as a network of NodeJS HTTP servers but ... same, that's more for the intellectual curiosity than a pragmatic need. So yes explore with VMs if you prefer but I'd argue remain pragmatic, i.e what you genuinely do need versus an "idealized" system that you don't actually use yet makes your workflow and setup more complex and less secure.



Nya Mediafonden har som syfte att hjälpa nya progressiva medier att växa. De hjälper många olika projekt varje år med en mindre summa pengar. Min blogg har i år fått 1 000 kronor från Nya Mediafonden och det tackar vi för.

blog.zaramis.se/2024/08/22/ett…




in reply to nous

I know, hence why i said youre not wrong but the example was wrong :p
Also, its more complex than that. Some teams can, some cant. And if they can it all depends on what project or context. The business world isnt that cut and dry hehe




Linux Market Share Reaches New Peak: July 2024 Report


The Linux operating system has reached a notable milestone in desktop market share, according to the latest data from StatCounter. As of July 2024, Linux has achieved a 4.45% market share for desktop operating systems worldwide.

While this percentage might seem small to those unfamiliar with the operating system landscape, it represents a significant milestone for Linux and its dedicated community. What makes this achievement even more thrilling is the upward trajectory of Linux's adoption rate.


...

According to the statistics from the past ten years, It took eight years for Linux to go from a 1% to 2% market share (April 2021), 2.2 years to climb from 2% to 3% (June 2023), and a mere 0.7 years to reach 4% from 3% (February 2024). This exponential growth pattern suggests that 2024 might be the year Linux reaches a 5% market share.

reshared this

in reply to pnutzh4x0r

It is finally upon us.

THE YEAR OF THE LINUX DESKTOP!

Terms and conditions apply. It could be the next year, or the year after, or not at all.

in reply to pnutzh4x0r

Did anybody bother to look at the numbers?

I checked the stats for the last 4 years here and it looks really strange.
Statistics isn't my thing... But it looks like it's wise to be cautious and not to fully trust the numbers.

Around the beginning of last year there was a huge dip in the Windows market share that seemed to be correlating with a peek in "unknown".
Windows then catched up in a somewhat erratic way.

Mac OS also shows a weird behavior.
Starts at 16%, up to 21% and the down to 14% between October and November...

It's not likely that a huge number of people decided to buy a Mac and then trash it one month later. Same but opposite goes for the windows stats.

I think it looks like there is an uncertainty of more than the total market share Linux is shown to have..

Not saying that Linux isn't increasing on desktop market share.
Just saying that numbers seen to have quite a bit error margin and to be cautious if referring to these numbers.




Skärpt straff för 17-åring. Svea hovrätt har skärpt straffet för en tonåring som dömts för mord och mordförsök. Fängelsestraffet blev dubbelt så långt som i tingsrätten.

blog.zaramis.se/2024/08/21/ska…



reshared this



Lingbank A/S är ett pelagiskt fiskeriföretag i Hanstholm. Ägare av företaget är Benny Rasmussen (60%) och hans två söner Jens Schneider Rasmussen och Jonas Sauer Rasmussen som äger 20% var.

fiske.zaramis.se/2024/08/21/et…

This entry was edited (1 year ago)


Samma år som Mastodon lanserades skapade också den högerextrema sajten Gab som en reaktion mot modereringen på stora sociala medier som Facebook och Twitter. Sajten växte snabbt och 2019 gick de över till att använda en klon av Mastodon.

blog.zaramis.se/2024/08/21/gab…

This entry was edited (1 year ago)


“Something has gone seriously wrong,” dual-boot systems warn after Microsoft update




The Best way to switch to Linux is to NOT


in reply to acceptable_humor

Another option if you have a laptop and desktop is to test the waters slowly with the laptop, and keep your desktop as is. It's what I did for a long while to get used to things on Linux.

If there is a critical problem with my Linux instalation on my laptop, it's OK because all the real stuff I care about is still on the desktop. So I'm free to wipe the laptop at a moments notice. It's the easiest way to learn in my experience.

This entry was edited (1 year ago)
in reply to acceptable_humor

You know there is almost more stuff advising how to switch to Linux than there is stuff for existing users or people with their feet in both worlds. There are plenty of people who used Linux but only for server, or as a dual boot, or on one machine but not another. I think they would benefit from advice on how to fully switch over or how to use both systems to full effectiveness together. Like I only fully switched to Linux maybe 6 months ago after going back and forth for years.

We also need to be thinking about how to get people from beginner level to intermediate, and then on to advanced levels. There isn't a clear progression path forward. It could be something like: Linux Mint -> Arch -> Nix. I believe projects like Arco Linux are striving to fulfill this gap from beginner to advanced.



Sober is a new way to play Roblox on Linux from the Vinegar team


in reply to Noo

No one said we need to play roblox on linux. We WANT to play roblox on Linux because its our computer and we want the freedom to play what we choose and not be arbitrarily limited by an asshole game studio.
in reply to Fizz

This entry was edited (1 year ago)


Ladybird Browser Team Selects Swift as Preferred Language


I would have preferred Rust, a language created by Mozilla instead of one with ties to Apple, but I'm not a dev so I can't really judge. What are your thoughts?
This entry was edited (1 year ago)
in reply to warmaster

I not entirely sure but from what I can remember Andreas Kling is seen using Mac-os in a Ladybird update video so it could be possible that it is his main operating system. Take this with a grain of salt.

in reply to mortimer

Thanks for this service, but whats the point if the server's cant handle their task?


Bluetooth Audio Issues when launching a game?


Hi there, I just acquired myself the Sennheiser Momentum 4, mainly for using while communting + work. But figured i'd try them out for some gaming too. They work just fine when watching YT or any video, but when I launch a game the audio quality changes significantly. I have no idea how or why its doing it, nor how to fix it. I've tried all of these different audio profile options, but all of them make the audio either distorted, weak, or make it sound like the audio is trapped inside a room... Anyone know how to go about this? Audio works fine with my normal non-wireless headset.

My system is running Bazzite.

Appreciate any pointers to how to resolve this.

reshared this

in reply to Sips'

Confirmed, changing the microphone input fixes the audio issues :)


GIMP 3.0 Enters String Freeze, Inching Closer To Release


GIMP 3.0 has been more than one decade in the making as the port from GTK2 to GTK3, also transitioning away from Python 2 to Python 3 support, and a wealth of other improvements from the UI to lower down into enhancing this open-source Photoshop alternative.

The GIMP project announced on X/Twitter today that they have entered the string freeze for this much anticipated release.

reshared this

in reply to user68k

I just flipped through the introduction of a GIMP book that the authors hoped 3.0 would be out so they could cover it but ultimately based the book on 2.6 due to delays. It's copyright 2012, apparently something (didn't) happen.