Nostr notes by Alyx

Your employer is not worth your mental health.

2026-08-07T11:22:00Z

In reply to nevent1q…sr8x
_________________________

Your employer is not worth your mental health.

> In a past life I had to argue every year to renew a license ...

2026-08-04T21:02:45Z

In reply to nevent1q…7wsn
_________________________

> In a past life I had to argue every year to renew a license for a profiling tool that cost about 20 EUR a month. I’ve heard since that everyone at the company is now getting a Claude subscription, even non-programmers. This is the kind of decision that baffles me. Management will not trust its engineers to spend their money on the tools they say they need, but then will tell everyone they have to use a shiny expensive toy they didn’t request.

The author reads my mind. I am scared ;)

RE: https://mastodon.social/@MatRopert/117039060061200542 > AI ...

2026-08-04T20:44:49Z

RE: https://mastodon.social/@MatRopert/117039060061200542

> AI adoption seems to have been mandated in many places from the top layer of management, regardless of how many of them ever worked (or studied for) an engineering job.
>
> I do admit that this approach immediately triggered my contrarian side and made me very defiant of any AI tool. I don’t believe someone who has never written a line of code in their life should be telling me what to use for my engineering job. This sounds to me like the most terminal case of micro-management, and that’s never a good thing (on top of being personally insulting).

This. So much of this.

quoting
note176l…5gc0

Hey do you guys wanna hear my nuanced thoughts about AI? Because the mods on HackerNews sure didn't.
https://mropert.github.io/2026/08/04/an_honest_review_of_ai_programming/

I wrote about that kind of stuff in French a few weeks ago: ...

2026-07-16T17:00:55Z

In reply to nevent1q…44u4
_________________________

I wrote about that kind of stuff in French a few weeks ago: https://broken-by-design.fr/posts/mots-de-passe/

C'est le bordel de ce côté là pour moi aussi :D J'ai ...

2026-06-19T15:38:43Z

In reply to nevent1q…mpgq
_________________________

C'est le bordel de ce côté là pour moi aussi :D
J'ai des tabs ; j'ai des interpréteurs shell directement dans Neovim... et j'utilise assez peu les autres compositions. Je sais que certain·es utilisent tmux pour ça, mais j'ai déjà eu un tmux qui a craché avec toutes mes sessions dedans....
Un temps, j'avais utilisé terminator, mais pareil : un crash m'a fait perdre toutes mes sessions et ça m'a saoulé... donc j'en suis revenu à quelques tabs et de la discipline personnelle.

Hello, Je dirais qu'il n'y a besoin de rien de plus. ...

2026-06-19T14:36:34Z

In reply to nevent1q…wjlw
_________________________

Hello,
Je dirais qu'il n'y a besoin de rien de plus. Perso, j'utilise Konsole ou Terminal suivant le PC sur lequel je suis et ça suffit amplement pour tout ce que j'ai à faire. Je suis system engineer/platform engineer et software engineer.
Tu peux éventuellement installer une NerdFont pour pouvoir utiliser NeoVIM avec nvchad ou autre.
Pour le reste, mouis, tmux peut être utile pour du peer programming en SSH, mais c'est pas indispensable.
Peut-être toolbx pour avoir des env de dev dans plusieurs distro ?

Sinon, je sèche ^_^

vindarel (npub1gdd…3eqj) David Revoy (npub16ys…sjae)

> Multiple instances of Signal can be used on the same device ...

2026-04-06T17:05:00Z

In reply to nevent1q…qwzh
_________________________

> Multiple instances of Signal can be used on the same device at a time.

Using GrapheneOS profiles sure but I don't know how people using other OSes can. Maybe I am missing something?

> There are non-KYC services for phone numbers available.

Services with no KYC may exist in some countries. Even if there is no KYC, you still need to pay in cash or other kind of untraceable currencies, and get the SIM card without being filmed. That can be done, but to be honest, it is just easier to rely on a service not relying on a phone number 🤷

Olvid and SimpleX do not need a phone number to be protected against spam.

> No, Signal is available outside the Play Store in multiple ways.

I know about APK installation and I mentioned it. I don't know about other installation mechanism.
On signal.org/download, the only advertised installation options for phones are the official app stores.

Olvid offers better privacy than Signal because: * it supports ...

2026-04-06T16:54:17Z

In reply to nevent1q…04ep
_________________________

Olvid offers better privacy than Signal because:

* it supports multiple identities, none tied to a real world identity or PII. Signal supports only one identity tied to a phone number;
* it can be installed from F-droid without Google services ; Signal can only be installed from the Google Play Store on Android. Both supports APK, though.
* servers can be decentralized/federated/self-hosted. Signal is centralized and hosted.
* server (message relay) is actually open source. Signal server source code is incomplete, often outdated.
* Servers do not rely on numerous service providers; only the one for the message relay; you can select your own TURN server for calls. Signal on the other hand depends on AWS, Cloudfront and Cloudflare for messaging/attachments.

This was in the previously linked video. Here are the slides if you don't want to listen to it:
https://cfp.pass-the-salt.org/media/pts2025/submissions/7K9MEV/resources/PTS2025-TALK-25-metadata_prot_in_instant_msg_apps_LsHI6ZN.pdf

Signal lies about their security level in two ways:
* inducing a false sense of security by pretending they collect any metadata except the time of account creating and last message retrieval: their infrastructure depends on many subcontractors, none of which make any privacy claims about not collecting data;
* they can silently and selectively disable sealed senders;
* they have a history of ignoring security reports sent to them, sometimes for months or years;
* they obviously can have so much more data than what they pretend, like all metadata regarding group size and management, prekeys requests/refresh, last connection IP address, connection frequency, etc. We have to trust them for not collecting them. That's not security. That's blind trust.

SimpleX Chat (npub1gsu…fy6l)

To be fair, Signal lies about their actual security, particularly ...

2026-04-06T06:55:20Z

In reply to nevent1q…paaq
_________________________

To be fair, Signal lies about their actual security, particularly regarding metadata protection.

https://passthesalt.ubicast.tv/videos/metadata-protection-in-instant-messaging-applications-a-review/#share

Olvid, a French IM, arguably offers better privacy than Signal, by design. But they are French, so I don't trust them either for the reasons you listed in this thread.

SimpleX Chat (npub1gsu…fy6l) is way ahead of Signal and Olvid, privacy/security-wise.

git over email is so underrated... And yet, it is federated by ...

2026-03-27T17:23:26Z

In reply to nevent1q…j9n2
_________________________

git over email is so underrated...
And yet, it is federated by design, and sometimes even more efficient than some forges...
jon r (npub1krk…4qg9) Michał "rysiek" Woźniak · 🇺🇦 (npub1afm…5gp4)

Or a vegan at a meat-eaters table, where everybody tells how good ...

2026-03-13T07:46:15Z

In reply to nevent1q…hfnr
_________________________

Or a vegan at a meat-eaters table, where everybody tells how good their meat is and that you should try it.

I am vegan, against AI and I don't smoke. I chose to suffer 😂

No link in particular. I have experienced it first hand. Shot ...

2026-02-18T16:35:49Z

In reply to nevent1q…et7p
_________________________

No link in particular. I have experienced it first hand. Shot them a report with what I was to present at a conference regarding some IM issues. Signal was the only one to not respond. I saw several testimonies on the fediverse with similar stories.
Signal left group v1 running for months after a public disclosure on the lack of renewal of group keys when someone leaves the group, allowing them to come back in uninvited. They never fixed group v1 and published much later group v2 as a replacement.
They ignored or dismissed reports about the server being able to disable silently and on demand sealed senders.
I suppose I could dig up some more stories, but of the top of my head, that's what I've got.

Signal just ignores security reports. Matrix could copy that ...

2026-02-18T16:27:14Z

In reply to nevent1q…cf2s
_________________________

Signal just ignores security reports. Matrix could copy that strategy and get away with it 😅
Daniel Gultsch (npub18ds…6490)

Ironically, the Avian Intelligence striked back with the ...

2026-01-29T19:39:41Z

In reply to nevent1q…z5yt
_________________________

Ironically, the Avian Intelligence striked back with the increased cost of RAM!

Excellent analysis. Very thorough 😍

2026-01-10T13:41:57Z

In reply to nevent1q…sfxt
_________________________

Excellent analysis. Very thorough 😍

Using random words in Bitwarden which uses a 7776 words ...

2026-01-10T08:12:26Z

In reply to nevent1q…asxh
_________________________

Using random words in Bitwarden which uses a 7776 words dictionary, you need 8 words to get over 100 bits of entropy. The last 8-words passphrase I created was rougly 60 characters long, for reference.

Yes, I have been using it two weeks ago on a Peugeot e208 from ...

2025-11-11T17:04:38Z

In reply to nevent1q…yq47
_________________________

Yes, I have been using it two weeks ago on a Peugeot e208 from 2021.
It stopped working on my previous car (Renault Twingo from 2019), though, due to a certificate expiry, but I think it was an issue on the car side of things.
GrapheneOS (npub1kwa…e0nj)

Are you positive this is a DNS issue or it is your diagnostic? ...

2025-10-23T16:28:52Z

In reply to nevent1q…9wwy
_________________________

Are you positive this is a DNS issue or it is your diagnostic? Because to me, it sounds like a cert cache issue and not necessarily a DNS issue.

More importantly, people need to stop uploading to Youtube. But ...

2025-09-25T09:27:11Z

In reply to nevent1q…eupu
_________________________

More importantly, people need to stop uploading to Youtube. But yeah, kudos to the efforts from yt-dlp, Freetube, Newpipe and all the others for trying to keep Youtube usable until people finally get it.

Thank you 😍 I'll look into these two! They were not ...

2025-08-20T17:04:31Z

In reply to nevent1q…2apd
_________________________

Thank you 😍 I'll look into these two! They were not mentioned on the websites comparing frameworks.

Trying to pick a CSS framework to learn. Bootstrap comes from ...

2025-08-20T15:59:44Z

Trying to pick a CSS framework to learn.

Bootstrap comes from Twitter, so no thank you by principle.

Tailwind CSS seems completely dumb since it defeats the whole point of using a class system to design reusable components. The magic detection of class names in the codebase looks scary af.

W3.CSS does not seem to be used by anyone.

PureCSS and Spectre.CSS seems to be abandonware.

I mean, the fuck I am supposed to pick?

#CSS

Trop de bruit avec Signal : les métadonnées en cause dans les ...

2025-07-16T13:25:39Z

Trop de bruit avec Signal : les métadonnées en cause dans les messageries chiffrées

https://blogs.mediapart.fr/xcli/blog/160725/trop-de-bruit-avec-signal-les-metadonnees-en-cause-dans-les-messageries-chiffrees

#Signal est régulièrement désigné comme LA meilleure application de messagerie sécurisée. Pour autant, cette supériorité universelle et présentée sans nuance relève d'un manque de finesse de l'analyse. Pire, elle met en danger les journalistes et leurs sources, les activistes et certaines minorités. Nous voyons pourquoi dans cet article.

#infosec #cybersecurite #simplex #matrix #olvid

No worries :) No new vulnerabilities will be presented: most ...

2025-05-06T15:27:11Z

In reply to nevent1q…2q2m
_________________________

No worries :) No new vulnerabilities will be presented: most things were previously discussed or are publicly documented. The idea of this talk is to compare the different approaches and trade-off of the reviewed protocols to give the audience a feeling about how well their metadata is protected, and to give developers ideas about improvements the other messengers already implemented.
But I do want to reach out to ensure what I am gonna say is correct and does not misrepresent the security levels of each network.

I'll be presenting a review of some metadata protections ...

2025-05-06T14:53:06Z

I'll be presenting a review of some metadata protections implemented by instant messengers at Pass the Salt 2025!

The studied messengers are Signal (npub1rkw…5q62) [@olvid_io](https://bird.makeup/users/olvid_io ) The Matrix.org Foundation (npub1m9z…whzq) and SimpleX Chat (npub1gsu…fy6l)

https://cfp.pass-the-salt.org/pts2025/talk/7K9MEV/

I'll be in touch with the vendors to share with them what I'm gonna say about them, to give them the chance to respond to my observations.

#pts25 Pass the SALT Conference (npub1uk4…z2gq)

Le pourquoi est plus facile que le comment. Pour la plupart, ...

2025-01-24T07:37:51Z

In reply to nevent1q…pzue
_________________________

Le pourquoi est plus facile que le comment. Pour la plupart, j'ai jamais commencé ou alors j'ai arrêté depuis longtemps.

Mais Whastapp, c'est pas évident. Je vais pas réussir à faire migrer mon conseil syndical, par exemple. Ni le groupe d'entraide de l'immeuble.

La seule solution que j'ai trouvée, c'est de le compartimentaliser pour que Whatsapp ne puisse presque rien obtenir de moi (à part mon graph social actif). Avec les permissions d'Android, et je vais migrer sur GrapheneOS (npub1kwa…e0nj) pour augmenter encore l'isolation.

Un temps, il y avait des bridges pour Whatsapp, notamment via Element, mais on dirait qu'ils ont arrêté les offres pour particulier qui l'offrait.

Fair enough. Let me patch that up: > There is difference ...

2024-11-21T19:46:47Z

In reply to nevent1q…umu4
_________________________

Fair enough. Let me patch that up:

> There is difference between the fediverse, Mastodon the web server, the mobile clients, and mastodon.social the instance

There is difference between the fediverse, Mastodon the software, ...

2024-11-21T14:13:56Z

In reply to nevent1q…e27x
_________________________

There is difference between the fediverse, Mastodon the software, and mastodon.social the instance. Some can be good. Some others can be bad. But kicking the whole stack because of an instance seems a bad faith argument.

Once installed, the application is still "self-updating" ...

2024-11-18T17:30:21Z

In reply to nevent1q…uzal
_________________________

Once installed, the application is still "self-updating" IIRC. As such, you still have the "RCE" issue.

Hosting it on IPFS allows cryptographic content pinning. It is the best solution I came up hitherto.

How do your apps/servers authenticate to your secret manager ...

2024-11-16T17:32:54Z

How do your apps/servers authenticate to your secret manager (e.g. #Vault) if you use one?

Boosts are apprecieted

#devops #secdevops #devsecops #secret #infosec

Once a phishing page mimicked the login form of my employer and ...

2024-10-28T16:24:18Z

In reply to nevent1q…c8zw
_________________________

Once a phishing page mimicked the login form of my employer and copied so much of our HTML that they included a javascript file under our control.

We modified the javascript so that if the referrer was the phishing page, it would send a special version of the javascript file that would send US the identifier of the client that was phished and sent fake yet believable credentials to the attacker.

We kept it running for days 😅 before the attacker noticed anything. Then, we sent an email to the "compromised" clients to warn them about the phishing attack.

google/magika: "Detect file content types with deep ...

2024-10-28T10:39:45Z

google/magika: "Detect file content types with deep learning"

Fucking hell. Just because we could not create formats with explicit internal types (like PDF, PNG or WEBVTT which start with the strings PDF, PNG or WEBVTT), we are now wasting vast quatities of energy to "predict the type of a file".

OMG, we are so fucking doomed.

(also, throwing yet another AI bullshit into the mix, when libmagic was doing it with static rules; how difficult can it be to just quarantine all files with "data" (i.e. unknown) data type?)

All these web applications handling end-to-end encryption of user ...

2024-10-23T06:51:29Z

All these web applications handling end-to-end encryption of user content (think Proton (npub19kd…t56d), CryptPad (npub1ykg…ch8k), or even Whatsapp web) have a common flaw: the user needs to trust the javascript sent by the web servers of the provider. This situation defeats the purpose of E2EE because the point of doing encryption in the user agent is precisely that the provider does not need to be trusted.

For some reason, signed javascript has never been a thing. No transparency program (like cosign), no key commitment, no nothing. Weird. Sad and weird.

The most frequent solutions to this problem is to not use web pages: publish a mobile app, a desktop client or a web browser extension.

I've been thinking about it for a while now, and the "solution" I came up with is to use IPFS.

IPFS uses content addressing, meaning the address of a file is a hash of the content of the file. Every time you request a specific address, you get the same file. If you store that address in your bookmarks, then you are sure that you are using a specific version of the web content. If that web content is a web application (frontend) and all resources referenced in that web application are either linked using IPFS content addresses or linked via the "traditional web" with SRI hashes, then you have an integrity-verified web application.

Put that IPFS content address in a transparency program, and you have a publicly auditable log of the javascript served by the providers.

So, my request to CryptPad (npub1ykg…ch8k) and Proton (npub19kd…t56d) is: could you please publish your frontend on IPFS?

#javascript #cosign #e2ee #ipfs

Is it a podcast if you have a feed and no website?

2024-10-21T05:44:56Z

In reply to nevent1q…7ld0
_________________________

Is it a podcast if you have a feed and no website?

Weird architecture when staging can impact production. Would you ...

2024-10-20T20:00:03Z

In reply to nevent1q…zwyz
_________________________

Weird architecture when staging can impact production. Would you care to elaborate?

Recently I got failed SSH connections. It was a MTU issue caused ...

2024-08-30T17:31:29Z

In reply to nevent1q…gw36
_________________________

Recently I got failed SSH connections. It was a MTU issue caused by large NTRU signatures 😵