fiona

age: mid twenties
pro™ nouns: she/it
location: SB-129

Last Notes

2025-11-26 00:17:07 UTC

I find it disillusioning to see the casual use of "AI" slowly creeping into our hacker circles. Most of the discussions about AI focus on the quality of its output. I think we're not doing a good job communicating its more fundamental dangers.
In this blog post I write about how tools shape who we are and why the resource intensiveness of AI is ingrained in its purpose. About the devaluation of skills, and power cycles.
Let me know what you think.
https://fokus.cool/2025/11/25/i-dont-care-how-well-your-ai-works.html

2025-07-27 21:20:07 UTC

*leans in*
"what if we kissed under the.."
*looks up*
"smoke detector?"

2025-07-10 12:46:53 UTC

tomorrow I'll talk about federated protocols and the recent pixelfed vulnerability – come join the discussion at @npub1ajs…40ga in berlin
https://social.wake.st/@liaizon/114790849535399825

2025-05-01 00:38:23 UTC

As you all know, the easiest way to set the time on a microwave oven is to plug it in at the right moment.
(Reference: https://chaos.social/@ant/109265527654254544)
Tired of doing this every few weeks to keep up with the drift of the shitty RTC?
Just add NTP to your microwave oven. The home appliance industry does not want you to know this simple trick:
Smart Plug + Home Automation
https://mystical.garden/system/media_attachments/files/114/429/707/584/609/655/original/3e52f125c559dd8b.png
https://mystical.garden/system/media_attachments/files/114/429/708/953/660/979/original/8dacbdaff3f7e7b3.png

2025-03-25 17:33:51 UTC

- reply

Pixelfed before v0.12.5 has a vulnerability where it could leak your private posts, regardless of whether you are a Pixelfed user or not.
Admins should update ASAP.
When following someone from a different server on the Fediverse, the remote server decides whether you are allowed to do that. This enables features like locked accounts. Due to an implementation mistake, Pixelfed ignores this and allows anyone to follow even private accounts on other servers. If a legitimate user from a Pixelfed instance follows you on your locked account, anyone on that Pixelfed instance can read your private posts.
I wrote a blog post about how I found the vulnerability, how disclosure coordination went and general ramblings about Fediverse safety:
https://fokus.cool/2025/03/25/pixelfed-vulnerability.html
#pixelfed #fediverse #activitypub

2025-03-24 16:00:22 UTC

pixelfed instance admins: Please update pixelfed to v0.12.5 asap. The version contains fixes for serious security vulnerabilities that I reported.
I will disclose further details about the vulnerabilities in about 24 hours.
:boost_requested:

2025-03-07 16:23:37 UTC

tiny blinky city
https://mystical.garden/system/media_attachments/files/114/122/065/173/074/584/original/1d3f09c8a4f76e88.mp4

2025-02-10 17:39:28 UTC

https://mystical.garden/system/media_attachments/files/113/980/805/440/899/661/original/27851bca54d56c0f.png

2025-02-10 00:53:11 UTC

https://mystical.garden/system/media_attachments/files/113/976/844/653/133/603/original/2243ff11565cb778.png

2025-01-17 21:44:57 UTC

- reply

We, the users, should question the context and purpose under which the protocols and software we promote are created - and whether that's in our interest or not.
Heck, maybe having a venture capital funded company at the steering wheel of the protocols that were meant to free us from the venture capitalist messengers... wasn't the best approach?
Where to go from here? Honestly, no idea. I have no proposals to make. But I think commentary is important. Maybe we can learn and find better ways to have nice things.

2025-01-17 21:44:49 UTC

- reply

Welp, I didn't expect this post to blow up like that. Maybe I should add some context.
I think this is a messy PR move gone awry. It's not a secret that Synapse doesn't scale well. The interesting part lies in the bigger picture.
First of all: There's nothing *inherently* wrong with a company building a closed source product to interface with open software/standards.
People have opinions on whether that's beneficial for the ecosystem or not. It's not the can of worms I want to open, but I can't avoid it entirely.
Some history. In the end of 2023 Element pulled a very interesting move where they forked Synapse and relicensed the code from Apache 2.0 to AGPLv3 and started requiring a CLA for contributions. See: https://matrix.org/blog/2023/11/06/future-of-synapse-dendrite/
Since Element staff is responsible for most of the maintenance work, the Matrix Foundation had no chance but to discontinue their Apache licensed version.
So, essentially project ownership of Synapse (forcefully) changed from the Matrix Foundation to the Element company.
A bit later Element announced a proprietary version of Synapse where they claimed to have fixed some of the most glaring architectural issues.
Suddenly they have a big commercial incentive to keep Synapse slow. And in this blog post they say that, loud and clear.

2025-01-17 14:47:07 UTC

lol @ element for pulling "our code base is utter trash and we have no intention to fix that, please buy our proprietary rewrite"
https://element.io/blog/scaling-to-millions-of-users-requires-synapse-pro/

2025-01-05 22:40:30 UTC

https://mystical.garden/system/media_attachments/files/113/778/132/339/158/968/original/f44bbc72d226cd3b.png