coffeeClean

joined 2 years ago
MODERATOR OF
[–] coffeeClean -1 points 1 year ago* (last edited 1 year ago) (1 children)

Why are you even in the library to begin with if you’re so opposed to how they manage their network?

How does one know how they manage their network before entering the library? The libraries that have ethernet /never/ advertise it. Only wi-fi is ever advertised. I have never seen a library elaborate on their wifi preconditions (which periodically change). This info is also not in OSMand, so if you are on the move and look for the closest library on the map, the map won’t be much help apart from a possible boolean for wifi. Some libraries have a captive portal and some do not. Among those with captive portals, some require a mobile phone with SMS verification and some do not. But for all of them, the brochure only shows the wifi symbol. You might say “call and ask”, but there are two problems with that: you need a phone with credit loaded. But even if you have that, it’s useful to know whether ethernet is available and the receptionist is unlikely to reliably have that info. Much easier to walk in and see the situation. Then when you ask what will be blocked after you get connected, that’s another futile effort that wastes time on the phone. It really is easier and faster to pop in and scope out the situation. Your device will give more reliable answers than the staff. But I have to wonder, what is your objection to entering a library to reliably discover how it’s managed in person?

[–] coffeeClean -1 points 1 year ago* (last edited 1 year ago) (3 children)

Stop lying.

I said “wait five or ten minutes”. I’m seeing a 9m1s span. I don’t really feel compelled to be more accommodating than that. Maybe you can write to Jerry and ask to configure it so edits are blocked after 1 minute if it really bothers you. Otherwise if you don’t like the policy of the node, you are free to leave.

[–] coffeeClean -2 points 1 year ago* (last edited 1 year ago) (5 children)

My client says it was created at 21:24:02 GMT and modified at 21:25:12. Instead of using a stopwatch which you somehow screwed up, just mouse over the time. The popup will show you a span of 1 minute and 10 seconds.

(edit) ~~strange; after I refresh the screen the /create/ timestamp changed. Surely that’s a bug in Lemmy. The creation timestamp should never change.~~ nvm.. just realized I was looking at the wrong msg.

[–] coffeeClean -2 points 1 year ago* (last edited 1 year ago) (7 children)

Calm down. It’s a new comment that just came in so of course I’m going to edit it a few times in the span of the first minute or two as I compose my answer. If you wait five or ten minutes you’ll get a more finished answer.

[–] coffeeClean -1 points 1 year ago* (last edited 1 year ago) (12 children)

The proof is in the money trail. If the library’s funding traces to a tax-funded government, it is a public service that encompasses all services offered by that institution. It’s also in state or national law that legislates for libraries to exist, which differs from one state to another.

If you want to find a clause that says “only people with wifi hardware may access the internet, and only if they have a mobile phone”, I suspect you’ll have a hard time finding that. At best, I could imagine you might find a sloppily written law that says “libraries shall offer wifi” without specifying the exclusion of others. But if you could hypothetically find that, it would merely be an indication of a national or state law that contradicts that country’s signature on the UDHR. So it’s really a pointless exercise.

[–] coffeeClean 0 points 1 year ago* (last edited 1 year ago)

Yeah I’ve done the same in one case. Librarian green lit me plugging into the rj45 but it turned out to be a dead port. I might have been able to get permission to hijack an occupied port to an unoccupied machine but just opted to bounce instead.

[–] coffeeClean -3 points 1 year ago* (last edited 1 year ago)

The wifi is for public use. The Ethernet isn’t. How is that so hard to understand?

How is it hard to understand that those two undisputed facts are actually a crucial part of my thesis? Of course I understand it because it’s the cause for the problems I described and my premise. It’s why this thread exists.

If that weren’t the case, the only notable problem would be with the mobile phone precondition on captive portals.

[–] coffeeClean -2 points 1 year ago* (last edited 1 year ago)

Time to wake up to reality. Everyone has access, the method of access isn’t discriminating, nor do you have any say in it.

That’s not reality. The reality is everyone has partial access (Firefox on a shared Windows PC only), while some people have full access via both public resources.

If you want to gain anything from this conversation, try to at least come to terms with the idea that Firefox is not the internet. The internet is so much more than that. Your experience and information is being limited by your perception that everything that happens in a browser encompasses the internet.

In other words, it’s public, free for all, and the way they set it up.

It’s not free. We paid tax to finance this. The moment you call it free you accept maladministration that you actually paid for.

If you don’t like the free service, don’t use it. It not being how you like it isn’t wrong in any way, that’s your problem.

You’re confusing the private sector with the public sector. In the private sector, indeed you simply don’t use the service and that’s a fair enough remedy. Financing public service is not optional. You still seem to not grasp how human rights works, who it protects, despite the simplicity of the language of Article 21.

[–] coffeeClean -5 points 1 year ago* (last edited 1 year ago) (1 children)

Could I be in the wrong? No, it must be literally everyone else in this entire thread / national library network.

Is your position so weak that you need to resort to a bandwagon fallacy?

Grow up.

and an ad hominem?

You demonstrate being a grown up by avoiding ad hominems in favor of logically sound reasoning.

[–] coffeeClean 1 points 1 year ago

Thanks for the tip. It slightly helped in a recent situation where I could not reach a captive portal, and it seems DNS was blocked (perhaps to prevent DNS tunneling). So http://neverssl.com was unreachable. But the gateway IP sent a redirection to their captive portal, which still did not work because of the DNS resolution problem. It’s a good tip nonetheless though. It at least was a way to discover the URL of the captive portal.

[–] coffeeClean -1 points 1 year ago* (last edited 1 year ago)

Their terms require a phone so yes, on their terms.

I keep a copy of everything I sign. The ToS I signed on one library do not require a mobile phone. It’s an ad hoc implementation that was certainly not thought out to the extent of mirroring the demand for a mobile phone number into the agreement. And since it’s not in the agreement, this unwritten policy likely evaded the lawyer’s eyes (who likely drafted or reviewed the ToS).

Why would they make an exception for anyone?

Because their charter is not: “to provide internet service exclusively for residents who have mobile phones”.

And why would they want to deal with paper agreements for WiFi?

Paper agreements:

  • do not discriminate (you cannot be a party to a captive portal agreement that you cannot reach)
  • are more likely to actually be read (almost no one reads a tickbox agreement)
  • inherently (or at least easily) give the non-drafting party a copy of the agreement for their records. A large volume of text on a tiny screen is unlikely to even be opened and even less likely to save it. Not having a personal copy reduces the chance of adherence to the terms.
  • provide a higher standard of evidence whenever the agreement is litigated over

You don’t have to be a member to use WiFi, someone else could have given you the password if there even is one

That’s not how it works. The captive portal demands a phone number. After supplying it, an SMS verification code is sent. It’s bizarre that you would suggest asking a stranger in a library for their login info. In the case at hand, someone would have to share their mobile number, and then worry that something naughty would be done under their phone number, and possibly also put that other person at risk for helping someone circumvent the authentication (which also could be easily detected when the same phone number is used for two parallel sessions).

If someone is doing something illegal it’s gonna involve the library if you get caught (that’s why the phone number but maybe they are just being shitty with it). Not worth the risk.

Exactly what makes it awkward to ask someone else to use their phone.

[–] coffeeClean -2 points 1 year ago* (last edited 1 year ago) (1 children)

You have, throughout your comments, repeatedly spoken down toward librarians and libraries.

Again, you’re not quoting. You’ve already been told it’s not the case. You need to quote. You replied to the wrong message.

but you’re certainly not painting them as “trying their best”

There are many librarians with varying degrees of motivation. I spoke to one yesterday that genuinely made an effort to the best of their ability. I cannot say the same for all librarians. When I describe a problem of being unable to connect, some librarians cannot be bothered to reach out to tech support, or even so much as report upstream that someone was unable to connect.

“worth having an adult conversation with instead of misrepresenting my situation intentionally”

This is a matter of being able to read people. I don’t just bluntly blurt out a request. I start the conversation with baby steps (borderline small talk) describing the issue to assess from their words, mood, and body language the degree to which they are likely to be accommodating whatever request I am building up to. Different people get a different conversation depending on the vibe I get from them. Even the day of week is a factor. People tend to be in their best mood on Fridays and far from that on Mondays.

 

cross-posted from: https://infosec.pub/post/10276158

There are apparently only two documented ways to reverse tether an Android via USB to a linux host:

OpenVPN dead
I really wanted the #openVPN method to work because I’m a fan of reducing special-purpose installations and using Swiss army knives of sorts. In principle we might expect openVPN to be well maintained well into the future. But openVPN turns out to be a shit show in this niche context. Features have been dropped from the Android version.

Gnirehtet dying
Gnirehtet works but it’s falling out of maintenance. ~~It’s also unclear if~~ #Gnirehtet really works without root. There is mixed info:

  • Ade Malsasa Akbar from Ubuntubuzz claims root is not needed (and devs agree).
  • OSradar claims root is needed. (edit: they are mistaken)

If anyone has managed to reverse tether an unrooted Android over USB to a linux host using free software, please chime in. Thanks!

update on Gnirehtet


Gnirehtet indeed works without root. But some apps (like VOIP apps) fail to detect an internet connection and refuse to communicate.

#askFedi

 

cross-posted from: https://infosec.pub/post/10276158

There are apparently only two documented ways to reverse tether an Android via USB to a linux host:

OpenVPN dead
I really wanted the #openVPN method to work because I’m a fan of reducing special-purpose installations and using Swiss army knives of sorts. In principle we might expect openVPN to be well maintained well into the future. But openVPN turns out to be a shit show in this niche context. Features have been dropped from the Android version.

Gnirehtet dying
Gnirehtet works but it’s falling out of maintenance. ~~It’s also unclear if~~ #Gnirehtet really works without root. There is mixed info:

  • Ade Malsasa Akbar from Ubuntubuzz claims root is not needed (and devs agree).
  • OSradar claims root is needed. (edit: they are mistaken)

If anyone has managed to reverse tether an unrooted Android over USB to a linux host using free software, please chime in. Thanks!

update on Gnirehtet


Gnirehtet indeed works without root. But some apps (like VOIP apps) fail to detect an internet connection and refuse to communicate.

#askFedi

 

cross-posted from: https://infosec.pub/post/10276158

There are apparently only two documented ways to reverse tether an Android via USB to a linux host:

OpenVPN dead
I really wanted the #openVPN method to work because I’m a fan of reducing special-purpose installations and using Swiss army knives of sorts. In principle we might expect openVPN to be well maintained well into the future. But openVPN turns out to be a shit show in this niche context. Features have been dropped from the Android version.

Gnirehtet dying
Gnirehtet works but it’s falling out of maintenance. ~~It’s also unclear if~~ #Gnirehtet really works without root. There is mixed info:

  • Ade Malsasa Akbar from Ubuntubuzz claims root is not needed (and devs agree).
  • OSradar claims root is needed. (edit: they are mistaken)

If anyone has managed to reverse tether an unrooted Android over USB to a linux host using free software, please chime in. Thanks!

update on Gnirehtet


Gnirehtet indeed works without root. But some apps (like VOIP apps) fail to detect an internet connection and refuse to communicate.

#askFedi

 

cross-posted from: https://infosec.pub/post/10262373

Question for people willing to visit Cloudflare sites:

How do you determine whether to trust a login page on a CF site? A sloppy or naïve admin would simply take the basic steps to putting their site on Cloudflare, in which case the authentication traffic traverses CF. Diligent admins setup a separate non-CF host for authentication.

Doing a view-source on the login page and inspecting the code seems like a lot of effort. The source for the lemmy.world login page is not humanly readable. It looks as if they obfuscated the URLs to make them less readable. Is there a reasonably convenient way to check where the creds go? Do you supply bogus login info and then check the httpput headers?

 

There are apparently only two documented ways to reverse tether an Android via USB to a linux host:

OpenVPN dead
I really wanted the #openVPN method to work because I’m a fan of reducing special-purpose installations and using Swiss army knives of sorts. In principle we might expect openVPN to be well maintained well into the future. But openVPN turns out to be a shit show in this niche context. Features have been dropped from the Android version.

Gnirehtet dying
Gnirehtet works but it’s falling out of maintenance. ~~It’s also unclear if~~ #Gnirehtet really works without root. There is mixed info:

  • Ade Malsasa Akbar from Ubuntubuzz claims root is not needed (and devs agree).
  • OSradar claims root is needed. (edit: they are mistaken)

If anyone has managed to reverse tether an unrooted Android over USB to a linux host using free software, please chime in. Thanks!

update on Gnirehtet


Gnirehtet indeed works without root. But some apps (like VOIP apps) fail to detect an internet connection and refuse to communicate.

#askFedi

11
submitted 1 year ago* (last edited 1 year ago) by coffeeClean to c/cybersecurity
 

Question for people willing to visit Cloudflare sites:

How do you determine whether to trust a login page on a CF site? A sloppy or naïve admin would simply take the basic steps to putting their site on Cloudflare, in which case the authentication traffic traverses CF. Diligent admins setup a separate non-CF host for authentication.

Doing a view-source on the login page and inspecting the code seems like a lot of effort. The source for the lemmy.world login page is not humanly readable. It looks as if they obfuscated the URLs to make them less readable. Is there a reasonably convenient way to check where the creds go? Do you supply bogus login info and then check the httpput headers?

19
submitted 1 year ago* (last edited 1 year ago) by coffeeClean to c/cybersecurity
 

An HTML-only email from a gov agency has a logo referencing an URL that looks like this:

https://1wy1y.mjt.lu/tplimg/1wy1y/f/l9hl7/g3q3v.png

It’s not exactly that (apart from the domain) but of course it’s rather unique looking. They send email routinely. The initial emails had an obviously non-suspicious basic logo, like “(their office domain)/files/logo.png”. But then later they switched and every message from them is the URL in the mjt.lu domain. It’s not unique per message but it could be unique to the user, perhaps to keep tabs on when each person reads their messages.

The output of torsocks curl -LI looks like this:

HTTP/2 200
date: (exactly now)
content-type: image/png
accept-ranges: bytes

That’s it. It’s the shortest HTTP header I’ve seen. There’s no content-length. I find that suspicious because if this is a service that facilitates tracker pixels, then they would want to withhold the length in order to dodge detection. Although from its usage in my case it wouldn’t just be a pixel -- it’s a logo.

The date is also suspect. Shouldn’t the date be the date of the object, not the current time this second?

Are there any other checks to investigate this?

 

The technical mechanism:

https://play.google.com/store/apps/details?id=com.google.android.apps.devicelock

update


To be clear, I am not the OP who experienced this problem. I just linked them from here.

13
submitted 1 year ago* (last edited 1 year ago) by coffeeClean to c/bugs@sopuli.xyz
 

There used to be no problem archiving a Mastodon thread in the #internetArchive #waybackMachine. Now on recent threads it just shows a blank page:

https://web.archive.org/web/20240318210031/https://mastodon.social/@lrvick/112079059323905912

Or is it my browser? Does that page have content for others?

 

Wordpress seems to be dominant blog software. I’m baffled that it seems I’m forced to use a web app gui. If I want to work locally in emacs, it seems I have to copy-paste the whole text of a page every time I make a change. Is that correct or am I missing something?

#wordpress #askfedi

 

I received several machine-generate e-mails which are all mostly the same: a notification. They are HTML emails with no plaintext MIME part. Yikes! And to complicate matters further, the messages traversed my anonaddy forwarding account which PGP encrypts every message to me before forwarding it to my normal email account.

The gov wants me to give them an “unaltered copy” of these e-mails. This gov office actually blocks my mail server so I am generally unwilling to send them email. This means I will be giving them the emails on paper hardcopy.

So wtf, this is tricky. They want an “unaltered copy”. If I were to print the MBOX files, it would be useless to them because it’s a base64 blob that only I can decrypt. My mail client is mutt so the HTML is detected and piped through w3m to give me a text version that is readable enough.

But in general, how do you give unaltered copies of an HTML email on paper form? This is not necessarily for a court but it could go down that path. Would a court want to see raw HTML tags? Or do courts prefer the HTML to be rendered for readability?

Normally I copy the w3m-rendered text of email into LaTeX and typeset it to look pretty and copy-paste the useful headers into a well-styled header in a monospaced font. And I omit the useless headers. But I get the impression my way of working would not pass for “unaltered”.

I could perhaps try to feed the HTML into wkhtmltopdf. In the end, HTML rendering always varies depending on the rendering tool. Normies use MS Outlook, and I have to figure that the gov is normally dealing with normies. So maybe I should install Evolution or Thunderbird. Any suggestions for a tool that is particularly good at making HTML email presentable on paper without looking too custom?

#askFedi

view more: ‹ prev next ›