Ctrl blog

Opera 10 was getting into some wild stuff. 9 was obviously just winning. But I loved how 10 literally gave you the user your own endpoints on the web. The browser is the server (by way of proxy)! Massively inspirational decentralization. https://www.ctrl.blog/entry/opera-unite.html

You must have been extremely lucky because I've had multiple apps just trigger endless SELinux warnings on RHEL8 (Rustdesk is an example) and I very much subscribe to the views in this article: https://www.ctrl.blog/entry/selinux-unmanageable.html I'm not going to waste my time fighting SELinux to stop non-existent threats (I'm just using a desktop and I'm not a high profile target). Too many false positives and I'll just turn it off. And in my experience there are always too many false positives.

This -- just ask Microsoft with their refusal to fix default browser behavior, even in the latest versions of Win11 which are supposedly fixed. I guess having Edge be the default is just too juicy to resist even with that €561 fine. https://www.ctrl.blog/entry/windows-system-components-default-edge.htm… It'd be great if the USA had some kind of effective consumer protection agency, but I guess then we might have fewer billionaires here.

Depending on your interests there are a lot of blogs out there. Beautiful Public Data (https://www.beautifulpublicdata.com/) is one of my best finds. Others I read via RSS include: Wladimir Palant's blog 'Almost Secure' https://palant.info/articles/ Ctrl.blog https://www.ctrl.blog/ Troy Hunt's blog https://www.troyhunt.com/ Molly White's newsletter https://newsletter.mollywhite.net

I've lost the whole day trying to understand the pretty complicated logic on how to have control of my linux (fedora) DNS with the many internet/connections nad wireguard's profile, and once again I went back to https://www.ctrl.blog/entry/resolvconf-tutorial.html (disable everything and just handle /etc/resolv.conf the 'old' way, and now finally I have no more leaks https://dnsleaktest.com as for wireguard, a pretty brutal settings in all wireguard profiles: PostUp = echo "nameserver <DNS IP in wireguard>" > /etc/resolv.conf PostDown = echo "nameserver 127.0.0.1" > /etc/resolv.conf and even a dns=none in /etc/NetworkManager/NetworkManager.conf p.s. I am aware of the great discussion in https://news.ycombinator.com/item?id=19435631 especially usr1106 comment

Fastmail looks great, but having "Get the email features you need, without giving up your privacy" and "Your data is always private" at the top of their homepage while knowing full well that is far from the case[0,1] seems disingenuous. [0] FastMail loses customers, faces calls to move over anti-encryption laws https://www.itnews.com.au/news/fastmail-loses-customers-faces-calls-to… [1] Goodbye FastMail https://www.ctrl.blog/entry/goodbye-fastmail.html

> I'd like to read a guide on hardening systemd. Here is a great guide detailing some of the security features available to systemd units from earlier this year (2020): https://www.ctrl.blog/entry/systemd-service-hardening.html

Native advertising trying to pretend its journalism by association is a much bigger problem than display advertising. Websites informing you about “great deals” with the voice normally reserved for actual journalistic endeavors (or even opinion pieces) in between their normal articles isn’t in any way desirable. Even big publishers don’t come clean about when articles are ads or not. E.g. https://www.ctrl.blog/entry/pcmag-vpn-review

Absolutely worth it to read the linked post by the EdgeDeflect author too: https://www.ctrl.blog/entry/microsoft-edge-protocol-competition.html Even if you'll eventually somehow be able to circumvent this, I'm more baffled by the sheer amount of effort Microsoft puts into locking Edge as the (de-facto) default browser. The changes OP described show pretty clearly this is deliberate and not just for whatever technical reasons there could be. E.g. even if microsoft-edge:// links had some proprietary features that are required for OS integration - say, opening the page in a specific existing process or something - it makes no sense to rewrite ordinary https:// urls into microsoft-edge:// urls - which Windows seems to be doing ("and links sent to the device from a paired Samsung or Android devices"). On the other hand, if they are so hell-bent on making Edge the default browser, why are they go through all the trouble with "link associations" and permit other browsers at all? By now it seems sort of odd they didn't simply hardwire https:// to Edge directly. In any way, this smells like another antitrust lawsuit waiting around the corner.

The main benefit is multiplexing - being able to use the same connection for multiple transactions at the same time. This can have benefits in finding and keeping the congestion window at its calculated maximum size, reduce connection-related start-up, as well as overcome waiting for a currently-used connection to be free if you have a max connection per server model. The other potential benefits were priorities and server-initiated push, but both I’d say largely went unused and/or were too much trouble to use. Priorities were redesigned in HTTP 3 - more at https://blog.cloudflare.com/adopting-a-new-approach-to-http-prioritiza… - and Chrome recently decided push in HTTP 2 wasn’t worth keeping around - https://www.ctrl.blog/entry/http2-push-chromium-deprecation.html HTTP 2’s main problem is head-of-line blocking in TCP - basically, if you lose a packet, you wait until you get that packet and acknowledge a maximum amount of packets thereafter - slowing the connection down. With multiplexing, this means that a bunch of in-flight transactions, as well as potentially future ones, are blocked at the same time. With multiple TCP connections, you don’t have this problem of a dropped packet affecting multiple transactions. HTTP 3 has many more benefits - basically, all the benefits of multiplexing without the head of line blocking (instead, only that stream is affected), as well as ability to negotiate alternative congestion control algorithms when client TCP stacks don’t…

The fact that it can be trivially blocked by anyone on the network path does not make it "much better". Of course anyone on the "network path" can block almost any protocol; DoT isn’t unique in that regard. The concern is many large businesses block port 853 but that's because prior to the development of DoT, there was no reason for IT departments to configure firewalls to enable it. Most organizations only have a handful of ports available, including 443, which is what HTTPS uses and therefore DoH works as a result. I've been running DNS over TLS using the Unbound [1] resolver for my home LAN on a spare laptop for a few weeks now and it’s been great. Given the privacy trade-offs between privacy and security, many IT departments would opt to make port 853 available for DoT rather than increasing the ability for their users to be tracked. As I mentioned elsewhere in this thread, the article Centralised DoH is bad for Privacy, in 2019 and beyond [2] clearly describes the issues with DoH: DNS over HTTPS opens up DNS to all the tracking possibilities present in HTTPS and TLS. As it stands, DNS over UDP almost always gets some free privacy by mixing all devices on a network together – an outside snooper sees a stream of queries coming from a household, a coffeeshop or even an entire office building, with no way to tie a query to any specific device or user. Such mixing of queries provides an imperfect but useful modicum of privacy. DNS over HTTPS however neatly separates…

>Effort have been made at keeping the impact of ads and tracking low: https://www.ctrl.blog/about/privacy-policy#privacy-policy-ad... FWIW, that's what every website will say. I don't have any reason to trust your site any more than I trust any other site. I don't want to be tracked by anybody, regardless of their intentions. > The ads help fund writing and research into technologies that restrict ads without blocking them outright. You choosing to block ads is your choice, but it takes away incentives for researching and writing about the topics you care to read about. You can sign-up for Flattr if you prefer not to see ads and still support writers. I'm sorry, but merely putting something online doesn't entitle you to make money from it. Posting an article or tweet or picture or other content on the public internet is an inherently non-profit activity, and it always has been. It doesn't entitle you to follow me around the internet. If you want to make money posting online use a paywall.

Unfortunately, I remember reading that Australia now has weak privacy laws: > The Telecommunications Assistance and Access Bill (TAAB or AssAccess) require technology companies like FastMail, Google, Apple, Cisco to provide Australian law enforcement and security agencies with access to all communications without any judicial oversight, transparency, or reason. The only restrictions offered to protect people’s privacy is the vague terms “reasonable and proportionate.” Source: https://www.ctrl.blog/entry/goodbye-fastmail.html

Microsoft constantly tries to trick[1], annoy[2] and coerce[3] users into using their software. 1: https://www.theverge.com/23935029/microsoft-edge-forced-windows-10-goo… 2: https://www.cloudcomputing-news.net/news/microsoft-tries-to-woo-google… 3: https://www.ctrl.blog/entry/windows-system-components-default-edge.htm…

I'm glad SELinux works better than in the past and at the same time I'm sorry it didn't from the start as many people were frustrated by it at that time (e.g. [0]). On the other hand, it looks like some people still get upset by it[1]. [0] https://news.ycombinator.com/item?id=13398582 [1] https://www.ctrl.blog/entry/selinux-unmanageable.html

> (Please tell me that exists now, or why it’s a bad idea.) Regarding the only-after semantics: - HTTP has "Delta encoding in HTTP": https://www.rfc-editor.org/rfc/rfc3229 (2002), - usage for feeds proposed in 2004: https://bobwyman.typepad.com/main/2004/09/using_rfc3229_w.html, - some (not so) recent discussion (2017): https://www.ctrl.blog/entry/feed-delta-updates.html + https://news.ycombinator.com/item?id=26091489 (zero comments). Adoption (or lack there of) is a different story. I guess the main issue is that it puts more work on the publisher side, in particular requires dynamic aspect when generating the response.

You get that not every program invoked on a desktop necessarily comes by that way right? But that’s not actually the core problem. I trust you can do your own research as to what the security issues are, but as a starter here’s https://www.ctrl.blog/entry/clipboard-security.html These are very old issues and are some of the major reasons Wayland was started in the first place. May want to read up on what the problems identified by the project were when it started considering all X maintainers migrated their time and energy to Wayland.

I remember seeing people try that fifteen years ago - it was a feature of FeedBurner, which ... apparently continued to work until 2021! https://www.ctrl.blog/entry/feedburner-2021.html

That's roughly what Flattr 2.0 did, as a browser extension : https://www.ctrl.blog/entry/flattr2.html (I guess the advertising industry, including Google, lobbied hard against a potential competitor, especially already at the time owned by an adblock company?) Heck, already Flattr 1.0 did that with its Flattr buttons on websites, but it got pretty much killed off by the 2013 Twitter APIpocalypse...

If you select the locale "English (Europe)" when installing Windows, it doesn't add bloatware. I think that's because they specify which bloatware to include depending on the country, and it's not defined for that locale. You also get a skippable error during installation because the installer doesn't have that locale defined for some message. https://www.ctrl.blog/entry/windows-ooberegion-bloatware.html

You want multiple NS records containing hostnames of nameservers from two or more providers on independent infrastructure (i.e. not two providers that are both hosted on, for example, AWS' compute). I would advise against running your own nameserver unless you have confidence in your ability to operate it correctly. You can increase the TTLs if you don't anticipate record data changing frequently, or are able to tolerate delays in your DNS record changes being served (until the cached answers expire). Choice of resolver (e.g. 1.1.1.1, 8.8.4.4) is out of your control (except of course, on your own devices and machines). Increasing the TTLs may improve robustness, assuming that your clients' resolvers are well-behaved and respect TTLs [0]. [0] https://www.ctrl.blog/entry/dns-client-ttl.html

"Don’t record your social life on an append-only social network" https://www.ctrl.blog/entry/append-only-social.html The distribution idea is glorious, but we'd all be better off with an application like it built on top of Syncthing ( https://syncthing.net/ ), ala DecSync ( https://github.com/39aldo39/DecSync )

Unfortunately ISPs not interested in that, too many legal letters because of file sharing users. So instead they they usually consider it a premium feature that they up-sell to gamers. Imagine how different the web would look like with many users with symmetrical connections, Opera Unite envisioned something like this https://www.ctrl.blog/entry/opera-unite.html

Seems like KeePass apps on Android often have decent but not quite perfect UI around conflict merging: https://www.ctrl.blog/entry/keepass-file-conflicts-android.html It does seem to be solvable though. I could see myself using SyncThing+ KeePass if I ever became unsatisfied with BitWarden and I found an app without too many sync issues.

You need to compare the URLs at least for equality in order to resolve conflicts, which is most straightforwardly done server-side. You could maybe do some sort of content-defined encryption to them, but I’m not sure how useful that would be. So storing the URLs in the clear is unfortunate but not inherently dumb. (As to how KeePass implementations deal with this problem when on top of a single synced file: they mostly don’t, data loss on conflict is not uncommon[1].) [1] https://www.ctrl.blog/entry/keepass-file-conflicts-android.html

This is an old thing they've been doing almost a decade now [0]. It's still around now [1]. You probably never because you either use Safari as your web browser or use it enough for the pop up to not trigger. I don't really get why you think this is unbelievable when Apple will regularly try to get you to use Apple Music, iCloud, etc. Why not Safari? [0] https://www.ctrl.blog/entry/how-to-osx-try-safari-promotion.html [1] https://lapcatsoftware.com/articles/TRYTHENEWSAFARI.html

Most clients ignore TTLs anyways, so your 1 day TTL barely is helping you're website's performance at all: https://www.ctrl.blog/entry/dns-client-ttl.html

Can it compile to systemd service sandboxing directives? Like described here https://www.ctrl.blog/entry/systemd-service-hardening.html

> To use your comparison, Windows is fine with you pulling Edge off the taskbar. It seems you missed stuff like: https://www.theregister.com/2021/11/11/latest_windows_11_build_enforce… https://www.ctrl.blog/entry/microsoft-edge-protocol-competition.html

Daniel Aleksandersen of ctrl.blog has absolutely no foot to stand on here. He is a proponent of this kind of algorithmic blocking for weird browsers and even implemented it on his own site and argued for it. https://www.ctrl.blog/entry/detect-non-browser-form-submission.html It's only after it happened to him that now he's suddenly against it. Until he removes the same type of blocks from his own website I have absolutely no sympathy for him.