[-] mox@lemmy.sdf.org -2 points 1 day ago* (last edited 1 day ago)

Cloudflare is a provider that you can choose to have as a part of your own infrastructure.

Indeed.

man in the middle implies “attack”

That can be a convenient shorthand if the parties in a discussion agree to use it as such in context. For example, in a taxonomy of cryptographic attacks, it would make sense. It is not the general meaning, though, at least not a universally accepted one. Similarly, "counter" does not imply "counter attack", unless we happen to be discussing attack strategy.

More to the point, nothing that I wrote misrepresents the situation as was claimed by that other person. If I had meant attack, I would have said attack. Rather, they made a leap of logic because I (like most of my colleagues) don't happen to follow a convention that they like, and picked a fight over it. No thanks.

[-] mox@lemmy.sdf.org 3 points 2 days ago* (last edited 2 days ago)

It bugs me when people say Cloudflare is a MitM, because that is a disingenuous representation the situation.

No, it is a clear description of what is happening: Instead of https keeping the traffic encrypted from user to service, it runs only from user to Cloudflare (and then in some cases from Cloudflare to service, although that's irrelevant here). The result is that a third party (Cloudflare) is able to read and/or modify the traffic between the two endpoints. This is exactly what we in mean in cryptography discussions by man-in-the-middle.

You can decide that you don't mind it because it's not a secret, or because they haven't been caught abusing it yet, but to say it's not a man-in-the-middle is utter nonsense.

and you opt into it.

No, the service operator opts in to it, without consulting the user, and usually without informing them. The user has no choice in the matter, and typically no knowledge of it when they send and receive potentially sensitive information. They only way they find out that Cloudflare is involved is if Cloudflare happens to generate an error page, or if they are technically inclined enough to manually resolve the domain name of the service and look up the owner of the net block. The vast majority of users don't even know how to do this, of course, and so are completely unaware.

All the while, the user's browser shows "https" and a lock icon, assuring the user that their communication is protected.

And even if they were aware, most users would still have no idea what Cloudflare's position as a middleman means with respect to their privacy, especially with how many widely used services operate with it.

To be clear, this lack of disclosure is not what makes it a man in the middle. It is an additional problem.

it cannot be a MitM because both sides of the connection are aware of this layer.

This is false. Being aware of a man in the middle and/or willingly accepting it does not mean it ceases to exist. It just means it's not a man-in-the-middle attack.

[-] mox@lemmy.sdf.org 10 points 2 days ago

I think zero RPM worked before (on cards that supported it) but wasn't directly configurable in Linux.

[-] mox@lemmy.sdf.org 1 points 2 days ago

My condolences. Unfortunately, people are sometimes designated the in-house expert on a thing just because they seem slightly less ignorant of it than anyone else in the organization. That leaves more than a few people making decisions that impact security and privacy without good understanding or sound judgment in those areas.

Maybe you should train up and become your state's new security expert?

102
[-] mox@lemmy.sdf.org 2 points 2 days ago

It doesn't necessarily mean putting it in a game's launch options. Environment variables can be set in a startup script, or a flatpak config, or a command line, for example. But the Steam launch options approach is convenient when you're just testing something for one specific game.

[-] mox@lemmy.sdf.org 40 points 2 days ago

music group IFPI complained that while Cloudflare discloses the hosting locations of pirate sites in response to abuse reports, it doesn’t voluntarily share the identity of these pirate customers with rightsholders.

“Where IFPI needs to obtain the customer’s contact information, Cloudflare will only disclose these details following a subpoena or court order – i.e. these disclosures are mandated by law and are not an example of the service’s goodwill or a policy or measures intended to assist IP rights holders,” IFPI wrote.

So the corporations enjoying enormous profits from other people's work are unhappy that Cloudflare doesn't make it easy for them to circumvent due process. What a surprise.

(I'm generally not a fan of Cloudflare, because its man-in-the-middle position between users and services has grown to an unhealthy scale, making it ripe for dragnet surveillance and other abuses. But it would be even worse if it was actively helping these greedy, predatory corporations dodge the law.)

5
submitted 3 days ago* (last edited 3 days ago) by mox@lemmy.sdf.org to c/technology@lemmy.world

This first video from Xiph.Org presents the technical foundations of modern digital media via a half-hour firehose of information. One community member called it "a Uni lecture I never got but really wanted."

Video Presentation

22
LXQt 2.1.0 (lxqt-project.org)
submitted 3 days ago by mox@lemmy.sdf.org to c/linux@lemmy.world

LXQt - The Lightweight Qt Desktop Environment

22
submitted 3 days ago by mox@lemmy.sdf.org to c/linux@lemmy.world
69

Navi 10: RX 5700, 5600
Navi 14: RX 5500, 5300

[-] mox@lemmy.sdf.org 7 points 4 days ago* (last edited 4 days ago)

I built a new machine pretty recently, also with an RX 7800XT GPU (factory overclocked). When sitting idle at the desktop, the system draws about the same amount of power as my old machine did with an RX 480. So I think trying to put the big GPU to sleep during desktop use might be barking up the wrong tree.

I suggest getting a power monitor, like a Kill-A-Watt, and taking measurements while you experiment. Here are some ideas to consider:

  • Are you using multiple monitors? I have read that newer AMD GPUs sometimes draw more power than they should in this case. It might depend on the resolution and/or windowing system in use. (I don't remember if the reports I read were on Wayland or Xorg.) It almost certainly is a driver issue.
  • Are you using nonstandard timings? Have you tried different refresh rates? https://community.amd.com/t5/graphics-cards/which-monitor-timing-parameter-allows-gpu-vram-frequency-to/td-p/318483
  • Have you been playing games for hours every day, with no frame rate limit? The graphics card can draw considerably more power pushing polygons at 1440p@180Hz than it does at 90Hz, for example, and I don't think the wattage progression from idle to full load is linear.
  • Are you using recent kernel and firmware versions?
[-] mox@lemmy.sdf.org 6 points 4 days ago

This is one of the more important reasons to minimize dependencies and be very picky about the ones we adopt.

82
275
submitted 5 days ago* (last edited 5 days ago) by mox@lemmy.sdf.org to c/til@lemmy.world

This is in response to someone else's post from half an hour ago, which contained phone numbers controlled by a politically aligned organization. It doesn't matter which one.

Reports of election interference should go directly to the authorities:

https://www.usa.gov/voter-fraud

How to report voter fraud, intimidation, or suppression

If you suspect voter fraud, report it to your state or territorial election office. You can also report it to:

If you witness or suspect voter intimidation or suppression, there are three ways you can report it:

LAST UPDATED: September 18, 2024

[-] mox@lemmy.sdf.org 35 points 5 days ago* (last edited 5 days ago)

Who is Vote Save America? How are they funded? How can I verify that these phone numbers aren't controlled by a political interest or foreign adversary?

[Edit: I looked up some of the phone numbers. They route to a politically-aligned organization.]

More importantly, why would I follow the advice of some random web site regarding something this important, rather than looking for an official source?

I wouldn't. Here's what I found with a quick search:


https://www.usa.gov/voter-fraud

How to report voter fraud, intimidation, or suppression

If you suspect voter fraud, report it to your state or territorial election office. You can also report it to:

If you witness or suspect voter intimidation or suppression, there are three ways you can report it:

LAST UPDATED: September 18, 2024

[-] mox@lemmy.sdf.org 39 points 6 days ago

When I’m driving, it’s actually unsafe for my car to be operated in that way. It’s hard to generalize and say, buttons are always easy and good, and touchscreens are difficult and bad, or vice versa. Buttons tend to offer you a really limited range of possibilities in terms of what you can do. Maybe that simplicity of limiting our field of choices offers more safety in certain situations.

Or maybe being able to consistently and reliably operate the thing without taking your eyes off the road has something to do with it? Hmm... Yes, this is really hard to generalize.

131

Surprisingly, the youtube comments contain useful information, too.

244
79
submitted 1 week ago* (last edited 1 week ago) by mox@lemmy.sdf.org to c/linux_gaming@lemmy.world

I smile every time I see an improvement that will make it easier for games to run near full speed while confined to a virtual machine. Another step forward for security and privacy.

95
submitted 1 week ago by mox@lemmy.sdf.org to c/linux@lemmy.world
307
submitted 1 week ago* (last edited 1 week ago) by mox@lemmy.sdf.org to c/til@lemmy.world
view more: next ›

mox

joined 9 months ago