skullgiver

joined a long while ago
[–] [email protected] 8 points 5 days ago (1 children)

Most of the file browsers I've looked at use a native tool to unzip (sometimes literally invoking unzip).

Even the native/optimised byte code difference shouldn't make the process that much slower unless OP is just using a phone that's not very powerful.

[–] [email protected] 16 points 1 week ago (1 children)

In a way LinkedIn is federated. You create a profile or post, and within minutes hundreds of shady data brokers and contact details resellers have a copy of your post available for their customers!

I don't really see the benefit, though. LinkedIn is functionally almost the same as Facebook, and can be replicated by adding a theme to a Friendica instance with a few custom fields. The biggest difference is that LinkedIn allows recruiters to ~~spam and stalk you~~offer you jobs, other than that it's just Facebook where most adults have decided to only talk about work stuff.

[–] [email protected] 8 points 2 weeks ago (1 children)

Aside from the fact it's proprietary stuff they own... you can't just mandate that a company must release stuff they own to the public.

They don't need to reslsse stuff they own to the public if they keep the servers running of course. And they can alter their client side software to accept a third party game server and let the fans do the rest. Kind of what the EU has forced Meta to do through the Digital Markers Act.

They own it, they can do whatever they want with it.

No, they have to abide by the law. Apple, Google, Meta, and many other billionaire tech companies have already been forced to alter and open up access to their software. Hell, games companies have already been forced to remove lootboxes in "their property".

Except for the fact for most games the online play is an extra feature and not the core game.

And the games where this is only a minor feature will be hit the least by the proposed legislation, if at all. Same reason the cybersecurity legislation mandating the availability of software patches doesn't affect devices without network connectivity much. An RC car doesn't need firmware updates, an app-controlled RC car has terrible costs associated with it if you don't build your code right.

Modern game servers for major games are simply just not designed to be run locally bare metal.

I know that. But that doesn't mean someone else can't run the same protocol on bare metal. Just give gamers the ability to hook into someone else's server after shutdown and you'll be fine, probably. Make it part of your sunsetting strategy. Beats waiting for governments to come down and make you alter games you intended to drop in ways you don't want to modify through lawsuits and regulatory pressure.

Plus, you think the people developing the netcode need to provision a full multi continent cloud every time they test their protocol?

Now that v2.4 copy of your game server stops working cuz it's not compatible with v1.8 of their auth system, so it's now just dead.

Wow, good thing they were mandated by law to release a v1.7 server so v2.4 of their game still works! After all, the servers have been shut down, so v2.4 is the very last version the developer will need to care about. Barring the mandatory support period for the Cyber Resilience Act, of course. Or maybe they could make backwards compatible APIs, though I doubt game developers still know how to these days.

You can't mandate they keep updating their old code on a game they don't support anymore.

First of all, sure you can. It'd be stupid, but you can.

Designing a server to be self hosted is a critical choice you make very very early on in development

There it is. Choice. That choice can be influenced. For instance, "you cannot sell your game in the EU" is a good reason to reconsider that choice. Or maybe "figure out what"'ll cost us more, the EU fine or having a few devs release a self-hosted server" for products developed while the law enters into effect.

it will stop working eventually when external upstream apis stop being compatible

What upstream APIs? The game has been abandoned. The server code is no longer being worked on. The auth is done server-side on servers they don't even control. There is no upstream to break.

You seem to take the current state of the game development industry and extrapolate from the game publisher's point of view what would be achievable without losing money. That's not how the law works. The law doesn't care. It the law says "no visible blood in your zombie game", you either don't release in Germany or you find a way to comply. Nobody in the government cares about the complexity of remodeling games, all the hard work the colour designers did, the way the shaders were written, it just says "get rid of the blood or fuck off". In this case, the law would say "make your game work or fuck off".

Games worked like this for a decade. They can be made to work like this again. "Modern" doesn't mean "better", it just means "different" when it comes to game servers. The only thing stopping games companies from doing that, is the financial incentive not to. Threaten 'em with a couple billion dollars of fines and they'll realign their incentives. It worked great for social media companies and ad agencies.

Some free-to-play video games would definitely fuck off. The companies willing to put up half a dev's time every month to sync their protocol changes to their self hosted servers will be there to take gamers' money they would've spent on the free to play stuff. There are billions at stake, and games companies are legally obligated to gobble up as many of their billions for their shareholders as they can.

[–] [email protected] 19 points 2 weeks ago* (last edited 2 weeks ago) (15 children)

The EU already mandates minimal service life for things like security updates. I don't see why it won't make it past courts. Hell, under EU laws regarding warranty, games publishers are probably already forced to either run game servers for a minimum of two years (or offer alternatives such as full refunds). This concept is just extending the mandated warranty in a sense. As for the software itself, manufacturers are under tons of regulation when it comes to support and availability of replacement parts in various industries. Entitlement does play a role, but that may very well be in the fact that consumers are simply entitled to access to the goods and services they purchased.

Also, there's nothing stopping companies from releasing alternative servers when their main servers turn off. Games used to come with dedicated servers for free. Companies just decided not to do it anymore because they can make more money with their current strategy. While the games are being sold, these companies make hundreds of millions or even billions of profit. The cost of their servers remaining available is just part of their profit forecast.

None of this will fail because it would be impossible to make happen. The real question is probably if consumers have more power than the video games lobby. I doubt they do. The proposal goes against the financial incentives of video game publishers, so they'll try to convince lawmakers not to bother. If their attempts fail, there's a chance certain games won't make it into the EU if such a law passes, or that certain content won't be available, but it's not like nobody will make games anymore.

A more realistic scenario of a law like this will have game publishers state an expiration date on their software. They already have to when it comes to security updates, but they'll probably have to put a sticker on it like "this game/DLC will stop working after 2026" and let consumers decide whether to buy the product or not.

[–] [email protected] 6 points 2 weeks ago

I don't think the science is out on that. For instance, your capacity to fall in love with someone is influenced by their smell as it contains information about their immune system (and, by extent, their immunological compatibility with yours).

Most humans have a need for companionship. It's the reason solitary confinement is considered torture in most cases. Our brains and bodies are rigged to prefer companionship over being alone most of the time. Put a human alone in a room with a plastic ball with a face drawn on it for long enough, and that plastic ball will be given a name, a personality, and that human will get upset if you dare "hurt" the plastic ball. In a much more dystopian twist on that experiment, people have started "befriending" LLMs now that they've grown to have the ability to remember a couple hundred keywords about your user account. The human mind craves being around others.

However, I don't think whether you like someone or not is purely a function of what they provide for you. You can enjoy the presence of your friends even if you're sitting in a room silently scrolling on your phone, or watching a TV show.

Their opinions and behaviour towards others definitely also matters. Shared experiences also factor into this stuff somewhere; someone you would normally detest who might've been with you through bad times/some traumatic event might end up becoming a friend. Years and years of positive experiences can also make you find excuses for things you would reject in others (which is why even the worst people can have their families and friends protect them). Your friends may have turned into terrible people over the years, and you will find ways to defend their behaviour to yourself and others just because they're your friends. Similarly, someone you know well might do something terrible out of the blue, and you will recognise that as an outlier event (mental health crisis? sign of illness?) rather than distancing yourself from them like they're some weirdo in the street.

Maybe ask yourself this: if your friends got hit by a car tomorrow, and suddenly lost their ability to hold an interesting conversation, make witty jokes, or play video games with you, would you stop caring about them? If not, then there's clearly more to your relationship with them than the basic experiences they can provide.

[–] [email protected] 1 points 2 weeks ago (1 children)

I don't see why not. Based on the spec, a server submits a request signed by a keyId which the receiving server caches or obtains, but the new server is also queried for the keys belonging to the actor. You cannot reuse the old key IDs (probably) because it'll stay in the cache, but you can just add new keys of your own.

Step 10 of the key verification algorithm explicitly instruct the server to ignore the old key and fetch a new one, in case the other server has done a blind key rotation.

In other words, the ActivityPub spec only verifies that an account was the source of a message at the time a server submitted or forwarded an event. It does not validate that an Update with new text contents belongs to the same server that once Created the object.

Of course, I expect ActivitiyPub software to (mis)implement this spec in different ways. Some software will be protected against domain hijacking, others will leave domains once registered completely useless in the future for common actor names in ActivityPub.

[–] [email protected] 2 points 2 weeks ago* (last edited 2 weeks ago)

There is, but the protocol is designed that you can't buy a domain for a month, set up a server, and then let it expire, leaving it unable to use ActivityPub for decades after because you posted a few things to Mastodon with popular usernames.

There is public/private key authentication, but the server is queried for its current keys when verifying content. This allows lemmy.ml to forward lemmy.dbzer0.com content to any other server without knowing the private key, because the receiving server will call back to the original server (if they key is not already cached) and use the user's public key to verify the message.

Once the domain expires and a new person buys the domain, that new person is in charge of what keys a domain lists or not. That, combined with the fact blind key rollover is permitted, leaves it up to programmers of individual servers to decide if they accept the new keys or not (the spec says they should).

[–] [email protected] 11 points 3 weeks ago

Kids shouldn't even be on social media, but at least the corporate ones are covering their ass against lawsuits well enough that they try to moderate content.

The Fediverse is not a place for kids. Servers catering especially towards kids are DEFINITELY not for kids, because that's exactly the kind of server I would build if I were a pedo.

The legal requirements for hosting content for kids are a massive headache that you definitely don't want to take on as a volunteer. The Fediverse can't even comply with the GDPR, let alone COPPA and its many international alternatives that actually see enforcement.

Of course I was a kid on the internet too and very few websites care about lying about your age, but if you do that and see the occasional dick, fetish porn or gore, you've only got yourself to blame. Plus, the Fediverse is full of misinformation, lies, and propaganda, from every side of the spectrum. Moderators can only do so much, and some moderators straight-up post misinformation and propaganda themselves. Best not to expose kids to any it that shit until their brains have developed a bit more.

[–] [email protected] 6 points 3 weeks ago (5 children)

Note that because of the way federation works, the domain can be bought by someone else who can then use the connections and links to lemm.ee images and posts to peddle spam and other nonsense. It's not a problem as long as the domain name stays under control of the lemm.ee admins, but if they don't renew their registration then anyone can pretend to be the old lemm.ee server.

Best for lemm.ee users to delete images from their posts and comments now so whoever grabs the domain in a year or so can't use it to inject weird shit into your old posts as easily. Of course they still can create new accounts for all.the old account names and post in your name if they want, but the user private keys should prevent that for individual posts if the other server software is smart enough to validate them.

[–] [email protected] 1 points 3 weeks ago

Capsacin is not soluble in water, so water and spicy food don't really interact. Unless the water is contaminated, chugging water won't do more than make you pee.

The capsacin applying signals as if your bowels are literally on fire and your body reacting to it as if it's poisonous will, though. Many people can apply the same trick they can apply when they get the shits from milk: just consume a decent amount of it every day and your body will get used to it eventually. Not recommended if you have roommates or a difficult to reach toilet, though.

Of course it could be that standard Taiwanese drinking water is so contaminated that chugging it does give you mild food poisoning, but that doesn't change the fact that people not eating large amounts of capsacin still get the shits when they eat spicy food.

[–] [email protected] 2 points 3 weeks ago

So far the only companies making you use one are the multiplayer gaming companies that are using TPMs for hardware IDs to ban cheaters and expensive corporate software using them for remote attestation on hardware the company owns.

If you're salty about the whole Windows 10 thing, you've got until at least October 2027 until Microsoft drops support for it (security beyond the 10 year window announced at the launch of Windows 10 cost like 5 bucks a month though) or you can install an OS from someone who's still willing to maintain support for old hardware, like Google's ChromeOS or maybe Linux.

It's only really a problem if you're unwilling to pay for (or pirate) updates and are afraid to separate yourself from the large corporations building your current OS.

[–] [email protected] 3 points 4 weeks ago

Oracle has a generous free server offering. You will need to trust Oracle not to turn off your server because a business customer needs it, though. Availability of their good free tier also fluctuates and you need to figure out their weird IP/firewall/security config.

You need a domain name to effectively federate, too. There are free options available for those too, but they're not very reliable.

 

Lemmy.world is gedefedereerd van feddit.nl. Dit heeft als gevolg dat inhoud (posts, comments) niet meer tussen de twee servers wordt gesynchroniseerd.

Omdat Lemmy ietwat apartwerkt, kun je vanaf feddit.nl nog wel in de lokale kopie van de gemeenschappen op .world plaatsen, maar die berichten zullen niet aankomen op .world en alle servers die daarop zitten aangesloten.

 

Nederland moet zich de komende tien jaar aan strengere stikstofeisen houden dan nu nog gelden. Beschermde natuurgebieden hebben meer last van stikstof dan gedacht, blijkt uit onderzoek van de Wageningen Universiteit in opdracht van het ministerie van Landbouw, Natuur en Voedselkwaliteit (LNV). Aan de hand van dat onderzoek worden iedere tien jaar stikstofnormen vastgesteld.

Het gaat om de zogenoemde KDW, de Kritische Depositiewaarde. Dat is de maximale hoeveelheid stikstof die een natuurgebied aan kan zonder dat de natuur er verslechtert.

De NOS berichtte vorig jaar al over een uitgebreid internationaal onderzoek waaruit bleek dat de bestaande stikstofnormen niet streng genoeg zijn. Nederlandse wetenschappers hebben nu onderzocht wat de uitkomsten van dat internationale onderzoek betekenen voor de Nederlandse stikstofnormen.

Gemiddeld mag in natuurgebieden de komende jaren zo'n 7 procent minder stikstof neerkomen dan tot nu toe, met uitschieters tot 36 procent.

De NOS legde de nieuwe normen op de kaart van de stikstofgevoelige natuurgebieden in Nederland. Daaruit blijkt dat in bijna 47 procent van de gebieden de normen strenger worden. Een kleine 3 procent krijgt juist minder strenge normen. Voor de rest verandert niets.

In deze natuurgebieden worden de stikstofnormen strenger

De afgelopen jaren kwam er veel te veel stikstof neer in stikstofgevoelige natuurgebieden, waardoor de natuur achteruitgaat.

Doordat ons land niet binnen de wetenschappelijk vastgestelde stikstofgrenzen blijft, mag er ook vaak niet gebouwd worden. Om weer ruimte te krijgen voor nieuwe bouwvergunningen en de natuur te herstellen, hoopt de de overheid de komende jaren duizenden boeren te laten stoppen met hun bedrijf in ruil voor een financiële vergoeding.

Het demissionaire kabinet wil dat in 2030 in 74 procent van de stikstofgevoelige natuurgebieden niet langer te veel stikstof neerkomt. Nu de stikstofnormen strenger worden, wordt het moeilijker om dat te halen.

Reactie minister Van der Wal

Minister Van der Wal (Natuur en Stikstof) noemt de nieuwe cijfers "zorgwekkend voor de natuur en voor iedereen die zo hard werkt aan onze gezamenlijke opgaven om de natuur te herstellen". "Door de nieuwe wetenschappelijke inzichten is onze opgave helaas groter geworden."

Ook is het volgens de minister "vervelend nieuws voor iedereen die behoefte heeft aan vergunningsruimte". Van der Wal laat het RIVM onderzoeken of er naast het huidige beleid meer nodig is. Verder wil ze meer onderzoek naar een alternatief voor de KDW voor het bepalen van de stikstofnormen.

Er is al geruime tijd kritiek op de KDW, de stikstofnorm die wordt gehanteerd. Veel politieke partijen willen van de grenswaarde af, omdat die niet flexibel is. Ook het kabinet zoekt een alternatief, maar tot nu toe is dat niet gevonden. Zolang het er niet is, blijven rechters de KDW gebruiken als ze bijvoorbeeld moeten oordelen of een bouwproject door kan gaan.

De wetenschappers van de Universiteit van Wageningen keren zich in hun rapport tegen de kritiek op de KDW. "Met nadruk zij gesteld dat de in dit rapport uitgevoerde KDW-schattingen aan de conservatieve kant zijn," schrijven ze. Als dit onderzoek over tien jaar weer wordt uitgevoerd, zou dat volgens een andere, strengere methode moeten gebeuren, vinden de betrokken wetenschappers.

Hoe wordt de KDW bepaald?

Wetenschappers berekenden in 2008 aan de hand van een model wat de maximale stikstofneerslag in verschillende types natuur zou moeten zijn. De getallen die daaruit kwamen, werden naast Europese normen gelegd. Die Europese normen zijn altijd een bandbreedte, gebaseerd op waarnemingen in de natuur van wetenschappers.

Stel dat die Europese bandbreedte 13 tot 15 is, terwijl het model uitkwam op 20, dan wordt de Nederlandse grenswaarde automatisch 15. Binnen de Europese grens dus, maar zo dicht mogelijk bij het oorspronkelijke Nederlandse getal.

Niet het oorspronkelijke Nederlandse getal, maar de Europese bandbreedte is nu aangepast. Daardoor veranderen dus ook een groot aantal Nederlandse grenswaardes.

 

After setting up my own Lemmy server, I've been intrigued by the server logs. I was surprised to see some search engines already start to crawl my instances despite it having very little content.

I've noticed that most requests seem to come in from IPv4 addresses, despite my server having both an IPv4 and an IPv6 address. This made me wonder.

IPv4 addresses are getting more scarce by the day and large parts of the world have to share an IPv4 address to get access to older websites. This often leads to unintended fallout, such as thousands of people getting blocked by an IP ban from a site admin that doesn't know any better, as well as anti-DDoS providers throwing up annoying CAPTCHA pages because of bad traffic coming from the shared IP address. Furthermore, hosting a Lemmy server of your own is impossible behind a shared IP address, so IPv6 is the only option.

IPv6 is the clear way forward. However, many people haven't configured IPv6 for their hosts. People running their own Lemmy instances behind an IPv6 address won't be able to federate with those servers, and that's a real shame.

Looking into it

So, I whipped up this quick Python script:

import requests
import sys
import socket
from progress.bar import Bar

lemmy_host = sys.argv[1]

site_request = requests.get(f"https://{lemmy_host}/api/v3/site").json()

hosts = site_request['federated_instances']['linked']

ipv4_only = []
ipv6_only = []
both = []
error = []

with Bar('Looking up hosts', max=len(hosts)) as bar:
    for host in hosts:
        host = host.strip()

        try:
            dns = socket.getaddrinfo(host, 443)
        except socket.gaierror:
            error.append(host)

        has_ipv4 = False
        has_ipv6 = False
        for entry in dns:
            (family, _, _, _, _) = entry

            if family == socket.AddressFamily.AF_INET:
                has_ipv4 = True
            elif family == socket.AddressFamily.AF_INET6:
                has_ipv6 = True

        if has_ipv4 and has_ipv6:
            both.append(host)
        elif has_ipv4:
            ipv4_only.append(host)
        elif has_ipv6:
            ipv6_only.append(host)
        else:
            error.append(host)
        
        bar.message = f"Looking up hosts (B:{len(both)} 4:{len(ipv4_only)} 6:{len(ipv6_only)} E:{len(error)})"
        bar.next()

print(f"Found {len(both)} hosts with both protocols, {len(ipv6_only)} hosts with IPv6 only, and {len(ipv4_only)} outdated hosts, failed to look up {len(error)} hosts")

This script fetches the instances a particular Lemmy server federates with (ignoring the blocked hosts) and then looks all of them up through DNS. It shows you the IPv4/IPv6 capabilities of the servers federating with your server.

I've run the script against a few popular servers and the results are in:

Results

Server IPv6 + IPv4 IPv6 only IPv4 Error Total
Lemmy.ml 1340 3 1903 215 3461
Beehaw.org 807 0 1105 74 1986
My server 202 0 312 4 518

A bar chart of the table above

A pie chart of the results for Lemmy.nl

A pie chart for the results for Beehaw.org

A pie chart for the results for my server

It seems that over half (55%+) the servers on the Fediverse aren't reachable over IPv6!

I'm running my own server, what can I do?

Chances are you've already got an IPv6 address on your server. All you need to do is find out what it is (ip address show in Linux), add an AAAA record in your DNS entries, and enable IPv6 in your web server of choice (i.e. listen [::]:443 in Nginx). Those running a firewall may need to allow traffic through IPv6 as well, but many modern firewalls treat whitelist entries the same these days.

Some of you may be running servers on networks that haven't bothered implementing IPv6 yet. There are still ways to get IPv6 working!

Getting IPv6 through Tunnelbroker

If you've got a publicly reachable IPv4 address that can be pinged from outside, you can use Hurricane Electric's Tunnelbroker to get an IPv6 range, free of charge! You get up to five tunnels per account (each tunnel with a full /64 network) and a routed /48 network for larger installations, giving you up to 65k subnets to play with!

There are lots of guides out there, some for PfSense, some for Linux, some for Windows; there's probably one for your OS of choice.

Getting IPv6 behind CGNAT

Getting an IPv6 network through a tunnelbroker service behind CGNAT is (almost) impossible. Many ISPs that employ CGNAT already provide their customers with IPv6 networks, but some of them are particularly cheap, especially consumer ISPs.

It's still possible to get IPv6 into your network through a VPN, but for serving content you'll need a server with IPv6 access. You can get a free cloud server from various cloud providers to get started. An easy way forward may be to host your server in the cloud, but if you've got a powerful server at home, you can just use the free server for its networking capabilities.

Free servers are available from all kinds of providers, such as Amazon(free for a year), Azure(free for a year), Oracle(free without time limit). Alternatively, a dedicated VPS with IPv6 capabilities can be as cheap as $4-5 per month if you shop around.

You can install a VPN server on your cloud instance, like Wireguard, and that will allow you to use the cloud IPv6 address at home. Configure the VPN to assign an IPv6 address and to forward traffic, and you've got yourself an IPv6 capable server already!

There are guides online about how to set up such a system. This gist will give you the short version.

Final notes

It should be noted that this is a simple analysis based on server counts alone. Most people flock to only a few servers, so most Lemmy users should be able to access IPv6 servers. However, in terms of self hosting, these things can matter!

view more: next ›