Spyke

Replies

Comment on

FLOSS communities right now

  • Terrible format for archiving knowledge
  • Terrible tool for retrieving knowledge
  • Locks community access behind a corporate license agreement
  • Hands control of community-created content to a corporation
  • Prevents indexing by web search engines
  • Antithetical to interoperability
  • Privacy-hostile

A web forum is far better in most cases. If you can't manage to run your own, there are plenty of lemmy servers that will do it for you. Even an email list (with searchable archives) would be better than Discord.

If you have collaborative documents that outgrow the forum format, use a wiki.

If real-time chat is needed, irc or matrix.

A project hosting its community on Discord is a project that won't get my contributions.

games

Comment on

Larion Studios forum stores your passwords in unhashed plaintext.

Reply in thread

Your guess is confirmed here.

There are plans to update the forum, including for better security (the main issue with changing the forum software is concern over reliably migrating all of the existing content). After emailing (admittedly not current best practice), the passwords are hashed and only the hash is stored.

...and later...

The forum has been updated to https, and passwords are no longer being sent by email.

Which raises the question of how old OP's screen shot is.

Also, no, the password would not necessarily still be stored in plain text on their end. The cleartext password used in that email might be only in memory, and discarded after sending the message. Depends on how the UBB forum software implemented it and how Larian's mail servers are set up.

EDIT: I just verified that this behavior has resurfaced since it was originally fixed. OP would do well to responsibly report it, rather than stirring up drama over a web forum account.

games

Comment on

What's up with Epic Games?

Reply in thread

somehow they managed to invent like 90% of all “evil” MTX and DRM in the process

Having worked with DRM systems since long before Valve existed, I'm reasonably certain this is just plain false.

Comment on

OP finds vulnerability where a forum sends you your password in plaintext over email and everyone misses the forest for the trees

I think the OP of that post would have had a better reception if they had:

  • Responsibly disclosed what they found, rather than using it to stir up drama on social media.
  • Mentioned that it's just a web forum account, not connected to game accounts or anything else of value.
  • Targeted the software vendor (https://www.ubbcentral.com/) instead of picking on one particular customer who used that software.
  • Refrained from spreading misconceptions and unfounded assumptions about how the technology works.
  • Responded to the reasonable follow-up questions, such as those that came when readers discovered that the problem was reported fixed three years ago.

People in that thread responded with skepticism and criticism to an irresponsible, misdirected, misleading, alarmist mess of a post. That's hardly surprising.

games

Comment on

What's up with Epic Games?

Reply in thread

Epic cons:

Also:

  • Epic has already been caught scanning and collecting data from files on people's hard drives that are totally unrelated to Epic or its games.
  • Epic's habit of interfering with game availability, through exclusivity deals.

Ties with Tencent (super anti-consumer chinese state-owned megacorp)

To be more clear about it, Tencent is Epic's largest investor, so they obviously have a great deal of influence over and access to anything they want from Epic (likely including user data) and they directly benefit from Epic's growth.

Steam pros:

Also:

  • Actively funding and supporting development of linux gaming technologies for more than a few years now, to the point where linux is now very much a viable gaming platform.

Steam cons:
Drm

Given that DRM on Steam is entirely up to each game publisher, I don't think it's appropriate to list under "Steam cons". I'm not even sure that any of my Steam games have DRM.

If you mean that most Steam games expect to find an instance of Steam running, you should know that is not DRM, and it's trivially replaced with the open-source Goldberg Emulator or a similar tool.

Gog
I don’t know anything besides the fact that it has drm-free games

Another plus for GOG is that they let you download games with a web browser. No special app required. (I think Itch.io does this as well.)

privacy

Comment on

Proton domains blocked as disposable in disposable filter

It's not just Protonmail.

Blacklists like these aggressively and unapologetically collect all privacy-focused email domains they find, including simple forwarding and tagging services. With more and more sites using these lists to reject or black-hole email addresses, it has become difficult to protect one's self from spam and cross-site account tracking.

Dear web developers, please don't use these lists. Well-intended or not, they are privacy and user-hostile.

linux

Comment on

On Monday morning we (Mozilla) detected a very large crash spike affecting Firefox users on Linux, specifically on an older version of a Debian-based distribution

Highlights:

The crash started apparently out-of-the-blue, hitting thousands of Argentinian users on a Debian-based distro called Huayra, and specifically on version 5 which was based on Debian 10.

Everybody seemed to crash while searching for images on Google.

Google's code was allocating 20000 variables in a single frame.

news

Comment on

Here's how 2 sentences in the Constitution rose from obscurity to ensnare Donald Trump

Fourteenth Amendment to the United States Constitution

Section 3: Disqualification from office for insurrection or rebellion

Section 3. No person shall be a Senator or Representative in Congress, or elector of President and Vice President, or hold any office, civil or military, under the United States, or under any State, who, having previously taken an oath, as a member of Congress, or as an officer of the United States, or as a member of any State legislature, or as an executive or judicial officer of any State, to support the Constitution of the United States, shall have engaged in insurrection or rebellion against the same, or given aid or comfort to the enemies thereof. But Congress may, by a vote of two-thirds of each House, remove such disability.

privacy

Comment on

How does using Matrix compare with using Signal, privacy-wise?

Key points off the top of my head:

  • Both Signal and Matrix have solid cryptography. (In fact, the Matrix Megolm protocol is built upon Signal's Olm protocol.)
  • Signal's client is open-source, but not its server. Matrix clients and servers are open-source. (Note that open server code is less important than open client code when end-to-end encryption is used.)
  • Both have had security audits, and presumably will have more in the future.
  • Both have cross-platform support. Matrix has a greater variety of clients, and last time I checked, the desktop clients were better than Signal's.
  • Signal prides itself on minimizing metadata exposure. Matrix started later, and hasn't yet moved all metadata (e.g. reactions, group membership?) to an encrypted channel. (Note that metadata protection can't ever be complete for either one of them, because an attacker that can gain access to the servers could just as well gain access to the routers, and correlate packets at the network level.)
  • Signal is a centralized service (hosted by Amazon last time I checked), meaning all traffic flows through one place and can be shut down or monitored there. Matrix is federated, much like Lemmy.
  • Signal does not offer self-hosting. Matrix does. (One might do this to be sure they always have a copy of their past messages, or to be independent of public server outages, or to be the sole keeper of data and metadata in conversations between local users.)
  • Signal requires a phone number, which makes having an anonymous account challenging for many people. Matrix doesn't require anything, but some Matrix servers require an email address for account recovery purposes.
  • Signal apparently integrates cryptocurrency payments. Matrix does not.

The most obvious security vulnerability that I can think of is that the person you are communicating with (or, conceivably, oneself, as well) is using an insecure/compromised application that may be leaking information.

Indeed, end-to-end encryption is unable to protect the endpoints. That's true of both messengers.

Since you brought it up, note that smartphones generally run system-level software that is controlled by the OS maker, meaning that Google or Apple have the ability to monitor those endpoints. Signal's approach to addressing this is to offer a Google-free build of their app, if you can find it, buried on their web site and with a scary-looking warning against using it. Matrix publishes their apps on F-Droid, so there's an easy Google-free option. Of course, most of the people using either messenger will have downloaded from the big app stores, so even if your phone and app are Google-free, it's likely that most of your contacts' phones are not. I believe Matrix has an advantage here, simply because their Google-free builds are easier to find and keep updated, and are therefore probably in use by more people.