ww 🩶

i wonder if real impostors have impostor syndrome. as in, "i'm not actually good at assuming other people's identities. it's mostly just luck and everyone around me being stupid, so they don't notice. hell, they probably do notice, but play along cause that takes less effort. if they cared to expose me for impersonating their friends/clients/coworkers/etc, they would.."

2026-04-06 03:38:01 UTC

- reply

so making lockpicking a crime makes sense cause it pretty much proves malicious intent

2026-04-06 03:37:21 UTC

- reply

yeah, and that's part of why we use locks, to prevent accidents that are hard to judge like that

2026-04-06 03:34:51 UTC

- reply

but someone's gonna do it, the question is when. and if testing the system and reporting to the owner is as big of a crime as doing it anonymously and destroying the system, the law isn't working to improve the society.

2026-04-06 03:33:28 UTC

- reply

locks make the intent to trespass evident. cause like if i picked someone's lock while they're away, went inside, photographed their documents, and left, and the only evidence was a forensic examination of the lock, it would be very hard to prove that i didn't just pick their lock for fun.
well, if you accidentally opened an unlocked door thinking it's yours, that's not necessarily trespassing, and the line can be pretty blurry sometimes

2026-04-06 02:19:59 UTC

the argument that lockpicking shouldn't be a crime because.. it's not the lockpicker's fault that the lock isn't secure? is absolutely ridiculous lol
people should be able to pick their own locks and the locks of consenting adults, but there's no legitimate reason to do it against strangers

2026-04-05 07:45:45 UTC

- reply

> to hell with server centrism, just make them relays
that eliminates smtp as well :p
scuttlebutt was super confusing and unreliable ime. also not very good on smartphones or multi-device in general.
oh, i didn't realize nostr couldn't gossip, that sucks
> government interference
at least it's easily detectable with ct, also they're the only ones even trying to solve the problem (unless you count pgp wot i guess)
> some DNS stuff
yeah i think dane allows specifying one's own self-signed tls certificates for email. idk the details but people say the crypto in dnssec isn't very good, and not every tld supports it, so it's not a universal solution.
i mean, yeah, but idk. it's much easier to deal with otherwise, like in docker and such. or providing one distro-agnostic downloadable static binary per os+architecture without resorting to appimage. also caching/incremental builds are hard and all c/++/java/etc build systems are bad because of that. and i prefer js/ts anyway.

2026-04-05 07:15:22 UTC

- reply

> spools that can be implemented by arbitrary other protocol-relays
yeah, federation bound to domain names is conceptually incompatible with that—you have to be able to directly load the message origin's key. and with spools, you'd probably want user identity independent of server identity anyway. what do you think of nostr?
> should be able to send snailmail to their server and continue interacting via the responses
it would be nice, but it greatly expands the scope of the protocol, activitypub wasn't made for it. and when compared to xmpp, i think it fares better. nostr should be compatible with snailmail.
> That is considered out of scope, yeah
but then there's no sense in comparing it to tls pki, since trust in identity is its raison d'etre
i see! there's a lot of tradeoffs involved, and i guess personally i prefer those of golang, like static linking.

2026-04-05 06:59:06 UTC

- reply

> There's such a conspiracy?
https://lars.ingebrigtsen.no/2026/02/02/whats-up-with-all-those-equals-signs-anyway/
> Those are cute by the way.
:)
> Are they opaque?
the clients i've used had an option to view them, but it's buried. and i'm pretty sure most people don't know they're leaking timezone and maybe even hostname!
idk, i think i used to run claws mail with TZ=0 to switch to utc. apparently there's a hide_timezone option now, if you know to look for it. i don't know any other client that allows one to set that up, let alone makes it obvious that the timezone is shared? i mean, even git doesn't...
and like, the reason they have unfriendly defaults, at least in regards to the timezone, is probably that the standard recommends them: "The date and time-of-day SHOULD express local time." (https://www.rfc-editor.org/rfc/rfc5322#section-3.3)

2026-04-05 06:46:15 UTC

- reply

> The spec should actively acknowledge and support that.
agreed
> Active support for pluggable transports
how do you mean? with relays?
> major usability issues with infrastructure-disadvantaged areas
wdym? isn't that a client issue? those that seamlessly retry posts/favs/boosts don't need it to be constant/low-latency. and you can load your timeline and then go offline.
how does nncp solve the key sharing problem? like, without pki you pretty much have to use tofu..
what's wrong with golang?

2026-04-05 06:37:34 UTC

- reply

> it clearly doesn't need it
:KuromiFrustrated: :KuromiPout: :KuromiCry:
> tacked on hacks
yes!!
> a flaw of the clearnet
smtp is expressly a set of clearnet technologies!
> delegation
you mean mx records? those are part of the design, and also expressly clearnet-specific!
> simplified greatly by a proper transport layer
but how? i guess you have client keys in onion, no idea if you can use one for both a client and a server.
and then, like, which parts are worth keeping, and at which point is it no longer smtp?
- the session-oriented request-response protocol is weird and slow, especially over tor
- relatedly, there's no excuse for MAIL FROM and the From header being separate fields
- the envelope is weird, inefficient and kinda obscure in general
- everything tls and dns-related is irrelevant for our purposes
- there's the email format with headers and multipart body, with weird encodings. like, that's what recently caused a conspiracy theory about epstein emails lol. implementing that decoder apparently isn't straightforward, especially when working with emails generated by older clients.
- headers traditionally leak a lot of metadata while being opaque to the user. e. g. user-agent is unnecessary, date should be standardized to utc to avoid leaking timezone.
- most email clients are bad
i'd probably replace every one of those parts, but that's a different protocol..

2026-04-05 06:15:37 UTC

- reply

it's a tradeoff and i think it's one worth making. you can extend the spec for your overlay network. cause otherwise developers implementing it outside those will make the worst implementation possible with just enough features to technically pass and their end-users will suffer!
yeah but activitypub wants any server to be able to talk to any other, so you'd need a separate, onion/i2p-only network, which likely won't be worth spending time on
activitypub works well on smartphones and xmpp is hostile to them due to its connection orientedness
i2p and tor have plenty of that, unless you have a good way to share addresses out of band

2026-04-05 06:09:19 UTC

- reply

why? smtp doesn't support unicode, and its security is a disaster. you have dkim, spf and dane for sending, and when receiving, there's nothing you can really do to reliably protect from mitm. tls certificates aren't verified the way you'd want them to be. and all the subtle incompatibilities, there's just, no excuse.
and yeah you can use a subset with stricter requirements for your little ecosystem you have full control over, and fall back when talking to outsiders, but why would you?

2026-04-05 06:04:29 UTC

- reply

like, even despite all its problems, activitypub is just a better option for most usecases? it's easier to deploy, easier to secure, uses tls like normal people (without dane or a thousand fallbacks!), has reasonable identity with webfinger and http signatures. and you have the whole of https at your disposal. you can do mtls, compress your requests, etcetc.

2026-04-05 05:59:26 UTC

- reply

i think xmpp is a bad protocol in whichever role tbh. i'm not sure whether it's better or worse than smtp, but i think proliferating the use of either is a disservice to the humanity!

2026-04-05 05:46:56 UTC

i hate xmpp. i randomly received a message that my omemo keys got updated. a new key was added. it's the same key i've had in my desktop client from the beginning.
and there's a bunch of other keys, probably from when i was trying out different clients. whenever i try to delete them, they always come back. or, well. one of the clients actually hides them. another grays out. and the third shows them as still trusted, except the trusted switch is disabled, so i can't remove trust. i can long-tap and erase the key, but it comes back after a restart.

2026-03-31 18:02:55 UTC

- reply

unix lost its way

2026-03-31 05:36:39 UTC

- reply

more like ww-narrow ww :p

2026-03-31 05:23:59 UTC

- reply

seriously tho, when a manual says, "in its first form," it's about a command that's diametrically opposed to the unix way, and that's like half the commands

2026-03-31 05:21:49 UTC

tar is not unix way. rsync is not unix way. none of cpio, install, env, bash/zsh/etc, [[/test, tail, awk, vi, ssh, git, curl, gpg or cat is unix way. just look at those manuals. it's a disaster! in fact, the only true unix way command installed on your system is probably yes.

2026-03-31 05:09:40 UTC

if ww is so good, why is there n—

2026-03-25 02:53:56 UTC

https://s3.us-east-2.wasabisys.com/xyzzylink-media/f51f011e09c7b0b0c296f4eaa156e5d837c4f95cf50f1d67ec9fe2dd515ef672.jpeg

2026-03-11 07:03:36 UTC

- reply

jealous of mcdonald's success at achieving world domination

2026-03-09 06:21:09 UTC

it's an email client with pgp and ai built in

2026-03-07 22:31:57 UTC

it's only polonium if it comes from the poland region of europe

2026-03-07 20:47:28 UTC

- reply

presumably, you can write 3d text in it?

2026-03-07 08:53:50 UTC

- reply

i just think at this point, anything that doesn't have economic activity happening over it can be blocked without consequences
most people don't buy magazines though, it's mostly people whose hobby is computers, so it wouldn't replace the web
yup. reading about those types of networks, i always wondered how the hell people in the us were able to afford them.

2026-03-07 08:44:08 UTC

- reply

zines are not real discoverability. also they don't have the money for those ads and the government doesn't have an incentive to allow them to exist anyway.
yeah where i'm from most people didn't really know what the internet is until the mid-2000s, even if they had computers

2026-03-07 08:38:48 UTC

- reply

where did you learn about those other protocols?

2026-03-07 08:35:42 UTC

- reply

i hope not, otherwise we'll just have facebook be the entirety of networking

2026-03-07 08:34:17 UTC

- reply

in the context of the poll, it's networking in general—it's just nothing really happens outside websites and mobile apps, most of which are alternative frontends for the same json api.

2026-03-07 08:29:19 UTC

- reply

i feel like without networking, free software is much less meaningful.. like, even if you have a sneakernet, that makes computers just so much less useful, and the advantages of free software proportionally smaller.

2026-03-07 05:39:41 UTC

okay, you made your choice. i'm taking away y'all's alternative operating system privileges!! clearly you don't deserve them!! :KuromiPout:
#note1zg2…f352

2026-03-06 07:07:11 UTC

- reply

oh interesting, i didn't see that skimming through their docs! but it seems you're supposed to buy those at the official store, and they aren't anonymous according to this post (proton can link the buyer to the redeemer): https://discuss.techlore.tech/t/proton-gift-cards/11895/12
so if you do find a third party to buy them from, that might only add one more subpoena to the chain, depending on the party

2026-03-06 04:48:43 UTC

- reply

well, the math in monero is pretty interesting (though it can't save you from sybil attacks), but proton only supports bitcoin. and cash over mail, which can be similarly hard to do anonymously, depending on where you are. so the only winning move is not to pay.

2026-03-06 04:24:54 UTC

- reply

aside from everything else, it's funny how paying for your encrypted email puts you at much greater risk than using the free tier. self-defeating business model, to an extent.

2026-03-05 22:43:49 UTC

- reply

i mean like this (selection mine)
https://s3.us-east-2.wasabisys.com/xyzzylink-media/b8d91f8a471659c352af8fb467ad1de0eb0db1cf0b471687565be8c9e4ac55ff.png

2026-03-05 21:07:17 UTC

i don't understand pull quotes. like, they usually appear before the sentence they're quoting. so it's basically a way to make you read a sentence out of context and misunderstand it, and then read it again and then it makes sense. why :KuromiConfused:

2026-03-05 04:03:24 UTC

- reply

i guess as a colloquial internet use; i don't think it originally had that meaning?

2026-03-05 03:46:57 UTC

- reply

how do you mean?
yeah, but it's a lot of work, easier to add to the already written letter. especially if it's a long one!

2026-03-05 03:01:54 UTC

did you know? postscriptums are pointless in email, as you can just edit the previously typed text without having to start from scratch.

2026-03-04 19:28:29 UTC

would you rather

2026-03-03 03:56:02 UTC

omfg i'm finally known enough to get spam lol
every one of the past spam waves there would be people complaining about it. but no matter how much i posted, the spammers couldn't find me. now it finally happened!! success

2026-02-26 07:09:17 UTC

- reply

> Are most of them related to XML itself?
a fair amount are! pretty sure it's still possible to crash a browser tab using an svg file with recursive xml entities. but i guess outside that xml and json-ld mostly share the same issues, the latter is just simpler, making it easier to implement securely. like i think any serialization format that requires network requests to properly parse is a bad idea. and i personally dislike everything rdf-adjacent though i do see the value they (and xml's namespaces) provide :( there needs to be a format that doesn't rely on network requests but has a way to make sure you're talking about the same thing.
not my area of expertise, but i'm fairly certain that if there being a rigid structure to your compressed plaintext could cause a big vulnerability so easily, both of us would've heard about it :Kuromi:

2026-02-26 06:45:00 UTC

- reply

it does but it's an unfair critique when comparing to xml. ~30 years of creating software vulnerabilities out of thin air and counting!!
well, fwiw xmpp doesn't even have an accepted push spec, it's "deferred" after being inactive in an experimental status for too long
we have way bigger problems then. breach specifically requires every response to be more or less the same except for the attacker-chosen plaintext, that's why it's mitigated with random paddings. you can't do the partial predictions if you don't know what's inside the message and have no point of reference (like the same message with one part that differs).

2026-02-26 06:22:58 UTC

- reply

> namespaces/schema
json-ld?
yeah i don't think matrix or activitypub are great, but both have fewer issues like that, partly cause they're younger
afaict the attack works roughly like this:
secret token is xxx
attacker sends yyy, server returns xxxyyy, compressed it's 3x3y, length = 4, can predict that there's no match
attacker sends xyy, server returns xxxxyy = 4x2y, attacker sees that length is still 4 and not 6 as expected = partial match
attacker sends xxx, server returns 6x = length unchanged = full match
if i'm not mistaken, active interference is required, and in this case it would look like a ton of spam

2026-02-26 06:05:55 UTC

- reply

it's not bound to a specific service it's just considered mandatory and not just one of the nice to have features. but nvm it leaks an uncomfortable amount of information to the app developer. both fcm and apns are e2ee but the app developer shouldn't see your events imo.
https://spec.matrix.org/v1.17/push-gateway-api/

2026-02-26 05:59:37 UTC

- reply

> Only the host and client/user-agent implementers have to.
that's the problem with xmpp, the users have to care too
xml is a markup language. chat messages need something like that, but the "envelope" with all the metadata is just data, it should fit into a serialized js object. it can be cbor or messagepack, i just don't think that warrants xml.
i mean, i find the syntax to be the worst part of lisp, so i disagree there, though i can definitely see why someone would prefer sxml
i don't think disabling gzip is the solution.. i mean, how do you even execute the attack? send a thousand messages to the client with all the different bodies and wait for one to match the token? with client-side e2ee, it seems like that would be pointless.. i guess it would work against cleartext if you can message the target and see its traffic at the same time, but it would be super noticeable..

2026-02-26 05:29:41 UTC

- reply

oh and iirc matrix has better push? it has to be a core feature of the protocol, not an optional extension imo.

2026-02-26 05:28:52 UTC

- reply

idk i hate matrix with passion and wouldn't use it for anything. i don't think i'd trust the server to be secure, even if isolated from federation. xmpp is certainly better, but then you have to deal with bosh and xml and all that. one thing matrix got right is that json over https is the way.

2026-02-26 05:09:05 UTC

- reply

i think so!

2026-02-24 09:05:44 UTC

- reply

this https://soatok.blog/2026/02/17/cryptographic-issues-in-matrixs-rust-library-vodozemac/
i think the bigger news than the vulnerability is how matrix has been handling it, not very well

2026-02-23 22:53:11 UTC

- reply

:KuromiConfused:

2026-02-23 20:30:00 UTC

i wonder if all this matrix drama with security and spam is gonna affect their relationship with the eu

2026-02-17 10:16:53 UTC

how is it april already??

2026-02-14 01:52:29 UTC

so i started using the journal app built into ios and macos. i never thought it's something i would do, but stranger things can happen i guess. so far it's been like fedi, except i don't have to worry about people unfollowing me. and i can write a little more freely. though i realized that most everything i don't feel comfortable sharing on fedi, i don't feel comfortable typing on a phone/computer at all.

2026-02-11 23:11:00 UTC

> CDN (basically, a network of servers that deliver content)
yeah. basically.

2026-02-11 00:26:48 UTC

- reply

it's actually fine, washing my hands a few times was probably more than enough, but the feeling is harder to wash off than the actual dirt

2026-02-11 00:25:55 UTC

cleaned something gross and now i want to get powerwashed

2026-02-10 22:21:19 UTC

- reply

no!! it's a vmware vm i have that's for a different cpu architecture so i can't boot it. so i converted it to qcow2 so i could mount it inside a different vm (cause the macos situation with fuse is very sad). i think virtfs is just unreliable, i ended up compressing the qcow2 and then decompressing it in the vm (it was hard to make sure i had enough free space for everything lol), which took like probably half an hour. but after mounting that, it worked really well, without corrupting the fs. same way, qcow2 -> nbd -> lvm -> xfs. so virtfs is the only difference.

2026-02-10 20:10:23 UTC

if i convert vmdk to qcow2, then start a utm vm and mount a host folder using virtfs, then mount the qcow2 using nbd, map the lvm group, mount the xfs partition inside the lvm group and try to copy a large amount of files, the filesystem gets corrupted and asks me to run xfs_repair, which destroys it completely and i have to remake the qcow2. i wonder why.

2026-02-09 11:51:10 UTC

- reply

i just saw this and idk
```
-stream
output the filesystem to STDOUT rather than to a file. This allows the output to be piped to another program or elsewhere with ssh. The resultant streamed Squashfs filesystem will not be a normal Squashfs filesystem because the super block will be at the end of the filesystem. But it can be fixed up afterwards with the -fix option and Unsquashfs 4.7.3 and later can read streamed unfixed up filesystems directly. Use - for the output FILESYSTEM on the command line. Duplicate detection is disabled using the -stream option.
```

2026-02-09 11:44:44 UTC

- reply

i don't think squashfs can be streamed as easily

2026-02-09 11:43:29 UTC

- reply

yeah. i knew tar is sorta fucked up from having implemented it in javascript, and i knew there's different header formats and incompatibilities between gnu and bsd, but i never thought bsd tar could create an archive incompatible with itself.
i still like it though

2026-02-09 10:43:47 UTC

fuck tar lmao bsdtar can't unpack an archive it itself created cause header too big and gnu tar tells me xattr support is not available

2026-02-09 10:04:17 UTC

- reply

outside it being mountable, what advantages does squashfs have?
the usecase i'm looking into is storing one-time (non-incremental) backups in cloud storage, mostly planning in case i need to wipe my computer to cross weird borders (and anything similar to that), so nncp or wormhole isn't an option (i usually use webrtc-based file transfer websites to send large files that don't fit into a messenger..)

2026-02-09 09:55:19 UTC

- reply

i'm thinking tar.gz.age. preserves permissions and xattrs, okayish compression, though not having a directory kinda sucks. age uses chacha20-poly1305 and scrypt if you're encrypting with a passphrase. or maybe tar.zst.age.

2026-02-09 09:48:41 UTC

- reply

have i mentioned that there's no salt either? and it's advertised as actually secure unlike zip, cause it uses aes256 😓

2026-02-09 09:28:12 UTC

til that encrypted 7z archives use 2^19 rounds of sha256 as the kdf, which doesn't sound great?

2026-02-05 08:15:55 UTC

i was thinking next time i install linux, i'm gonna do root on zfs. i didn't realize that zfs on linux is like, a real thing now and not just a tech demo. but it seems its encryption would be significantly easier to evil-maid so i'm not sure..

2026-02-05 03:54:44 UTC

```
Most people don't type their own logfiles; but, what do I care?
```

2026-02-04 00:19:47 UTC

- reply

i sleep with wife and, depending on cat's mood, cat, so i don't think that would fit the space requirements.. but i also can't imagine it being very comfortable?

2026-02-03 09:29:15 UTC

i usually sleep on my stomach and put my arms under the pillow cause it's cozy and idk what else to do with them. but that very often cuts off blood flow to my hands and i wake up from not being able to feel them. i guess the solution is probably to stop sleeping on my stomach..

2026-02-02 08:14:37 UTC

- reply

she should've tried fedi

2026-02-02 08:11:51 UTC

- reply

is that the true meaning behind brainworm pink

2026-02-02 02:46:16 UTC

- reply

no, it's not that, it's specifically while talking to a specific person..

2026-02-02 01:11:06 UTC

okay i didn't realize how strongly i'm inclined to copy the writing style of whoever i'm replying to, like, i have to fight it very hard sometimes

2025-12-27 08:14:39 UTC

- reply

i mean, surely it can make their drones better at spotting african refugees headed towards the border, so they can be stopped before they get the chance to make a legally binding request for asylum :/ except they can't just say that on fedi, cause hopefully no one here wants that.

2025-12-27 08:02:44 UTC

- reply

yes here on fedi we're so happy to hear you list AI, Quantum, drones, and space in the same sentence

2025-12-22 00:17:40 UTC

- reply

that ram won't go in regular computers :(

2025-12-11 13:46:07 UTC

i don't understand why people region-lock their app store apps

2025-12-01 10:06:56 UTC

omfg why does the python ecosystem (if you can even call it that) have to be.. like this 😭
i wish i never had to see a single line of python or pip/poetry/uv/conda/pixi command ever again

2025-12-01 09:02:27 UTC

@npub1m96…ag4y wow you literally just put ai, green tech, deregulation and fighting disinformation all in the same post
#note1w39…plsh

2025-11-30 23:07:54 UTC

> A lost generation of news consumers? Survey shows how teenagers dislike the news media
yeah i didn't like the news when i was a teenager either. tbh i'm having a hard time trying to imagine a teenager who's just stocked to read a newspaper.

2025-11-13 01:53:31 UTC

- reply

well i'm timing it from inside js which happens after semantic analysis, but that's a one-time thing and not very interesting anyway
if i disable jit in chrome, js is fairly consistently 3 times slower than my wasm module. i don't wanna try to disable jit in firefox cause i'm worried it would break things.

2025-11-13 01:43:57 UTC

- reply

i think it compiles? wdym by fewer execution steps?

2025-11-13 01:23:13 UTC

- reply

i wrote a simple wasm program to calculate something. i really like the text representation (wat), it's so much better than real assembly languages!! but my program takes twice as much time to run as the same algorithm implemented in js 😭 and that's just the actual webassembly run time, cause i also have to encode strings into its memory using a uint8array and a textencoder, and then decode them from memory using a dataview and a textdecoder.

2025-11-13 01:16:37 UTC

i changed my mind. the webassembly text representation is the best lisp :KuromiLove:

2025-11-11 22:39:23 UTC

not all political opinions are equally valid! for example, some people believe that javascript is a bad programming language. in a perfect world, such people would be shunned and excluded from every group, and die sad and alone. unfortunately, we do not live in a perfect world.

2025-10-06 06:02:33 UTC

- reply

i usually get americanos when i want a bigger drink, cause i always feel like pour-over orders are probably very annoying and i don't like batch brew. would you rather take an order for an americano or a pour-over? is it less annoying than i think?
many cafes around also have good americano, but very bitter espresso. it feels like it's made to be mixed with either milk or water.. they also often ask me twice, like, "are you sure you know what an espresso is?"

2025-10-05 11:08:14 UTC

- reply

apple is a gatekeeper let's gatekeep them back. they should be banned from bundling safari with ios and macos. it should be paid software $50 per one-device license so that if my website doesn't work in safari i don't have to care. it would be its users' own fault!!

2025-10-05 11:05:06 UTC

safari is the worst fucking browser ever i hate safari it really is the new explorer. @npub1m96…ag4y can we please just ban safari completely and ensure the chrome monopoly please 🥺

2025-08-30 08:55:57 UTC

- reply

are you saying there's a backdoor that allows apple to cause your phone to report its location to them even if the relevant settings are disabled? based on what?

2025-08-30 08:52:33 UTC

- reply

they also don't share your location with anyone unless you explicitly enable location sharing

2025-08-30 08:47:16 UTC

- reply

the absolute majority of smartphone buyers don't care about those things. if anything they care more about being able to run their bank app and get push notifications (and on midrange to flagship phones, google/apple pay), which is often incompatible with degoogling. iphones come degoogled out of the box and have e2e encrypted backups and sync for those who care.

2025-08-30 08:23:42 UTC

- reply

what can modern android phones do that neither your first android nor a modern iphone could??

2025-08-30 08:13:35 UTC

- reply

that doesn't change the fact that there's demand for them as a phone and not just a status symbol