The article explains the infographic and adds a lot more context.

The amount of arsenic depends on location - if you’re in a region that has standards on arsenic levels, like the EU, UK, or the US, then you’re probably fine, but the levels may be higher than what’s considered safe for children. This method would allow you to reduce the levels by around 50%, and since the levels for children are a bit under half of what’s acceptable for adults, that’s likely to make it safe for them.

The time savings are relative to other methods for reducing arsenic content, like cooking it with excess water (like a 12:1 ratio) and then discarding the excess, as this method allows you to use a rice cooker for the remaining time and to cook with a much smaller water:rice ratio, even accounting for the discarded water.

Eligible libraries, archives, and museums have a few exemptions to the DMCA’s anti-circumvention clauses that aren’t available to ordinary citizens, but these aren’t unique to the Internet Archive. For example:

Literary works, excluding computer programs and compilations that were compiled specifically for text and data mining purposes, distributed electronically where:

(A) The circumvention is undertaken by a researcher affiliated with a nonprofit institution of higher education, or by a student or information technology staff member of the institution at the direction of such researcher, solely to deploy text and data mining techniques on a corpus of literary works for the purpose of scholarly research and teaching;

(B) The copy of each literary work is lawfully acquired and owned by the institution, or licensed to the institution without a time limitation on access;

© The person undertaking the circumvention views the contents of the literary works in the corpus solely for the purpose of verification of the research findings; and

(D) The institution uses effective security measures to prevent further dissemination or downloading of literary works in the corpus, and to limit access to only the persons identified in paragraph (b)(5)(i)(A) of this section or to researchers or to researchers affiliated with other institutions of higher education solely for purposes of collaboration or replication of the research.

This exemption doesn’t allow them to publish the content, though, nor would it provide them immunity to takedown requests, if it did.

These exemptions change every three years and previously granted exemptions have to be renewed. The next cycle begins in October and they started accepting comments on renewals + proposals for expanded or new exemptions in April, so that’s why we’re hearing about companies lobbying against them now.

Dunno, I think regardless of the method used by the extension, I think any extension called “Bypass Paywalls” that does what it says on the tin can pretty unambiguously be said to be designed to circumvent “technological protection measures”.

“Bypass” and “Circumvent” are nearly synonymous in some uses - they both mean “avoid” - but that’s not really the point.

From a legal perspective, it’s pretty clear no circumvention of technological protection measures is taking place*. Yes, bypassing or circumventing a paywall to get to the content on the site itself would be illegal, were that content effectively protected by a technological measure. But they’re not doing that. Rather, a circumvention of the entire site is occurring, which is completely legal (an obvious exception would be if they were hosting infringing content themselves or something along those lines, but we’re talking about the Internet Archive here).

* - to be clear, I’m referring to what was detailed in the request, not the part that was redacted. That part may qualify as a circumvention.

In this case, it circumvents the need to login entirely and obviously it circumvents the paywall.

Following the same logic, Steam could claim that a browser extension showing where you can get the same game for cheaper or free circumvents their technological protection measure. It doesn’t. It circumvents the entire storefront, which is not illegal.

That’s the same thing that’s happening here - linking to the same work that’s legally hosted elsewhere.

Though as you said, these guys should probably be sending DMCAs to the Internet Archive

Yes - if they don’t want their content available, that’s what they should do. They might not want to do that, because they appreciate the Internet Archive’s mission (I wonder if it’s possible to ask that content be taken down until X date, or for content to be made inaccessible but for it to still be archived?) or they might be taking a multi pronged approach.

Maybe archive.today is the problem? Maybe they don’t honor DMCA requests.

Good point. If so, and if their site isn’t legally compliant in the same ways, then the extension becomes a lot less legally defensible if it’s linking there. That’s still not because it’s circumventing a technological protection, though - it’s because of precedent that “One who distributes a device with the object of promoting its use to infringe copyright, as shown by clear expression or other affirmative steps taken to foster infringement, going beyond mere distribution with knowledge of third-party action, is liable for the resulting acts of infringement by third parties using the device, regardless of the device’s lawful uses,” (Source), where “device” includes software. Following that precedent, plaintiffs could claim that the extension promoted its use to infringe copyright based off the extension’s name and that it had knowledge of third-party action because it linked directly to sites known to infringe copyright.

The Digital Media Law Project points out that there are two ways sharing links can violate the DMCA:

• Trafficking in anti-circumvention tools - which is obviously not what’s going on here
• Contributory copyright infringement - which is basically doing something described by the precedent I shared above.

I’m not sure how the extension searches web archives. It if uses Google, for example, then it would make sense to serve Google ae DMCA takedown notice (“stop serving results to the known infringing archive.piracy domain”), but if the extension directly searches the infringing web archive, then the extension developers would need to know that the archive is infringing. Serving them a DMCA takedown (“stop searching the known infringing archive.piracy domain”) would give them notice, and if they ignored it, it would then be appropriate to send the takedown directly to their host (Github, the browser extension stores, etc) citing that they had been informed of the infringement of a site they linked to and were de facto committing contributory infringement themselves.

Given that they didn’t do that, I can conclude one of the following:

1. The lawyers are incompetent.
2. The lawyers are competent and recognize that engaging in bad faith like this produces faster results; if this is contested they’ll follow up with something else, possibly even the very actions I described.
3. The archives that are searched by the extension aren’t infringing and this was the best option the lawyers could come up with.

How is the accused project designed to circumvent your technological protection measures?

The identified Bypass Paywalls technology circumvents NM/A’s members’ paywalls in one of two ways. [private]

For hard paywalls, it is our understanding that the identified Bypass Paywalls technology automatically scans web archives for a crawled version of the protected content and displays that content.

If the web archives have the content, then a user could just search them manually. The extension isn’t logging users in and bypassing your login process; it’s just running a web search for them.

while (true) { print money; }

Someone’s never heard of Bitcoin

Each credit reporting agency offers this option, at no charge …

It is highly recommended to lock your credit. Frankly, it should be locked by default. In September of 2017, Equifax announced a data breach that exposed the personal information of 147 million people.

Note that, before this incident, it wasn’t consistently free. I remember it being free to lock, but costing $20 or so to unlock. A law passed in 2018 required credit bureaus to offer freezes and unfreezes (and to fulfill them within certain time frames) for free.

Also note that you might need to look for a “freeze” instead of a lock. Experian charges $25/month for their “CreditLock” service, for example, but they offer a free security freeze.

I use --format-sort +res:1080, which, if my understanding of the documentation is correct, will make it prefer 1080p, the smallest video larger than 1080p if 1080p isn’t available, or the largest video if nothing 1080p or larger is available.

res is the smallest dimension of the video (so for a 1080x1920 portrait video, it would be 1080).

Default sort is descending order. The + makes it sort in ascending order instead.

Does your script handle bi-directional sync or one-way only?

What makes sourcehut better?

From a self-hosting perspective, it looks like much more of a pain to get it set up and to keep it updated. There aren’t even official Docker images or builds. (There’s this and the forks of it, but it’s unofficial and explicitly says it’s not recommended for prod use.)

Yes, but only in very limited circumstances. If you:

1. fork a private repo with commit A into another private repo
2. add commit B in your fork
3. someone makes the original repo public
4. You add commit C to the still private fork

then commits A and B are publicly visible, but commit C is not.

Per the linked Github docs:

If a public repository is made private, its public forks are split off into a new network.

Modifying the above situation to start with a public repo:

1. fork a public repository that has commit A
2. make commit B in your fork
3. You delete your fork

Commit B remains visible.

A version of this where step 3 is to take the fork private isn’t feasible because you can’t take a fork private - you have to duplicate the repo. And duplicated repos aren’t part of the same repository network in the way that forks are, so the same situation wouldn’t apply.

Misleading title.

The title literally spells out the concern, which is that code that is in a private or deleted repository is, in some circumstances, visible publicly.

What title would you propose?

If my thing was public in the past, and I took it private, the old public code is still public.

The “Accessing Private Repo Data” section covers a situation where code that has always been private becomes publicly visible.

Doesn’t their API also require you to allow-list IPs, making it basically useless for dynamic DNS?

From https://www.namecheap.com/support/api/intro/ under “Whitelisting IP.”

But being rude and abusive to support staff doesn’t help, encourage, or even compel the support staff do their jobs any better or faster. In fact, I’d wager it’s rather the opposite.

I work in IT (not IT support, though) and I’m fortunate enough that none of my business partners are outright abusive. Even so, I still have some that I deprioritize compared to others because working with them is a pain (things like asking for project proposals to solve X problem and never having money to fund them). If someone was actively rude to me when I had fucked up, much less when I was doing a great job, I can guarantee I wouldn’t work any better or faster when it was for them.

Reverse proxies aren’t DNS servers.

The DNS server will be configured to know that your domain, e.g., example.com or *.example.com, is a particular IP, and when someone navigates to that URL it tells them the IP, which they then send a request to.

The reverse proxy runs on that IP; it intercepts and analyzes the request. This can be as simple as transparently forwarding jellyfin.example.com to the specific IP (could even be an internal IP address on the same machine - I use Traefik to expose Docker network IPs that aren’t exposed at the host level) and port, but they can also inspect and rewrite headers and other request properties and they can have different logic depending on the various values.

Your router is likely handling the .local “domain” resolution and that’s what you’ll need to be concerned with when configuring AdGuard.

They probably have experience with Spring

If your Java dev is using Jackson to serialize to JSON, they might not be very experienced with Jackson, or they might think that a Java object with a null field would serialize to JSON with that field omitted. And on another project that might have been true, because Jackson can be configured globally to omit null properties. They can also fix this issue with annotations at the class/field level, most likely @JsonInclude(Include.NON\_NULL).

More details: https://www.baeldung.com/jackson-ignore-null-fields

Is it possible to force a corruption if a disk clone is attempted?

Anything that corrupts a single file would work. You could certainly change your own disk cloning binaries to include such functionality, but if someone were accessing your data directly via their own OS, that wouldn’t be effective. I don’t know of a way to circumvent that last part other than ensuring that the data isn’t left on disk when you’re done. For example, you could use a ramdisk instead of non-volatile storage. You could delete or intentionally corrupt the volume when you unmount it. You could split the file, storing half on your USB flash drive and keeping the other half on your PC. You could XOR the file with contents of another file (e.g., one on your USB flash drive instead of on your PC) and then XOR it again when you need to access it.

What sort of attack are you trying to protect from here?

If the goal is plausible deniability, then it’s worth noting that VeraCrypt volumes aren’t identifiable as distinct from random data. So if you have a valid reason for having a big block of random data on disk, you could say that’s what the file was. Random files are useful because they are not compressible. For example, you could be using those files to test: network/storage media performance or compression/hash/backup&restore/encrypt&decrypt functions. You could be using them to have a repeatable set of random values to use in a program (like using a seed, but without necessarily being limited to using a PRNG to generate the sequence).

If that’s not sufficient, you should look into hidden volumes. The idea is that you take a regular encrypted volume, whose free space, on disk, looks just like random data, you store your hidden volume within the free space. The hidden volume gets its own password. Then, you can mount the volume using the first password and get visibility into a “decoy” set of files or use the second password to view your “hidden” files. Note that when mounting it to view the decoy files, any write operations will have a chance of corrupting the hidden files. However, you can supply both passwords to mount it in a protected mode, allowing you to change the decoy files and avoid corrupting the hidden ones.

It sounds like you want these files to be encrypted.

Someone already suggested encrypting them with GPG, but maybe you want the files themselves to also be isolated, even while their data is encrypted. In that case, consider an encrypted volume. I assume you’re familiar with LUKS - you can encrypt a partition with a different password and disable auto-mount pretty easily. But if you’d rather use a file-based volume, then check out VeraCrypt - it’s a FOSS-ish [1], cross-platform tool that provides this capability. The official documentation is very Windows-focused - the ArchLinux wiki article is a pretty useful Linux focused alternative.

Normal operation is that you use a file to store the volume, which can be “dynamic” with a max size or can be statically sized (you can also directly encrypt a disk partition, but you could do that with LUKS, too). Then, before you can access the files - read or write - you have to enter the password, supply the encryption key, etc., in order to unlock it.

Someone without the password but with permission to modify the file will be capable of corrupting it (which would prevent you from accessing every protected file), but unless they somehow got access to the password they wouldn’t be able to view or modify the protected files.

The big advantage over LUKS is ease of creating/mounting file-based volumes and portability. If you’re concerned about another user deleting your encrypted volume, then you can easily back it up without decrypting it. You can easily load and access it on other systems, too - there are official, stable apps on Windows and Mac, though you’ll need admin access to run them. On Android and iOS options are a bit more slim - EDS on Android and Disk Decipher on iOS. If you’re copying a volume to a Linux system without VeraCrypt installed, you’ll likely still be able to mount it, as dm-crypt has support for VeraCrypt volumes.

• 1 - It’s based on TrueCrypt, which has some less free restrictions, e.g., c. Phrase "Based on TrueCrypt, freely available at http://www.truecrypt.org/" must be displayed by Your Product (if technically feasible) and contained in its documentation.”

That’s still a single point of failure.

So is TLS or the compromise of a major root certificate authority, and those have no bearing on whether an approach qualifies as using 2FA.

The question is “How vulnerable is your authentication approach to attack?” If an approach is especially vulnerable, like using SMS or push notifications (where you tap to confirm vs receiving a code that you enter in the app) for 2FA, then it should be discouraged. So the question becomes “Is storing your TOTP secrets in your password manager an especially vulnerable approach to authentication?” I don’t believe it is, and further, I don’t believe it’s any more vulnerable than using a separate app on your mobile device (which is the generally recommended alternative).

What happens if someone finds an exploit that bypasses the login process entirely?

Then they get a copy of your encrypted vault. If your vault password is weak, they’ll be able to crack it and get access to everything. This is a great argument for making sure you have a good vault password, but there are a lot of great arguments for that.

Or do you mean that they get access to your logged in vault by compromising your device? That’s the most likely worst case scenario, and in such a scenario:

• all of your logged in accounts can be compromised by stealing your sessions
• even if you use a different app for your 2FA, those TOTP secrets and passkeys can be stolen - they have to be on a different device
• you’re also likely to be subject to a ransomware attack

In other words, your only accounts that are not vulnerable in this situation solely because their TOTP secret is on a different device are the ones you don’t use on that device in the first place. This is mostly relevant if your computer is compromised - if your phone is compromised, then it doesn’t matter that you use a separate password manager and authenticator app.

If you use an account on your computer, since it can be compromised without having the credentials on device, you might as well have the credentials on device. If you’re concerned about the device being compromised and want to protect an account that you don’t use on that device, then you can store the credentials in a different vault that isn’t stored on your device.

Even more common, though? MITM phishing attacks. If your password manager verifies the url, fills the password, and fills your TOTP, then that can help against those. Start using a different device and those protections fall away. If your vault has been compromised and your passwords are known to an attacker, but they don’t have your TOTP secrets, you’re at higher risk of erroneously entering them into a phishing site.

Either approach (same app vs different app) has trade-offs and both approaches are vulnerable to different sorts of attacks. It doesn’t make sense to say that one counts as 2FA but the other doesn’t. They’re differently resilient - that’s it. Consider your individual threat model and one may be a better option than the other.

That said, if you’re concerned about the resiliency of your 2FA approach, then look into using dedicated security keys. U2F / WebAuthn both give better phishing resistance than a browser extension filling a password or TOTP can, and having the private key inaccessible can help mitigate device compromise concerns.

If you only need one factor to log into your password manager, you’re doing it wrong.