A left-wing podcast for better technology and a better world.
Paris Marx is joined by Kate Green and Milo to discuss how Elon Musk’s DOGE is dismantling the US Digital Service and the consequences that has on really improving service delivery in government.
An eventful few weeks for Wordpress, WP Engine, and Automattic. Every time I've sat to write a few lines about this, I've had to start over, as the situation has rapidly evolved. WP Engine sent a cease and desist to Automattic, and later sued the parent company of tumblr, and its founder Matt Mullenweg. Mullenweg has a history of responding to criticism in what I would call an unprofessional manner, using not only his own social channels, but those of the Wordpress Foundation. It is unfortunate to see another fracture in the open source space where users are victim to petty squabbles from those in positions of leadership. especially when some of those are inclined to act the way Mullenweg has.
Evolving Github Issues. Yay subissues and advanced search!
15 year old hacker exposed a zendesk backdoor impacting a large swathe of F500 companies after the company declined to pay out associated bug bounties. its a shame that what should be a good relationship between bug hunters, especially ones showing a lot of promise in the early stages of their career, are met with such a poor disclosure / payout process. not to mention the latent financial impact of your product being known for not engaging with security researchers. zendesk has posted their own "retrospective" on the topic.
I'm a big fan of wizards-as-programmers, but I think it's so much better when you lean into programming tropes.
A spell the wizard uses to light the group's campfire has an error somewhere in its depths, and sometimes it doesn't work at all. The wizard spends a lot of his time trying to track down the exact conditions that cause the failure.
The wizard is attempting to create a new spell that marries two older spells together, but while they were both written within the context of Zephyrus the Starweaver's foundational work, they each used a slightly different version, and untangling the collisions make a short project take months of work.
The wizard has grown too comfortable reusing old spells, and in particular, his teleportation spell keeps finding its components rearranged and remixed, its parts copied into a dozen different places in the spellbook. This is overall not actually a problem per se, but the party's rogue grows a bit concerned when the wizard's "drying spell" seems to just be a special case of teleportation where you teleport five feet to the left and leave the wetness behind.
A wizard is constantly fiddling with his spells, making minor tweaks and changes, getting them easier to cast, with better effects, adding bells and whistles. The "shelter for the night" spell includes a tea kettle that brings itself to a boil at dawn, which the wizard is inordinately pleased with. He reports on efficiency improvements to the indifference of anyone listening.
A different wizard immediately forgets all details of his spells after he's written them. He could not begin to tell you how any of it works, at least not without sitting down for a few hours or days to figure out how he set things up. The point is that it works, and once it does, the wizard can safely stop thinking about it.
Wizards enjoy each other's company, but you must be circumspect about spellwork. Having another wizard look through your spellbook makes you aware of every minor flaw, and you might not be able to answer questions about why a spell was written in a certain way, if you remember at all.
Wizards all have their own preferences as far as which scripts they write in, the formatting of their spellbook, its dimensions and material quality, and of course which famous wizards they've taken the most foundational knowledge from. The enlightened view is that all approaches have their strengths and weaknesses, but this has never stopped anyone from getting into a protracted argument.
Sometimes a wizard will sit down with an ancient tome attempting to find answers to a complicated problem, and finally find someone from across time who was trying to do the same thing, only for the final note to be "nevermind, fixed it".
"This spell causes the hair to fall off cats." "It works with my tome"
"This spell causes the hair to fall off cats." "That's fixed in Xaranthius' latest publication, you just have to rewrite your entire spellbook for compatibility."
"This spell causes the hair to fall of cats." "Magister Olaus of Writhington uses it to help with his allergies. WORKING AS INTENDED."
I want to see wizards snarking at each other over different magical languages/scripts, the same way programmers do it over different languages.
Sure, "High Tower is a powerful language, but it's such a pain to write. I just use Unity* as it's simple to write and can do nearly everything I need" "cranky because you can't memorize all the conjugations and declensions, aren't you?" "LOOK MAN, I CAN MEMORIZE ANYTHING, INCLUDING THE FACE OF YOUR MOTHER IN ECSTASY. IN FACT, BEHOLD!" *a little time window appears between them, demonstrating exactly that. The first wizard (seen through the window) turns around and winks at the "camera".
"you kids today with your lizardman. How can you get anything done in a language without gendered pronouns? It's like fingerpainting. Sure you can learn on it but once you've got the basics you should switch over to a REAL language"
"the Kalic have been here already. We better get out before the rest of their army marches in." "how can you be sure?" "you see that teleport?" "no" "well, if you COULD see it, you'd see it's written in Adevic Yevi. That's the Kalic magic language." "couldn't it be someone else? We saw those Monon traders, maybe one of them..." "no. No one writes Adevic Yevi unless they're being paid to. It's a language written by committee."
Wizards going on a quest to get the spellbooks for a lost spell, only to find out that it was written in skydove cant. No one can read that shit! The creator must have been one of those weird "functional wizards". (They're obsessed with making sure their spells have no side effects)
There's a small library on the outskirts of Freeport which tries to collect versions of basic spells in every language. The Adevic Yevi version of "fireball" takes up 7 pages, mostly boilerplate setting up the interfaces with fire and explosions and ExplodingMagicalBallFactorySingletons. The Lizardman version is basically "AHAHAHA, YOU GO BOOM!"
There's a bunch of wizard apprentices working on porting an old "Summon Bread and Fishes" spell from the absolutely archaic language it was written in. Once it's in Unity, it'll be easy to modify and teach to more wizards, which'll obviously be good for disaster areas. It's just too expensive to keep paying the ancient guys who can still do magic in TRAN-FOR.
Eccentric wizards keep inventing new languages for spells. You look at them and they're neat, but it'll never catch on. And either you're right, or the next time you're applying to be a court wizard, the advisors want to know if you have at least 5 years experience in Tilted Runic and you're like "it only came out 2 years ago!" "aren't you a chronomancer?" "oh good point. Yeah I've been using it for 20-30 years."
There's wizards who will spend incredible amounts of time doing silly things with spells in strange ways. There's this guy (Vorth) who made his own language where there's only one basic spell: fireball. Everything else is basic magic glue tying multiple fireballs together. So like, he's got a breakfast spell. Stand back (good advice for all his spells), and you'll see a fish get knocked out of the local pond, flung through the air by successive explosions, and eventually it lands on his plate, nicely cooked and deboned, if slightly charred (the glass of milk is harder to explain). His magical door locks involve a quicksilver sphere and molten lead changing shape when heated... It's tricky but it seems to work. He's working on a teleport spell, but so far it's mainly just killed test subjects (primarily sheep from a nearby farm).
* so the funny thing here is that this isn't a reference to the unity game engine. The main country in my One Hundred and One Magical Pistols setting is called "the union" and their language is called "unity".
Wanders are like "they're available everywhere and once you learn how to do it it's so powerful!"
Staffguys always talk about how you can do ANYTHING with a staff. Wanders claim it's a pain to carry around an overpowered device that can do ANYTHING when you just need to cast fireball or a simple one man teleport.
Meanwhile the bare wizards are showing off how they don't need any magical tools and can just do hand motions.
Wanders and staffguys retort that when a spell goes wrong, THEY need to go to store for a new magical tool. YOU need new hands.
You've perfected a spell with your staff and once you start sharing it with others they tell you it keeps failing. You work tirelessly to figure out why only to try it with a different staff and finally reproduce the issues. Turns out your original staff had a wyvern whisker embedded.
You try to share a spell both wand users and staff users but discover they both have different built in component handling. Suddenly your simple world doubles in size to handle all the differences. Hand users will need to figure out their own component system... but they're used to that.
The new pit viper school is cool and so but you just NEED to be able to do a micro material shift somewhere in your spells or else it's just not efficient enough. And pit viper doesn't let you do it.. they say it's for safety, but you've already taken enough fireballs to the foot, you know how to avoid them.
You hear about some well respected long standing wizardry city that there's a group of wizards who's entire job is to ensure the spells component lists will work across the cities various and and staff brands.
We only use wands here. We tried letting someone use a staff once but none of the basic spells we made for the job worked for them. Hands? Hahahahahahahahahahahaha.
interesting reads from the week of 16 september 2024
How Intel lost Playstation's business
"Juice" in user/player experience
How Discord Reduced Websocket Traffic by 40%
Inside Annapurna Interactive's Mass Walkout: Internal Politics, the Surprise Remedy Deal, and Why It All Happened
Not Strictly Tech - TW mental health, addiction, self harm He needed mental health care. He found a ghost network. If you need to talk, the 988 Lifeline is here.
intersting reads from the week of 2 septemeber 2024
Yubico issues security advisory for YubiKey series 5 Ninjalab's Writeup: https://ninjalab.io/eucleak/
Microsoft confirms to the Verge that the ability to disable Copilot via Windows Features is a bug It's unclear for now if the ability to uninstall Copilot will be removed entirely. EU regulations would likely require the option to be present in copies of Windows sold in that region.
404 Media, in collaboration with Court Watch, show a track record of Google employees keeping their internal communications "off record" Check out Court Watch: https://www.courtwatch.news/subscribe?ref=404media.co
Malaysia mandates ISPs redirect DNS Users in the country report using a pihole or similar service allows them to access sites censored by their ISP
a deeper dive into the pcTattletale data leaked last week reveals a massive potential fraud scheme affecting Wyndham hotels, closely matching a past scheme against Choice hotels
Wyndham would be at least the second hotel chain hit with this
Passwords. Everyone hates them. The multi-factor authentication experience has improved over the past few years, but it can still be cumbersome to copy a text or code on your phone to whatever device you're trying to log into. How can we improve on the experience further? An answer to easy multi-factor auth: passkeys.
source: xkcd
Let's step back and understand what MFA is. A few common examples of authentication factors include:
something you have (like a passkey, or a debit card, or your phone)
something you know (like a password or a pin)
something you are (like a fingerprint or other biometrics)
Commonly today you may use a combination of the first two. One example is using an ATM: you have your debit card, and you know your pin. For online accounts you typically know your password and you utilize your phone to receive a Time-based one-time password via SMS or an app. Windows users may be familiar with Windows Hello. Using a physical passkey such as a Yubikey allows you to log in with a single pin and your key, skipping typing in your password entirely.
I personally have used a yubikey for a couple of years. When I was first setting them up, I ran into some bumps, but the experience has vastly improved as more services adopt support of FIDO2-compliant passkeys. When Red Hat recently announced that RHEL 9.4 would support passkey auth, I was excited to test out the experience. My sidekick Aya agreed to help.
Aya and her new passkey.
setup
To test out this feature we need an identity management system (IdM), and a hardware token. This will give us the ability to set up some centrally managed users. I've set up a lab with two RHEL 9.4 hosts, one server and one client, and utilized the freeipa ansible collection to install some ansible roles to set up the FreeIPA environment. Red Hat has more details about how to use these roles on RHEL in their docs. My playbooks are up on github for reference.
For testing purposes, I'll be setting these hosts with the domain lan.example.com. Both live in a mini-pc I use for testing, which has USB-C ports. In my hypervisor, I pass one of those ports through to the hosts, so that we can use the passkey. A more practical every-day example could make use of something like the spice protocol to redirect the USB device remotely.
Logged into idm server, we need to authenticate as an admin so that we can create our test user. Once we're logged in, we can create an account named aya for testing. We'll add and register a passkey for her.
Now Aya has a passkey tied to her account. Let's jump over to the passwordless-client, and have her log in. We're asked for her pin, once entered, the passkey flashes to prompt us to touch it. The key is booped, and we're in! Now Aya is enabled to log into any services connected to my IDM with just her pin and the passkey. Goodbye, passwords!
login successful, I just didn't give her a home directory on this host.
Works in the GUI too!
This is a simple example, but I'm excited to think about how much easier this could make my workday. While testing I was able to ssh between hosts using the key and pin as well. In the real world, I could, instead of having to fetch different passwords, have my token plugged into my workstation. If my environment's IDM system is aware of what accounts I should have access to, I could easily log into them without having to type passwords at all.
Thank you to Red Hat for the docs and support, and thank you to Yubico for providing hardware passkeys for testing.
thank you everyone for the kind words. also thanks to at least two of the tumblr engineers who followed me from this (if you're reading this add code formatting to the editor please)
I turned this off basically the same night that I deployed it, it was just a fun gimmick that was extremely distracting and used a BUNCH of receipt paper. here's what I'm doing with the receipt printer now
whenever I am feeling bad I look at the notes to this post and get an instant self esteem boost. genuinely, thank you for the kind words. it helps me care about doing other dumbass projects in the future
do you enjoy troubleshooting problems such as packet loss on a host? have you ever viewed a network architecture with a mix of horror and awe? tunnet may be the game for you! I'll be going live January 5th at 6:30pm ET to build some networks. tune in at https://www.twitch.tv/leocantus
Build, debug and optimize a computer network in an underground facility.
jbbartram-illu
snowghoul
tangentwithtanner
andulkaphoto
kianamaiart
izzy806
