chameleon

Another choice quote from the original IGN interview that this is from:

Sweeney: […] The only way that we can hope for new games coming into the market to be able to succeed when there’s so much Metcalfe’s Law at play and so many captive audiences in the really big games – you know, Fortnite, Roblox, PUBG Mobile, and a few other really huge ones – it’s got to be that those games get momentum by connecting to the economies in other games. I think that can really reinvigorate the market if people are constantly looking to new games and sources of new items that they can earn everywhere and be able to really easily move together with their friends.

Guy got talked into the whole blockchain NFT crap so hard that he’s still trying to make it happen, as if it was ever a desirable thing that the best way to get some kind of gear or cool cosmetics in game A involves playing game B instead.

To add to that, even the original paper written with 1999-2007 era SDRAM/DDR/DDR2 is not optimistic about the scenario of a machine that was already powered down at regular operating temperatures:

with the fastest exhibiting complete data loss in approximately 2.5 seconds and the slowest taking an average of 35 seconds

And that only got worse with more advanced RAM, not to mention that they lost almost all of the data far quicker than that with only a couple % of bits surviving that long. For all practical intents and purposes, cold boot against an already-powered-down machine is a myth, the cooling has to be applied while it’s on.

One example: https://aur.archlinux.org/cgit/aur.git/commit/?h=oracle-bin&id=eceeb808ef933a66285ea68cefd72c1b5f4374c9 . It seems the AUR team forcepushed the malicious commits out of the repo branches, likely to prevent being accidentally reused by git-bisect in the future, but the URLs still seem to work until they run garbage collection. The author/committer information on each affected commit impersonated a previous maintainer of that particular repository and isn’t real.

The whole thing essentially just boils down to adding a cd /tmp; npm install [random crap] post-install hook to every abandoned repository they easily got access to, which itself had a post-install hook to set up malware things. npm has nulled the affected packages, though it took them somewhere around 24 hours to do so. atomic-lockfile was one of them.

Dev post on the forum:

Just be aware that choosing works only in places where there is ambiguity due to belt being perpendicular. Those cases were the cause of problems for blueprint flip reliability.

So there’s limits to it.

I ended up wanting an online pseudonymous identity as well as an offline real-life identity, which leads to needing multiple phone numbers when things are tied to said number. That’s extremely annoying to manage, especially with Signal’s current activity and update policies that essentially require you to keep a phone in a drawer, charge it and log into it every so often or risk losing your entire account due to inactivity, as only the mobile device counts for that purpose (this might supposedly be changing).

In that particular scenario, I don’t really care if my least-favorite three-letter-agency or law enforcement can link my identities. It’s a nice bonus if they can’t, but not an absolutely required feature. The main worry is the person on the other end trivially learning it. But the person on the other end might have a different set of worries that makes Signal one of the few available options for them.

That said, Telegram also requires a phone number and has exactly the same issue, so this is a rather weird thread to bring that up.

There aren’t a lot that work well with Space Age, because overhauls are generally incompatible in terms of gameplay/balancing and Space Age itself is essentially an overhaul. Most new mods made for the Space Age era are new planets instead of overhauls, there’s Loup’s Guide to the Galaxy if you want some community-curated advice on what’s decent vs not worth the time (not a mod but it lives on the mod portal anyway).

But if you really want it, there’s a Krastorio 2 fork called Krastorio 2 Spaced Out that integrates Space Age. I think it’s about the best it can be, which is to say, I’m not a big fan of it but other people seem to like it. Nauvis is pretty much just vanilla K2 with new rocket silos while the other planets are slightly janky Space Age.

Not sure, but I can reproduce it on my end. The actual download pages on get.videolan.org have ads, the main site does not.

I’ve seen the claim around but I’m highly skeptical of it. DDR5 is far too slow for anything where memory bandwidth really matters, any newly produced chip that’s gonna be used for AI is on HBM3 or HBM3e, or possibly GDDR6/GDDR7 if it’s a GPU pulled from the consumer segment. HBM5 is still a very, very early research project and is certainly not being produced yet.

The idea is interesting, but $13/month for one ‘mystery’ album from an artist you (most likely) don’t know feels rather up there.

root= isn’t correct for booting a live image like this. You need to use some specific parameters to guide the initramfs to where it can find the /boot/x86_64/airootfs.sfs file, and in general, something like that will be the case for most distros but there are lots of unique mechanisms. Looking at the grub.cfg, /loader/entries or similar files will usually get you some things you can put into your favorite search engine to hopefully find some documentation. For Arch it’s part of mkinitcpio-archiso: https://gitlab.archlinux.org/archlinux/mkinitcpio/mkinitcpio-archiso/-/blob/master/docs/README.bootparams?ref_type=heads

I don’t have a setup to test it but if If I’m not mistaken something like this should work:

options  "archisosearchuuid=2025-08-01-13-39-26-00"

These containers are/were for self-hosting. VMWare previously owned Bitnami, it was their attempt to make it easier to self-host rather than paying a cloud provider, which should directly benefit them because VMWare got its money from businesses that self-host + self-host people growing up learning free homelab ESXi and wanting to apply that at work. It helps a lot if there’s well-maintained solutions for deploying popular stuff.

Then Broadcom bought VMWare for a ridiculous price and is doing none of that.

Tends to change by playthrough but 50% water scale/150% water coverage/~200% resource frequency+size+richness is my go-to. Creates lots of natural chokepoints, available resources end up feeling like they’re similar to default map settings, gives you enough area to build a reasonable bus starter base at the start but eventually pushes towards a more train spaghetti playstyle.

scripts mix configuration with logic and this was a big reason why a lot of distributions switched to systemd in the first place

What was really wrong with the old BSD-style rc/init systems is that they mixed configuration with the logic required to start/stop the service at all, and that that logic was running in the same session it was being executed from (inheriting the environment, FDs and the like). These daemontools-style supervisors don’t have that problem, the run script is essentially just systemd’s ExecStart= and it gets forked off from the supervisor itself and is then managed by it. Lots of them are just #!/bin/sh \n exec coolservice.

There’s plenty more things that systemd does pretty well that this doesn’t do (dependency management seems to be sorely lacking here in particular), but this kind of approach is much closer to it than the old rc scripts.

All true, wanted to add on to this:

Note that smart peeps say that the docker socket is not safe as read-only.

That’s true, and it’s not just something mildly imperfect, read-only straight up does nothing. For connecting to a socket, Linux ignores read-only mount state and only checks write permission on the socket itself. Read-only would only make it impossible to make a new socket there. Once you do have a connection, that connection can write anything it wants to it. Traefik and other “read-only” uses still have to send GET queries for the data they need, so that’s happening for legitimate use cases too.

If you really need a “GET-only” Docker socket, it has to be done with some other kind of mechanism, and frankly the options aren’t very good. Docker has authorization plugins that seem like too much of a headache to set up, and proxies don’t seem very good to me either.

Or TLDR: :ro or stripping off permission bits doesn’t do anything aside from potentially break all uses for the socket. If it can connect at all, it’s root-equivalent or has all privileges of your rootless user, unless you took other steps. That might or might not be a massive problem for your setup, but it is something you should know when doing it.

The modern breed of CAPTCHAs is mostly only trying to verify that it’s a full-fat browser. undetected-chromedriver, camoufox, pydoll, patchright and a million other libraries/tools exist. Nothing’s perfect and it’s a cat & mouse game, but this single incident is a sample size of one as well.

https://ec.europa.eu/commission/presscorner/detail/en/ip_25_1339

Everything regarding enforcement is early stages but what they’re aiming for is much more specific than chat control and is based on existing wording in the Digital Services Act.

Then it can’t be booted with new media. Microsoft has been very, very slow with the automatic rollout of their own key updates, and made just about no progress over the past two years. It’s been manual updates + newly produced systems only.

The trick here is that they have a key-exchange-key that can be used to update the other keys. That doesn’t expire (or rather, not in a meaningful way). But, a Windows image is still only going to boot on a system that trusts the key that was used for it. If you make a Windows image on a 2011 system now, it’s going to be signed with the 2011 key, and it won’t boot on a system that distrusts that key. The same is true in reverse.

Their key update documentation is all available and some enterprises have been on the new key for a while, but it’s a lot of manual work and a lot of problems have popped up, most documented in there. How they’re going to roll this out automatically to normal users isn’t obvious to me. There’s technically nothing stopping a system from trusting both the 2011 and 2023 keys, and I wouldn’t be entirely surprised if they end up never pushing the 2011 revocation.

The keys they use for their own OS don’t truly expire until late 2026, and I expect they’ll do their best to delay it until then, but the next time they have to update their boot manager is going to be painful and introduce all kinds of new problems.

There’s a disclaimer in the readme: https://github.com/juanfont/headscale/?tab=readme-ov-file#disclaimer

The maintainer Tailscale contributes happens to be the lead developer by commit count at the moment.

They also had a major ass security issue that a security company should not be able to get away with the other day: assuming everyone with access to an email domain trusts each other unless it’s a known-to-them freemail address. And it was by design “to reduce friction”.

I don’t think a security company where an intentional decision like that can pass through design, development and review can make security products that are fit for purpose. This extends to their published client tooling as used by Headscale, and to some extent the Headscale maintainer hours contributed by Tailscale (which are significant and probably also the first thing to go if the company falls down the usual IPO enshittification).

I haven’t seen proper reporting but the Play Integrity install source thing is accurate. There’s a reasonably good overview straight from the devil himself.

Lots of things that have very valid reasons on paper that also just happen to give Google a stupid amount of control and will backfire for a somewhat small percentage of people in very bad ways. We’ve been at “you can’t use pretty much any bank unless you agree to either Google or Apple terms” for quite some years now, now we’re giving those same app developers ways to detect if their device has accessibility APIs enabled (useful to protect against bot farms, but also a functional check for “you’re able-bodied”) or is in security support (also a functional check for “not reliant on hand-me-downs”).