Inbred: chaorace’s family has been a bit too familiar. (Can be inherited)

Expand?

  • 5 Posts
  • 41 Comments
Joined 1 year ago
cake
Cake day: June 10th, 2023

help-circle


  • Note that I’m specifically including “in an an instance-local post” because I am assuming admins don’t want to provide free cloud image hosting to random internet people for arbitrary non-lemmy use.

    Note that I at no point allude to hotlinking from outside of the instance. Unless you want it to be possible to create an image post, delete the post, and then have an orphaned image forever (thereby creating an attack vector), you do need to solve that problem. If you solve that problem without considering crossposts and comment hotlinks within the scope of your own instance, you’re going to cause breakage. If you’re forced to consider these things before triggering the deletion regardless, then you’re not saving much on performance.


  • What’s the practical difference? In both cases you’re culling images based on whether they’re orphaned or not.

    If you’re suggesting that the implementation be based on setting individual timers instead of simply validating the whole database at regular intervals, consider whether or not the complexity of such a system is actually worth the tradeoff.

    “Complexity comshmexity”, you might say. “Surely it’s not a big deal!”. Well… what about an image that used to belong to a valid post that later got deleted? Guess you have to take that edge case into account and add a deletion trigger there as well! But what if there were other comments/posts on the same instance hotlinking the same image? Guess you have to scan the whole DB every time before running the deletion trigger to be safe! Wait… wasn’t the whole purpose of setting this up with individual jobs to avoid doing a scripted DB scan?







  • Err… not really? Python is a mature programming language which is more-or-less the same experience to write code within compared with 2 years ago. A few comfort features might have been added in that time, but all of the core stuff has been cemented in place for quite a long time now.

    Yes, ChatGPT will struggle if you ask it something very domain-specific (e.g.: “write an example app for posting to Lemmy”), but it can be a great tutor if you stick to broader queries (e.g.: “write a boilerplate Python commandline application”, “add a --help argument to this existing argparse code”, “why am I getting an undefined variable error in this code?”)


  • chaorace@lemmy.sdf.orgtoUnixporn@lemmy.ml[bspwm] gruv
    link
    fedilink
    arrow-up
    3
    ·
    edit-2
    1 year ago

    Delicious gruvbox. Excellent choice with the focus highlight color (I do something similar).

    If you use picom, try out this shadow config I made for a similar theme. It creates a neat accent effect that complements the focus border and gives a flatter look:

    shadow = true;
    shadow-radius = 1;
    shadow-opacity = 0.50;
    shadow-offset-x = 2;
    shadow-offset-y = 2;
    shadow-color = "#211521"
    

  • I’m suggesting a whitelist, that each peer has to put in a substitute list of vlemmy.ml==vlemmy.ml to re-federate.

    I don’t see any inherent problem with that suggestion, though it does create something of a sticky situation with things like canonical links. It also kind of goes against what I’ve so far perceived as a “low-maintenance” operations ethos from the project maintainers, so I’m not totally sure if they’d greenlight it. Technically quite doable, though.



  • chaorace@lemmy.sdf.orgtoLemmy@lemmy.mlWill this also affect lemmy.ml?
    link
    fedilink
    English
    arrow-up
    14
    arrow-down
    2
    ·
    edit-2
    1 year ago

    On the technical topic of renaming a domain of a Lemmy server… I think it is worth experimenting with the code.

    This is unfortunately only possible if you still own the original domain. Think about it this way: if you could migrate domains without proving you own the original, then what’s stopping a bad actor from migrating any domain they want? Keep in mind that Federated servers rely on DNS to verify who’s who – they don’t have a backup system for deciding trustworthiness.

    Yes, there’s no technical reason Lemmy has to rely on DNS to establish trust (aside from the fact that changing this would require a massive rearchitecting effort), but why shouldn’t it? It’s possible to switch to a different trust system (i.e.: public/private keypairs), but that doesn’t actually change the nature of the problem – people can still lose control of the private key and blow the whole system up (and, arguably, this is a lot more likely to happen than permanently losing a domain).

    At minimum, I think it should be an option to try and keep the same login/passwords for users from the old install of Lemmy.

    So, login credentials aren’t actually tied to the domain name at all. A user like example@lemmy.ml is simply known as example to the server internally. The server doesn’t particularly care if it lives at lemmy.ml or microsoft.com – if user example shows up and gives the right password, they’re allowed to log in. What I’m trying to say is that – assuming that the user database isn’t destroyed – login info would probably carry over without any special effort needing to be taken at all.

    But even that could prove tricky if a particular domain changed underllying ownership more than once - and user@domain became rewritten by an entirely different person. I guess in the real-world people do often get mail for previous residence of a house.

    The identity problem you allude to is not exclusive to this scenario. Let’s use lemmy.ml as an example: where did the domain come from? The Mali government. Does this mean that the Mali government owned lemmy.ml before it became associated with the Lemmy project? At the risk of oversimplying: yes, pretty much! Prior to 2019, the government of Mali could have created “fraudulent” Fediverse posts under your username, /u/roundsparrow@lemmy.ml.

    With that being said, it’s kind of a silly concern. Despite being partially distributed, Lemmy is not a read-only database (i.e.: not a blockchain). There’s nothing stopping the current domain owner from more-or-less completely undoing vandalism from a prior domain owner by simply asking the other federated servers to delete that fraudulent content. Keep in mind that the domain is not the server; the original operator keeps all of the original data even if they lose the ability to host that data under the original domain.

    My biggest concern is legality because Lemmy claims to support privacy. I honestly think it’s a bad idea to claim privacy because you run into so many problems. If the user never knows that their lemmy instance changed names and can’t find it again, etc.

    This is not a problem unique to Lemmy. If Google forgets to pay for gmail.com, then suddenly a lot of email addresses become untrustworthy. This isn’t a privacy issue because your old emails don’t leave Google’s servers. It is a trust issue, however, since the new owners can now impersonate any gmail.com address and receive any new email that was intended for the original owner.

    Not to downplay how catastrophic this scenario would be… but I don’t think there’s any law on the books which would legally obligate Google to operate gmail.com until the end of time. Nothing lasts forever and eventually gmail.com won’t be controlled by Alphabet Inc. anymore – that’s just how time works. Those bothered by this uncertainty can instead choose to host their own mail server (or Lemmy instance) on their own domain – this won’t last forever, either… but at least you’re in control now.

    Especially on technical topics, 15+ years of having Reddit keep messages from deleted user accounts offered a lot of great search engine hits. With Lemmy, a person moving to a different instance and deleting their account, so much content is going to get black-hole in favor of 50 instances having copies of a meme post or trivial website link - and solid original content (often in comment discussions) gets removed.

    Just FYI: Much like Reddit, comments continue to exist even when the author deletes their account. The user must explicitly delete each individual comment before deleting their account if they want it all taken down. EDIT: This is not actually currently the case, though as far as I can tell the stated intent is to prefer anonymizing comments over deleting them when deleting an account (source). I don’t really get this complaint in the first place, actually… surely both kinds of content would get lost when a user deletes all of their data, right? There’s no button that says “delete all of my stuff, except for the shitposts”.



  • Js is what you make of it. It can be a godawful mess but it also can be really awesome.

    Agreed. It wasn’t always a great language, but by some miracle it eventually became pretty alright.

    But it’s also a double edged sword because that means that novices can write absolute spaghetti code in it. That’s not the fault of the language though.

    Disagree. The best languages are those which can be intuitively used without having to learn the pitfalls. Take Rust vs. C++, for example: both languages have pitfalls, but only Rust is intentionally designed to help you steer clear of them. JS is like C++ in this regard – decades of cruft have coalesced into tempting yet painful footguns, much to the chagrin of many a new learner.