So, I got malware that seemed to create an hidden proxy or VPN or something when I was online, without me having to install anything. I was on Fedora using Firefox in private mode with Ublock Origin and some script blocker. Ghostery, or Privacy Badger, or something. Fedora has it’s firewall enabled and blocking inbound connections, and SELinux was running. It would occasionally report small things like VLC or Clam AV wanting access to something.

It took me a little bit to realize something was wrong.

I realized it after Google started demanding repeated captcha attempts for everything, I started seeing unsuccessful attempts to sign into my Microsoft account from around the world, and some websites started blocking my IP for abuse. A few times, the blocking page (usually Cloudflare) showed that my public IP was over 240.0.0.0, in the unassigned block. My modem logs showed my machine making outbound connections to these random or impossible IPs at times that roughly lined up with my connection issues.

But if I simply hit refresh on those pages when they blocked me, the websites suddenly returned my correct residential IP address and started working again. I was slow to catch on. Hell, I hadn’t even used my Microsoft account for years, and I assumed Fedora with SELinux would alert me if anything strange was going on. It didn’t. My machine started acting weird, but I couldn’t place my finger on exactly how. I tried tools like Clam AV, or any number of intrusion detection solutions to assuage my growing paranoia. Problem is that they require some knowledge and you have to set them up before things go wrong.

Besides a terminal tool to unhide running processes, which inconsistently returned zero to dozens of unknown short-lived programs with increasingly high PIDs, nothing was detected. I later ran that unhide tool on a live USB of Fedora, and it did the same thing, so I assumed it was a false positive.

Ultimately, it was my fault, I know. I just went on a shady website to watch a TV show. Stupid, but not uncommon. My android phone also started acting strangely around the same time. I assume because I visited the same site to finish some season in bed using Firefox mobile. It’s been replaced entirely now.

But the point is that SELinux didn’t stop anything, I didn’t have to explicitly download or install anything to my machine, and it was some kind of drive-by infection that somehow added my machine to a kind of botnet, I think. Hard to tell just from the various logs I gathered from my machine and modem.

I don’t know what it was doing, but when I finally put all the pieces together, I completely wiped the drive in that machine, including a long dd operation on the drives with /dev/random. Still not sure what I’m going to do with it.

I’m also not sure if the infection was limited to Firefox itself, or if my entire machine was compromised. I may never know for sure.

While I was being stupid, I wasn’t being completely reckless and just running untrusted code from strange places. I watched TV in Firefox’s embedded video player. All it took was going to a website that I found by other people recommending it on social media. I should have known better, but I’m human.

If I can’t even visit a webpage without getting invisible botnet malware that escapes professionally configured tools like SELinux on Fedora, then how are complete newbies, or kids, or grandparents, or “know just enough to be dangerous nerds” (like me) supposed to be safe?

I agree that the user is the single biggest point of failure in security, and should be mindful. But when you’re not installing random Github packages, or turning off your firewall, or enabling SSH, and your machine can still get so easily pwned, what then?

That’s the value of anti-virus software. Yeah, it’s not perfect, but neither is your list of rules to follow. There is no single perfect approach, and people are lazy, impulsive, and sometimes drunkenly want to watch Breaking Bad. I don’t know what the solution is, but outright denying everyday antivirus seems… unwise, I guess?

Even if if takes a month for the vendor to be able to detect it, that’s still protection for anyone who comes after. It doesn’t have to be perfect to make a positive difference.

And, no: For anyone curious, I’m not going into more detail about the website.

Or even a criminal organization.

This isn’t the same thing, but I’m reminded of Minecraft.

Minecraft is a massively popular game. Notch once said he planned to make it open source when its popularity died down. But now Microsoft owns it.

Not only that, but Mojang accounts don’t work anymore. You have to have a Microsoft account to play it now. Even trying to download and play an older version of the game offline requires Microsoft to approve it. Microsoft is actively tightening the leash on the game because it makes them money. Open sourcing the game will likely never happen now. The best we can hope for it for versions to fall into public domain after 70-ish years.

That’s how I see Microsoft. They only care about what its beneficial for them to drive profits. Working on open source projects, and open sourcing a few of their tools to get the benefits of community adoption and code review is great, sure. But they’d sooner try to incorporate Linux into Windows to keep people in their surveillance ecosystem, than to open source Windows.

Remember when Windows 10 was the last version, until they changed their minds? Remember when they floated the idea of charging a recurring subscription to use Windows, before they silently dropped the idea? Remember when there was credible talk about the next version of Windows being cloud-based where they controlled all your data and you had no privacy? Hell, you have basically no privacy on Windows 10. Trying to reclaim some involves registry edits, special third party tools, and a constant battle with automatic updates reverting your changes.

I’ll say it again. Microsoft doesn’t care about OSS. It’s just currently beneficial for them to pretend they do.

Goggle seemed to care a lot about OSS, then started making everything in Android depend on their proprietary ecosystem to function. Now Google is using the dominant position they got by taking advantage of OSS adoption, and have been pushing privacy-invading standards and trying to get rid of ad blockers online, among many other things.

For these huge companies, OSS is just a tool to get more control and power. The moment it’s no longer useful, they’ll find ways to work around the license and enshitify everything again.

It keeps happening. I refuse to keep trusting bad actors every time they dangle a shiny trinket over our heads.

I do appreciate the work this person did in finding the bug. It’s not all doom and gloom.

Damn fine work all around.

I know this is an issue fraught with potential legal and political BS, and it’s impossible to check everything without automation these days, but is there an organization that trains and pays people to work as security researchers or QA for open source projects?

Basically, a watchdog group that finds exploitable security vulnerabilities, and works with individuals or vendors to patch them? Maybe make it a publicly owned and operated group with mandatory reporting of some kind. An international project funded by multiple governments, where it’s harder for a single point of influence to hide exploits, abuse secrets, or interfere with the researchers? They don’t own or control any code, just find security issues and advise.

I don’t know.

Just thinking that modern security is getting pretty complicated, with so many moving parts and all.

I’m pretty sure it was Debian in the early aughts.

They can be good quality, yeah. But I’m more worried about having to basically present a digital-equivalent of a driver’s license if I want to sign up for Netflix, or watch porn, or order food. And if ID system routes every request to a central location first, then you get stuck with de-facto tracking on everything you ever do, no matter how good the company’s privacy record is. That’s what I meant by creepy.

When I was a teen looking for a job, I checked the classified section of the newspaper. Saw a job post I thought I could do and called them. Ended up giving them some of my info, and maybe my social security number, don’t remember. All I know it I put them on hold to ask my parents a question about something, and they said “anybody can put things in the paper”. That’s when I learned that scammers just post their shit in public with little to no consequence.

At my last job, the fire system kept calling the fire department with false positives so often that they told us to fix it or the city was going to start fining the company LOTS of money. One of the dumbass HR people asked if we could just disable the fire system to prevent it from making false positives. The very patient fireman had to explain that no, we could not intentionally disable fire safety equipment in a populated building, and the company had to actually fix the broken detector.

The elevators also broke down a lot, one time with my intern inside. I called the fire department to get her out, and my boss’s boss said I should have waited longer before calling the fire department, for some reason. I forget why.

I never signed an NDA, and I think I’d be fine telling you the name of this global company. But to be safe, I won’t. I’ll just say that most of the people here have probably interacted with customer service run by this company before. I AM CERTAIN OF IT.

Same. Pass phrases seem like a solution to a problem that doesn’t exist anymore. We don’t live in a world where people should be reusing and memorizing strong passwords. We live in a world with frequent user data theft and scams to glean your login info. Just last week, I started getting random login attempts from around the world for a Microsoft account I haven’t used in over a decade. No idea when or how that info got leaked.

And people aren’t equipped to memorize a different passphrase for all 30 of their accounts.

So, we should do what we always do: Get machines to make the issue easier for us to manage. Right now, that means password managers with a strong master password and secure storage.

In the future, maybe we’ll have some kind of creepy central government ID based password-less login method. Who knows?

Edit: Besides, most services require ThIrTeEn dIgIt lOnG PaSsWoRdS WiTh fIvE SpEcIaL ChArAcTeRs aNd sIx nOn-cOnSeCuTiVe dIgItS Of pI ThAt dOeSn’t mAtCh aNy kNoWn dAtE Or eVeNt oR SpEcIaL StRiNg oF NuMbErS. It’s just too annoying, and I’d have to memorize all the special characters in addition to the phrase.

Using the internet without everyone and their grandmother spying on them and blocking access to stuff the busybodies don’t personally like.

Nice!

Needs the unified menu for the active/maximized window at the top. Else, it’s perfect.

These. Get some have that special dividers or pouches for extra comfort. So cozy.

Linux already won years ago. Linux won so thoroughly that Windows 10 includes a Linux subsystem, almost every supercomputer runs Linux or BSD, and the majority of all mobile devices use the Linux kernel.

Not too bad for a bunch of nerds sharing code. :)

Instead of each frame of animation being a grid of pixels, each frame is a small collection of math describing the visuals.

But we’d still have frames to use for animation, if we want.

Instead of replacing one PNG for another PNG to make the illusion of movement, we replace one SVG with one SVG instead.

I’m okay with being wrong, it just means I’m less wrong in the future. Thank you for the info.

I bit the bullet and was the cringy person at work who said “peeps”. After a few months of do this, it was amusing to see the word spread until my boss’s boss started saying peeps in meetings.

I’m still following an open bug report from a year ago where the desktop does weird stuff with AMD GPUs, like randomly scramble graphics or unmap half the screen for no reason.

Oh no, I got you. I was kind of looking at if from another angle.

You normally can’t buy a machine with desktop Linux pre-installed, but you can with ChromeOS. Despite that, Linux has a bigger market share. I think part of the reason why is specifically because ChromeOS is so limited and intrinsically tied to Google, that people who do things like install new OSes avoid it like the plague. Google’s push to satisfiy shareholders and build walled gardens is the reason their desktop OS isn’t being used.

I’ve installed Android in virtual machines and played with x86 builds on bare metal. I’ve installed Linux on Macbooks, desktops, servers, and handhelds. I’ve tried out BSD on network shares and other little devices. I’ve never done anything like that with ChromeOS. It holds zero appeal to me, despite being easily purchasable at a retail store.

Not gonna lie, I’ve submitted tiny feature requests to the dev team for Cinnamon and Mate before. One or two of them got implemented, and I was so … happy? proud? idk

I was such a cool feeling though. Being able to participate is very underrated.

I use Gnome 3 because of Comic-like tiling extensions, lack of random bugs and crashes (looking at you my beloved KDE), and because so many apps require GTK that it almost always gets installed by something I want to use.

I dislike using it because SO MANY features and quality of life things were removed and never reintroduced. Like, I have to make a custom bookmark for root or my Desktop folder in Nautilus, and can’t remove the default ones that I never use. Creating symlinks is disabled by default. I have to go to “other locations” and manually type in a network address because you can’t even type in the ADDRESS BAR. If too many windows are open on a tiled workspace, the lack of any reserved clickable space on the titlebar means Nautilus gets squished and I can’t drag and move a window without either moving something else first, opening the overview, or using the keyboard. Not entirely the Gnome team’s fault, but it’s little oversights like that which make the desktop a pain to use. The awful “classic mode” application menu with no ability to search or right click on entries for more options is a good example too. I have to open the mobile-like workspaces view or whatever its call to do that stuff now. I’m not on mobile, this is a desktop.

It’s like they’re trying to force me to use their cursor/touch based UX in some ways, but in others I have to use a keyboard or dig in the settings to do anything. Or maybe they’re just of the opinion that if people want features, someone will volunteer to make and maintain an extension to enable them.

Don’t get me wrong, Gnome 3 is impressive, looks good, and is generally simple to use, but I end up trying to spend so much time working around its intentional limitations, that I start to hate it a little more every day. I use it begrudgingly, waiting for something better to come along. If I was a smarter person with more time, I’d try to help the project with these papercuts, but my coding skills are crap.

But, just so I’m not beating up on them for no good reason, I’ll add that there are a ton of very nice things they created or implemented that I enjoy. The quick settings menu comes to mind; and the settings app in general is very nice.

I think the Gnome devs made a lot of good choices. I just wish they could have done so without removing so many features or trying to force a paradigm change in how I use my computer. I appreciate their work, I really do, but damn…

I love the idea of the Pinenote, but could never afford one.

Not sure, but I’ll say that if you use ChromeOS, you’re much more likely to buy special hardware (Chromebooks) to run it on. Not many people download ChromeOS to run on their pre-existing computers. But you can just slap Linux on a toaster if you really want to. Even more, Valve’s Steam Deck comes with Linux by default, and that’s basically a desktop with touch and gamepad controls in mind.

I just wish the culture around open source gave more back to the people working on the software, even if it was just businesses. I think we’d see even more delevopment and support if the one guy making a critical driver for some obscure device that only power plants use, could take a vacation or quit his day job.

People around the world depend on open source being freely available and shareable. But if you’re making millions of dollars a year, I think it’s only fair to give some money to the people making your profit possible.

Clothing stores too. Especially the “high end” ones that supposedly have their own factories just for them.

I would have an exploding corkscrew penis. I’ll find ways to entertain myself.

I see you’re a person of culture.

I was thinking of the inserted text as a user-side thing. If someone sends you an emoji, your software inserts the name of the emoji next to it for the benefit of the user. That kind of thing.

I’m of the opinion that Microsoft was tired of losing money on OpenAI, so made some kind of plan to out the current CEO, tank the stock price, and be in the perfect position to buy the company and monopolize AI technology. It wouldn’t be the first time they pulled shady crap like that.

Huh, that’s an interesting point that I never thought of before.

Do you think there would be a way to make them easier to differentiate that would make them more useful, or do you think there’s a fundamental problem with using them?

I’m thinking of workarounds like making emoji SVG to scale to whatever size you need.

Or maybe an optional setting to insert text after an emoji for users that want it. Example:

😊 (Smiling face)

What do you think?

The far future: A man sits at a table, staring at a floating hologram display. He watches as an indecipherable block of alphanumeric characters wiggles and splits into two segments. He nods slowly.

He takes a breath and closes his eyes, broadcasting a message to everyone on duty that day.

“Merge the request. Tell Linus#3418 that Wayland is now the default display manager.”

Maybe I’m just in a good mood, but I saw that and about died. Thanks for the chortle and subsequent coughing fit.

Well, they’re still working in Wayland support as far as I know. Some windows have double title bars for some reason, or extra large invisible borders. I have a portrait rotated monitor, and had trouble with wallpapers in general.

It was basically a bunch of little stuff like that, nothing major as far as I remember.

Well, they’re still working in Wayland support as far as I know. Some windows have double title bars for some reason, or extra large invisible borders. I have a portrait rotated monitor, and had trouble with wallpapers in general.

It was basically a bunch of little stuff like that, nothing major as far as I remember.

Those in power hate losing control. That’s why bodily autonomy, sexual freedom, critical thinking, accurate history, and religious diversity are all their go-to boogymen.

Trans folk are just one of the more recent groups to be targeted.

I’ve known four out trans people. One was a piece of shit. The other three turned out to be amazing and empathetic people who all made my life better just by knowing them.

It turns out, when you deal with people being entitled jerks to you all day, that tends to make you a better person. Forged in fire and all that.

These days, it’s a little bit janky while the new dev team tries to modernize it, but try out Ubuntu Unity on a live USB or something.

It’s pretty and it’s fun to use. Different, but not alien. I wouldn’t install it as a daily driver yet, but if you are having fun trying out Linux stuff, I’d say to give that desktop interface a try.

So…sex on an SSRI.

Pro: I can effortlessly last over an hour. Basically edging without trying.

Con: It’s simply impossible to finish sometimes and I just have to say it was good enough and stop. Or the mix of chemicals in my brain just don’t let me start for whatever reason. The times I can finish, I have to take over and go extra intense on myself to peak the mountain. If my partner tries, they can’t get me there.