Maid Café (メイド喫茶)

Hakase

12:00 AM

agriculture

damn this packed of meat looks and smells like cat food

I like cat food but this is smaller and not as flavorful

btw our cat's food is human food

both cat and dog just eat what we eat

(plot twist: we all eat cat food)

кяαzєя

12:22 AM

forest

12:41 AM

@Hakase Home connections kind of need public IPs to function.

Hakase

well they usually get nat punchthrough or whatever it's called

but you can't reach them by that ip

I'm talking about a situation where you can

forest

Oh. Then it depends on whether or not you run any services on any of your computers.

Like NAT isn't meant to be a security measure, and IPv6 in fact doesn't even use NAT.

Hakase

huh

so are all ipv6 addresses "public"?

forest

Like I can reach my computer through SSH over the internet and that's not a security issue (at least in this case since I use public key auth).

In the sense that they aren't usually behind NAT, yeah.

Taisho

Hakase

12:44 AM

huh… so it doesn't depend on ip version but on how your ISP is managing your connection's outwards visibility

forest

It depends on your router, not your ISP.

It's your router that manages NAT and such (though of course, an ISP with IPv6 is gonna give you more addresses to allow you to not need to use NAT).

Hakase

as far as I know, you can't just assign yourself an IP address and expect the ISP to provide you service

if you're on a cheaper plan, you get rotated local IPs and nobody outside can call your 192.168.x.x or something and reach you

forest

Right, you have to use an IP in the range you've been given. For IPv4 most people get a /32 (aka one IP address). For IPv6, your ISP will give you a really huge number and you can use any of them.

Hakase

but will they do that by default?

forest

For IPv6? Probably. They have no need to hold back at all since IPv6's address space is so damn huge.

Hakase

12:48 AM

isn't there an authority which rules over ipv6 addresses the same way there is for ipv4 and as a result the ISP has a limited range of IPs to give out to its customers?

forest

Yeah it's called class networking.

Hakase

I mean I'd have to check with my ISP to know for sure which options I have

forest

But the difference is that IPv6 has so many addresses that they are incredibly cheap. You can get a million without even knowing it.

Of course, they'll all be in the same subnet (they'll be right next to each other) so it's not like you can use it to evade blocking, sadly.

Hakase

I know I can call my home IPv4 and reach whatever servers I have set up but I've never tried ipv6, I don't even know that address or whether I have it

forest

You probably don't have it then.

Hakase

12:50 AM

or just nobody told me coz what's the reason for it

forest

ISPs rarely give out multiple IP addresses simultaneously, much less of multiple types.

Hakase

ah

forest

Sadly most ISPs don't do IPv6 yet. It's pretty much used for mobile devices right now.

Hakase

from what I just found it doesn't look like any russian isps work with ipv6 yet

forest

Like virtually all cell phones will get an IPv6 address. Honestly I like it that way. IPv6 is complicated and confusing and the addresses aren't as easy to remember. Let the mobile devices and IoT crap use it so everyone else gets their IPv4 space freed up.

Russian ISPs use ancient tech.

Hakase

12:53 AM

none of the major ones at least or ones which I have access to

forest

You're in Russia?

Hakase

well idk about tech, but I'm not complaining about the free speed upgrades and price drops they've given to me over the years

yea moscow

forest

Yeah I have a friend in Moscow who's ISP mistakenly gave him a huge network and they don't correct their mistake as long as he doesn't bother them with support questions. We hosted a server on that network.

I think we dropped it because the network kept disconnecting and reconnecting every hour. Now we're gonna host in Romania where a 200/200 is fucking $5/month.

Gotta love foreign internet prices.

Hakase

yea there's not much here but the internet is great

forest

Except the censorship bit. Though I think you can get around that by stripping SNI since they're stupid enough to block only based on SNI.

Hakase

12:59 AM

I think every provider does it their own way

at work we can't reach hella servers like firefox installer domain and addons site

at home it's all good

forest

Probably. And Roskomnadzor is too dumb to tell them to do it right.

Hakase

and they've actually unblocked a couple previously blocked -booru sites recently

forest

My site is still blocked :(

Hosting in Russia is a death sentence if you plan to move out of Russia later.

They'll block shit into oblivion if you host it there and then move it.

Hakase

some guy is constantly spamming stats about blocked/unblocked IPs in our work chat, and it looks bad but when it touches actually important sites, it gets fixed in about 20 minutes to a couple hours

these ban lists are actually not in effect immediately, they're just sent to ISPs to implement soon-ish

some are overzealous, some are understanding and have good people on board who know not to ban specific ranges belonging to legit sites

forest

Yeah. A lot of them are automated too.

Hakase

1:02 AM

everybody says just use Opera vpn for sites that don't work otherwise

forest

Bots scrape sites and when they find something bad, Roskomnadzor sends you a "friendly email" to take down that URL and the bot keeps hammering it until it's down, or it'll get you blocked.

They never replied when I told them to fuck themselves :(

Hakase

although I've been getting unironic responses about paying money for random VPN services on top of your normal monthly internet pay which is mind-boggling for me, a pirateborn

forest

heh

Hakase

so yea at work I use opera vpn to download firefox updates

dumbass work isp

forest

That's just sad.

...maybe that's why everyone I know in Russia uses Opera

Hakase

1:05 AM

it used to be popular here before chrome appeared and firefox was good

opera opened up real fast, had an interesting design and had a basically vpn "fast mode"

forest

And now Opera is just "Chrome with a new skin" lol

Hakase

which compressed the site contents like images and served that page to you

forest

Ever since they switched to Blink.

Hakase

idk but I heard some chinese company bought Opera

forest

Yep

Hakase

1:06 AM

so its vpn is even less trustworthy than before

forest

Well its VPN was never meant to be trustworthy, just to provide things like compression/caching. Which honestly isn't that huge.

Taisho

Hakase

Opera Mini is the mode's name I believe, and the app's name for phones with it enabled permanently

forest

huh

I think there was also an Opera web browser for the Nintendo DS way back.

I always wanted that one.

Hakase

it used to be a huge deal for 56k connection days

and for slow-ass mobile internet

forest

1:08 AM

Yeah for sure.

Ironically internet speed today is not that much faster since the internet is so damn bloated. I mean really, 10 MiB web pages with resources from two dozen domains and 10 KLOC JavaScript? It'll be the death of us all.

Hakase

I actually wanted to ask on superuser or somewhere about something like that but for 2018

forest

About what, a caching proxy?

Hakase

it's not so much bloat as all the major sites are designed to track your activity, and the way it's implemented is slowing down the page loading times dramatically

forest

Well it's both. Tracking requires a lot of resource loads and they don't want the page to finish rendering until the tracker is actually functioning.

But it's also things like insanely huge JS libraries and CSS stylesheets.

Hakase

something like for when you go to read reddit and other news sites or whatever every day at 10 sharp, have the browser pre-load these pages starting from 9-55 so when you open these tabs, it's instantly opened from a fresh couple minute old cache

normal cache serves the page faster but I'm talking about the browser not having to make you wait to load and render the page

forest

1:10 AM

An RSS feed?

Hakase

kinda going a step further

no, tab pre-loading

forest

Huh interesting. So like predictive preloading but based on time, not on previous activity.

Hakase

rss feed still needs time to load and render on the tab

well, it's not predictive, you manually set it up

and while you're away, you don't care if your computer/tablet/phone is lagging loading those pages, but when you open these bookmarks, it instantly opens

forest

developer.chrome.com/extensions/background_pages

Hakase

I don't think making it predictive would be a good idea in terms of wasted bandwidth for all the times you didn't use it, and lost battery charge, and most of all the site owners will not be happy about these automated page updates which didn't lead to anything

forest

1:13 AM

Yeah I meant like predictive loading, but based on time instead.

Hakase

I don't know what predictive loading is, if it exists already, so I can't say if it's like that

forest

It's like, preloading the "next page" link when the site sees you click "next link" before on the Buzzfeed top 10 bullshit tabloid sites article.

Hakase

mm yea kinda

forest

Same with like a booru, it'll preload the next page without preloading each individual image.

Hakase

do any popular browsers already do preloading like that?

forest

1:16 AM

Chrome does, I think Firefox has something basic like that.

Hakase

@forest I'd write an app to browse boorus honestly >.>

forest

It even has predictive scrolling rendering, like it'll see you scrolling down and it'll pre-render the stuff below because it expects you to keep scrolling down.

Also, chrome.google.com/webstore/detail/tab-schedule/… (opens tabs at a set time)

Yeah I've been thinking of writing a Gelbooru browser script.

Hakase

developer.mozilla.org/en-US/docs/Web/HTML/Preloading_content this doesn't sound like what we're talking about

forest

Because Gelbooru is now totally broken without JavaScript (because the idiot admin wants people to see the ads even with Tor browser).

That's explicit preloading, not predictive preloading.

Link prefetching

Link prefetching allows web browsers to pre-load resources. This speeds up both the loading and rendering of web pages. Prefetching was first introduced in HTML5. Prefetching is accomplished through hints in web pages. These hints are used by the browser to prefetch links. Resources which can be prefetched include: JavaScript, CSS, image, audio, video, and web fonts. DNS names and TCP connections can also be hinted for prefetching. == Prefetching in HTML5 == There are two W3C standards covering prefetching for HTML5: Link preloadHints to specific URLs. Common hints include JavaScript, CSS, images...

Hakase

opening tabs at a set time… hmm… but we don't want the side effects like the act of loading the page might register with some messenger or chat as you having read all the messages…

forest

1:19 AM

Why would it do that?

Do new tabs create some sort of popup in your setup?

I imagine they can be made to be opened in the background.

Hakase

I guess if the sites decide to fire the event for that if some specific resource is loaded

they'd have to revise their logic

in telegram app on pc for example the messages don't register as read until you move the mouse or hit a key

forest

I don't have my system configured to notify me for browser events.

Hakase

eh nevermind that

forest

I find it distracting.

Hakase

@forest use danbooru with safe mode on instead

or wait

unsafe mode off?

I forget which one is for nsfw stuff only

forest

1:21 AM

I hate danbooru. It wants me to be a member to see cute things.

Hakase

maybe I haven't used these in a while

Memor-X

@forest no it doesn't

forest

Has that changed?

Memor-X

@forest i don't think it's been like that for years

forest

> 20 post(s) on this page require a Gold account to view (learn more).

Hakase

1:22 AM

mm

Memor-X

@forest i have never seen it be that large but even then the vast majority you don't need a gold account

Taisho

forest

I prefer everything being available.

Hakase

danbooru doesn't work for me

I think it was blocked a couple years ago before all this recent telegram bs

forest

Gelbooru has more than Danbooru anyway, even if it's more ad-heavy.

Hakase

1:25 AM

isn't it just scraping all of danbooru's submissions and refiltering them in some way?

like safebooru?

forest

No.

It does scrape from Danbooru but the majority that I've seen is new.

Memor-X

i thought safebooru was danbooru but with no possibility of seeing nsfw stuff

forest

Maybe. But you can always do rating:safe

Memor-X

@forest but would that be enabled by default when you go to the main page?

forest

At least for Gelbooru, the main page is SFW (just a text search box).

And you can probably set it by default if you register, but I never register.

Hakase

1:27 AM

@forest that ruins the search as it's limited by number of items in the query

it's already bad but then it's even worse

forest

You're using too much Danbooru then :P

Hakase

I remember running into issues with that at some point

forest

(Just reminds me of another reason why I hate it)

Hakase

I don't remember what I was searching for tho

I think I was trying to browse those isometric projection floating island house pictures?

forest

wha

Hakase

1:29 AM

anyway, it turned out a lot easier to find good ones on pixiv if you click all the tags and figure out which one means isometry

(coz I can't read japanese)

that stuff

forest

Ah

Yeah Pixiv is nice.

Hakase

forest

I sometimes use it to view through my favorite artist's galleries but not really to just search. Sad that it requires an account to view NSFW though.

Hakase

I don't have that many saved but I wasn't planning to have to need more

I'll get more sometime next year probably

forest

I imagine there are huge archives that people have collected.

Hakase

1:32 AM

@forest yea and it sucks that they change the layout when you log in

forest

I usually use the bugmenot passwords to log in, when they work.

Hakase

these archives surprisingly take up very little space

forest

But it seems most of them have been deleted.

Hakase

just make an account, it's not binding or anything

forest

It blocks Tor logins :/

Hakase

1:33 AM

I removed all the "confirm you account" nag bars with css

oh

forest

Or rather, its handling of Tor is broken (it gives a 403 in the oddest places).

Hakase

why tor tho

forest

I always use Tor.

Hakase

and do you always use the default window size and such?

forest

Yeah but I've been working on solutions to that.

(It's more complex than it seems :/)

Hakase

1:35 AM

do you have a plugin to make keystroke intervals the same? :p

why go to these lengths for daily browsing

forest

Sort of. I've patched my kernel to create delays when triggering PS/2 interrupts (it waits on an interrupt then switches to polling and disables IRQs for the next 5 seconds, and goes back to being interrupt-driven if no input in those 5 seconds).

But most of the time I have JS off anyway so keystroke biometrics are irrelevant.

Hakase

I use always private mode because my previous searches mess up my recommendations and it's more useful to have new recs for what I'm currently looking for every time, which sites don't natively do, but like this they do

@forest yea that's why I asked

I'd imagine you would have disabled canvas elements and any other method to identify window client area dimensions

forest

It's not possible to do that sadly.

Hakase

so you can safely use any size of screen you like

oh wow

forest

Because of the CSS @media elements (doesn't use JS or anything). You can't rip that out without completely obliterating rendering.

Taisho

1:38 AM

Hakase

but can't you like download firefox sources and edit that handling so that it doesn't remove certain media elements?

forest

No. The media elements that can be used to detect screen size are also required for basic functionality of the browser.

Hakase

or would it otherwise compromise the browser's identifiability

forest

Well it would do that too, but the real problem is that it just wouldn't work. You'd be stuck with a text-based browser (no CSS).

Hakase

well… you could just block all js or be very selective about allowing outgoing requests

forest

1:40 AM

CSS @media-based screen size detection doesn't require JS.

Hakase

does it send some requests back to the server with your dimensions just from css?

forest

Basically. CSS can be used to selectively load an element based on dimension.

Hakase

hmm right

forest

So it can be told to load /size=1x1 if the size is 1x1 pixel, or /size=1x2 if the size is 1x2 pixel, etc.

Hakase

like lazy loading for elements outside visible area

forest

1:42 AM

Well it's loaded in real-time.

Hakase

idk if you can mitigate that at all

well, anyway, what does it really matter

forest

Not without extensive modifications to the browser. It might be possible in theory, but I can't really think of a good way to do it. And I don't mind using the default size.

Hakase

a lot of people these days have fullhd displays and browse maximized with default taskbar size

forest

true

Hakase

default window size puts you right in with the snowden nuts

forest

1:45 AM

You'd be surprised how effective browser size-based fingerprinting can be.

Fingerprinting in general is a little scary.

Hakase

just browse like a normal person if you wish to be considered a normal person

forest

Impossible

Hakase

90% of reddit is like "am I weird for thinking this somewhat sociopathic thought that one time?" and the rest are like "phew I'm glad I'm not alone with these occasional thoughts"

so I'm not sure it is that impossible

forest

Unless you actually are a sociopath lol

Hakase

of all the groups of people one can be assigned to, I think you'd still be in a pretty large group

even sociopaths

forest

1:47 AM

The problem is that an absence of anonymity limits your choices in the future.

When you have anonymity, your choices are unbounded.

Also, lots of people love suing people for reporting security bugs in their products.

Which is another nice reason to stay protected.

Hakase

when in 2020 uncle elon launches his leo internet mesh we'll see some interesting anonymizing ideas I'm sure

forest

Oh god, an LEO mesh would have such high latency.

Hakase

also 5G is supposed to be meshable if I'm not mistaken

forest

Neat

Hakase

do you know anything about that?

forest

1:49 AM

Unfortunately it still uses the IP protocol. An entire new routing protocol would be needed to make anonymity built in.

And no I don't. I know only a few of the basics about 2G GSM/3G, almost nothing about 4G, and nothing at all about 5G.

Hakase

it says on wikipedia page and in some official booklets about 5g that it's supposed to get rid of cell phone stations as the only relays

forest

So each mobile device would be part of the meshnet?

Hakase

kinda

forest

huh

Hakase

I doubt that since it would mean the death of mobile companies

since you don't need them anymore?

forest

1:52 AM

Well mobile companies would still need to be there, they'd just have free wireless repeaters all around.

If I understand the concept.

Hakase

they'd have to build in some ddos protection or anti-bittorrent swamping system so people would be able to call each other like intended and not lag to death

forest

But honestly I think meshnets are a pipe dream. We'll be stuck with centralized, AS-riddled BGP-heavy IP-based internet for a long-long time.

Well the thing is, cell towers use spread spectrum frequency hopping so they work quite well already without a mesh network.

Hakase

I've read VPN companies handle this by blocking bittorrent traffic on their normal usage only servers and let you torrent away torrent-only servers

idk how it works low-level but it seems that it does work somehow

could do something like this on phones also

and turn all wifi routers into mesh relays for torrenting

forest

Now, what I would love to see is a pure DSSS designed for LPI/LPD with end-to-end encryption. Pure, perfect location anonymity and no jamming risk.

Hakase

(not that you can put 5g antenna and hardware into an existing wifi router but let's say every new router you buy will have that included from 2020 onwards)

forest

1:55 AM

Isn't there some project in Germany that uses OpenWrt for a meshnet?

Hakase

elon said they're planning some anonymity stuff designed into the protocol for these sats

no idea

forest

huh

I doubt it'll be fruitful since we're so deeply invested in IP-based internet, but I really do hope... It would be amazing if he actually designed an anonymous internet. Then maybe in 50 years all the major sites will have switched over.

Hakase

alphr.com/space/1008632/Elon-Musk-SpaceX-Starlink-internet some text on that

Taisho

forest

> “a crypto fix will go out immediately via [a] network-wide firmware update.”

RIP

Hakase

1:58 AM

hahaha

but in the end, can you trust any device even today?

forest

Given that I know people who have compromised entire ISPs (and maybe still have shells there), the mere concept of a centralized, internet-wide update is horrifying.

Sure you can, if you do threat modeling.

That's why I don't even fear the Intel ME.

Hakase

I think what's happening in the world right now is good for our future prospects

forest

How so?

To me it seems like more and more governments are going anti-cryptography / anonymity because "muh turrurists"

Hakase

nothing is secure enough, people getting all sorts of viruses into enterprise systems, passwords and personal info leaking regularly from the largest companies

forest

Ah yeah

Hakase

2:02 AM

windows 10 screwing up people's lives

forest

That's a good point. And the Spectre/Meltdown vulns seem to be making people finally care about hardware security (about fucking time!)

Hakase

yea

forest

It mirrors what happened in the 90s with binary exploitation.

Hakase

maybe we'll finally have some fuckin granular permissions for apps on both phones and computers

it's 2018 ffs

where are they

forest

When it was still in its infancy and everything was vulnerable to buffer overflows and shit, before even Smashing the Stack For Fun and Profit.

I still think the Spectre paper should have been titled "Poisoning the Branch Predictor For Fun and Profit".

I mean back then, the idea of ROP (ret2lib) was just barely emerging, and now it's a well-known and standard exploit technique with various mitigations coming in (RAP, kCFI, Clang CFI, CFG, CET, etc).

Hakase

2:04 AM

I wouldn't be afraid of AI before we invent fast self-replicating robots

forest

I'm afraid of AI right now, but for different reasons.

Hakase

or army-bots which can move fast and shoot people

forest

I have no fear of them turning evil or anything. No matter how smart an AI is, it'll have no desire for self-preservation. The real thing that scares me... the goals of an AI will be set by humans.

An incredibly intelligent AI is not something I fear unless it is created by MITRE under a contract for the DoD.

You know Google's Recaptcha is being used for drone strikes?

It's teaching an AI how to recognize targets for the Pentagon.

Hakase

multiple groups around the world have to be working on general AI in secret and some of them might have already succeeded, and we have no way of knowing

forest

If you noticed recently, instead of asking you to select cars and buildings and signs, it asks you to select said things in very grainy, night vision-esque environments.

Hakase

2:07 AM

unless one of them fucks up big time and lets its presence be known

forest

Eh, we'd know.

Hakase

hah

forest

Because said group would suddenly become very rich and powerful.

Also, a general AI isn't even the most scary thing. An AI specialized in recognizing people is far more terrifying.

Facebook has one that is something like 0.2% less accurate than a human at recognizing human faces (though as it is, only well-lit portraits at one angle).

Hakase

well, there are many publicly known projects for that purpose

I wonder how "non-reusable" the iphone face id is

forest

Sure, but they're a little limited. They can't look at a low-resolution picture of someone and give their real name (like that person's mother could).

Not at all

Little kids have been known to unlock their parent's phones.

Simply because the ID software is so fucking stupid.

A freaking mongoloid can tell the difference between an adult and a child.

But Apple's "security software" is so bad it can't tell the difference.

It's hilarious and sad at the same time.

Hakase

2:10 AM

it's purposefully adjusted to accept very vague parameters in case you're drunk off your balls and your face is too different from the way when you scanned it initially

imagine seeing "u r fken drunk! this phone is locked"

forest

Which makes it nothing more than a gimick.

Hakase

what were we talking about? why is face id scary?

forest

AI and shit.

(Biometrics in general should not be (ab)used for identification. Biometrics tests "what you are". You need to include a "what you know" or "what you have" in order to create a secure authentication system. Fingerprints and face should only be the equivalent of nicknames, not passwords)

Hakase

yea

forest

A lot of things scare me in this world.

Hakase

2:12 AM

but how can we detect "unadulterated honest intention to gain access" from a human brain

forest

Functional brain imaging.

Hakase

I mean who the fuck knows, these scientists already found a way to figure out if you've seen a thing or not

forest

Lemme just sit in this loud fMRI machine for a few hours so I can unlock my phone.

Hakase

finally makes those "lie detectors" useful for something

forest

Well sort of, but generally yeah.

They can also tell what number you are thinking of and even what object.

Hakase

2:14 AM

wow

forest

And, get this, even an audio playback of your dreams.

Hakase

I'd imagine after a very long series of questions beforehand

forest

Albeit very low quality and very difficult to understand.

Nope.

Just "think of a common household object"

Hakase

yea audio I get, it wouldn't be too difficult to get a vague waveform

forest

Yeah

Apparently it sounds slow and distorted.

Hakase

2:15 AM

ear and mouth muscles tend to mimic these sounds when reproducing the memory

forest

We can also hook up rats to an imaging device when they're dreaming, and if they were in a maze that day and dream about the maze, the device can tell where in the maze they are dreaming they are.

It's really neat.

Well in a dream our mouth muscles don't move when that happens.

Due to peripheral paralysis.

Taisho

Hakase

I bet it's cheating by using already known map layouts though and guessing the location of the rat within its dream by figuring out where it may be based on where its muscles are moving it, so it can't be where the path crosses the walls

forest

No muscles involved. It checks the hippocampus' "place cells" and "border cells".

Hakase

hmm cool

forest

2:17 AM

But yes it does need to know already known map layouts, if I recall. Still not really cheating though because it directly taps into the rat's brain.

Hakase

anyway anonymity amirite

I gotta go sleep

it's 5:20

thanks for a chat

forest

Have a good sleep!

yep, same

Hakase

come again sometime during normal human hours

forest

That slide is from my next talk, which basically tells how the same old implementation stupid bugs and crypto flaws are omnipresent also in the latest Post-Quantum Algorithms. The facepalming show starts from the most obvious test..

Tweeted by mjos_crypto on May 26, 2018 at 8:00 PM in reply to mjos_crypto

Someone just linked that in the Crypto chat room. Holy shit.

Sakamoto

4:27 AM

0

Q: Boruto episodes and corresponding manga chapters.

If I want to pick up the manga where the chunin exams left off. Does anyone know what chapter I should start at?

boruto

Transcript for