Diseased Open Source Software Community - it's about ethics in Code of Conducts

[GNU Abyss]

Fediverse dudes have proposed a new symbol for it: ⁂

Niggers can't even...uh... Snowforce?

 

[Marvin]

a Debian maintainer shipped KeepassXC (to SID) without networking features. if you use KeepassXC you mightn't think this is a big deal but it "breaks" quite a lot of things, notably using KeepassXC to integrate with a browser to autofill passwords.

Lol don't do this. Why even use an external password manager if you're going to weaken it like this? Just copy and paste the passwords manually.

 

[torvalds]

Lol don't do this. Why even use an external password manager if you're going to weaken it like this? Just copy and paste the passwords manually.

I think it depends on your threat model and who/what you choose to trust.

Do you trust the security/privacy of clipboard support in your OS and all the applications that use it? Historically, and still in several OSes, clipboard contents can be read by all applications simultaneously. A malicious app or malware could steal passwords that way (among many others of course).

Or in the case of a browser extension for passwords... if you don't trust the clipboard support, do you choose to trust all the networking code instead?

 

[Marvin]

I think it depends on your threat model and who/what you choose to trust.

Do you trust the security/privacy of clipboard support in your OS and all the applications that use it? Historically, and still in several OSes, clipboard contents can be read by all applications simultaneously. A malicious app or malware could steal passwords that way (among many others of course).

Or in the case of a browser extension for passwords... if you don't trust the clipboard support, do you choose to trust all the networking code instead?

You can always get more complicated, sure.

Still, if someone has a process running on your computer, they at least have access to all of the stuff your browser does, so while maybe, depending on the OS, they can snoop on your clipboard, they can definitely snoop on the socket delivering the credentials.

Just in general, it's a bad idea to have a dedicated service that delivers the credentials on demand, as opposed to a generic service you use for other stuff anyway that operates in response to user stimuli.

 

[botrix_fan]

Fediverse dudes have proposed a new symbol for it: ⁂

Why does the fediverse need a symbol?

 

[The Taxman]

Why does the fediverse need a symbol?

Because the Fediverse is overrun with fags and troons, which more than anything in the world desires constant representation. It’s never enough for these people.

 

[UERISIMILITUDO]

I fucking hate this neverending trend of picking some garbage out of Unicode to give it some quirky meaning. Make a fucking logo. The pentagram logo they mention in that page is so much better than this. I also love the justification they use for rejecting the other logo:

It incorrectly depicts a centralised network, with a big planet in the middle and the rest around it.

Yeah, that totally doesn't summarize The Fediverse.

 

[Cuckoman]

a Debian maintainer shipped KeepassXC (to SID) without networking features.

And that was the right thing to do. The people that use this functionality for their password manager are retarded faggots who consider security being just a performative action.

The people that complain about this feature being removed are the exact same people, a.k.a. idiots, that removal of the feature serves to protect.

 

[Looking Glass]

You can always get more complicated, sure.

Still, if someone has a process running on your computer, they at least have access to all of the stuff your browser does, so while maybe, depending on the OS, they can snoop on your clipboard, they can definitely snoop on the socket delivering the credentials.

Just in general, it's a bad idea to have a dedicated service that delivers the credentials on demand, as opposed to a generic service you use for other stuff anyway that operates in response to user stimuli.

In general if malicious code is executing outside of some kind of sandbox you're fucked, but a socket can provide a lower degree of fucked in some cases:

1. The clipboard on some systems (notably X11, windows and mac probably) is basically unguarded and accessible to all applications, making it extremely easy to steal data from.
2. The clipboard is a standard mechanism which is going to be known and watched by basically any info stealer.
3. The clipboard can be read by applications inside containers or any other form of window sharing that does not filter it out.
4. A dedicated socket won't be as standard as the clipboard, which serves as a bit of security through obscurity
5. A dedicated socket works based on filesystem permissions, not display server permissions, meaning containers or other remote connections cannot access it.
6. A dedicated socket can implement additional authentication per connection, e.g. forcing you to re-enter your password in a connected application or something (no idea if keepass does this)
7. A dedicated socket can't be passively monitored as easily (though if you can MITM it via the filesystem (move the original, make a new one in its place) this does not matter.)
8. You can't accidentally leave it in the clipboard and paste it somewhere if you don't use the clipboard.

Edit: This also adds some protection from fake domains as well, if your password manager is set up to list passwords by domain or something. Its easier to notice the password manager not displaying an entry for gooogle.com than it is to notice before pasting.

 

[SleeplessEcho]

Just in general, it's a bad idea to have a dedicated service that delivers the credentials on demand, as opposed to a generic service you use for other stuff anyway that operates in response to user stimuli.

Lol don't do this. Why even use an external password manager if you're going to weaken it like this? Just copy and paste the passwords manually.

The people that use this functionality for their password manager are retarded faggots who consider security being just a performative action.

You can configure the password manager to be able to supply credentials on demand *but* notify the you of the fact that some app in your computer is requesting passwords (and which/which passwords), then require approval before handing them over.

To me that's a perfect sweet-spot unless you're working in an aggressively-hostile threat environment. You get usability (and let's not forget that usability IS a requirement for security in the long term, or all users* stop following protocol eventually) without having an open piñata any process with your credentials can whack for free passwords.

*Yes, you the reader included, before anyone UM ACHSHUALLYs me.

 

[UERISIMILITUDO]

I just memorize most of my passwords and, when I can't be fucked to do it, that's usually because a session will last for years. Even then, I can usually remember them after a few tries. Just write down the most important passwords on a piece of paper. I keep my piece of paper in my wallet, which is always on my person. Yeah, if I had hundreds of accounts I'd need a password manager. I'd rather not.

 

[Looking Glass]

I just memorize most of my passwords and, when I can't be fucked to do it, that's usually because a session will last for years. Even then, I can usually remember them after a few tries. Just write down the most important passwords on a piece of paper. I keep my piece of paper in my wallet, which is always on my person. Yeah, if I had hundreds of accounts I'd need a password manager. I'd rather not.

I used to just memorize them, but having a password manager is nice because instead of trying to remember a bunch of infrequently used passwords, you remember one, preferably extremely strong, password that you use often and automatically generate the rest as a bunch of random symbols. Its also good for storing extra metadata like which emails were used for which accounts.

Its less of a hundreds of accounts problem and more of a tens of accounts problem as well. I'd recommend a password manager to anyone with over 10 accounts.

 

[Kola]

Why does the fediverse need a symbol?

Because it's a concept that works when it can be easily marketed and works better if there are many people using it. Might as well ask why KiwiFarms needs a logo. The funny part is that the symbol represents the userbase.

 

[Faggotdog Niggertail]

And that was the right thing to do. The people that use this functionality for their password manager are retarded faggots who consider security being just a performative action.

The people that complain about this feature being removed are the exact same people, a.k.a. idiots, that removal of the feature serves to protect.

You are being rated dumb for being right. Out of all the software on a computer, the web browser is the most insecure one, and yet here you have your password manager integrating into it. You would not scan your sticky notes with a camera to log in, why would you integrate the very manager of all your account access into the very thing that is most likely to steal them?

 

[Peristaltic Pump]

Fediverse dudes have proposed a new symbol for it: ⁂

https://symbol.fediverse.info

It looks like a bunch of snowflakes, making it very representative.

Since when did groypers take over the Fediverse?

 

[torvalds]

In general if malicious code is executing outside of some kind of sandbox you're fucked

Absolutely... I think more awareness needs to happen regarding sandboxes and default installs need to do more things like how Android is approaching security such as separate users per process, or at least some kind of default-secure namespace.

On Linux you can run your browser (or most apps in general) with a tool that supports namespaces such as firejail, bwrap, unshare etc. or hell even a docker container, and that way you can limit what filesystem or network access it has, that way e.g. a browser exploit doesn't necessarily mean they can easily steal other credentials from your home folder. Or if you're really paranoid, something like Qubes OS.

Windows also has Sandboxie that does similar, not sure about macOS or others.

 

[Pooners Paradise]

Absolutely... I think more awareness needs to happen regarding sandboxes and default installs need to do more things like how Android is approaching security such as separate users per process, or at least some kind of default-secure namespace.

On Linux you can run your browser (or most apps in general) with a tool that supports namespaces such as firejail, bwrap, unshare etc. or hell even a docker container, and that way you can limit what filesystem or network access it has, that way e.g. a browser exploit doesn't necessarily mean they can easily steal other credentials from your home folder. Or if you're really paranoid, something like Qubes OS.

Windows also has Sandboxie that does similar, not sure about macOS or others.

OpenBSD has Unveil(2), which allows an application access to only certain parts of the file system (Firefox and Chromium only has access to the Downloads folder) and Pledge(2), which an application or process tells the kernel what system calls it’ll use at startup and will SEGFAULT if the deviate from those system calls.

 

[Aljam]

After watching this video I am filled with malcontent. The opensuse rotten flesh op was news to me. Imagine having to publicly display troon flag to contribute to the project.

 

[Drama Fan]

GIMP 3.0 Enters String Freeze, Inching Closer To Release (archive)

Lulz. Yes, I unironically use The GIMP.

There's literally hundreds of us!

 

[Pure Snort]

I don't understand how you GIMP users do it. I might open it up once every 6 months to "quickly" do something related to work, and I'm left with seething impotent rage because I fight with every single aspect of getting the app to do what I want lmao.