archomrade [he/him]

  • 7 Posts
  • 166 Comments
Joined 1 year ago
cake
Cake day: June 20th, 2023

help-circle




  • It depends on the attack vector. Typically you’re right, but malicious .lnk files are often paired with other malicious methods to infect machines. Sometimes they’re configured as a worm that copies and spreads when a flash drive is connected, sometimes they’re configured to download a remote payload when another script or program is started. The problem is that it’s a type of file that’s often overlooked because it seems innocent.

    It isn’t necessarily the case that the Trojan needs to be interacted with by the user in order to execute the malicious code. Just having the file on your machine opens the door for all kinds of attacks (especially if you’re using a headless setup: you wouldn’t necessarily know you have the .lnk file in the system unless you’re manually unpacking your downloads yourself). All it needs is for another piece of infected code to run and look for that file, and it can open the door for more traditional malicious code.


    Edit: just as a for-instance - If I was a black hat and wanted to spread some malicious code, I could include this .lnk file in a torrent (innocuous enough to slip by unnoticed by most people/unscrupulous pirates), and then maybe place a line of code in a jellyfin plugin or script that looks for that file and executes it if it’s found. Because the attack isn’t buried in the plugin or script itself (most people wouldn’t think much of a line of code that’s simply pointing to temp file already on your system), it could theoretically go unnoticed for long enough to catch a few hundred or thousand machines.




  • Lots of good suggestions here

    I’m a bit surprised by your budget. For something just running plex and next cloud, you shouldn’t need a 6 or even 3k system. I run my server on found parts, adding up to just $600-$700 dollars including (used) SAS drives. It runs probably a dozen docker containers, a dns server, and homeassistant. I don’t even remember what cpu I have because it was such a small consideration when I was finding parts.

    I’d recommend keeping g your synology as a simple Nas (maybe next cloud too, depending on how you’re using it) and then get a second box with whatever you need for plex. Unless you’re transcoding multiple 4k videos at once, your cpu/GPU really don’t need much power. I don’t even have a dedicated GPU in mine, but I’m basically unable to do live 4k transcodes (this is fine for me)


  • If i’m understanding the last graph right, it’s showing the total number of active monthly users per instance’s top communities, filtered by the overall top 100 communities?

    So if an instance has activity spread out over many niche communities, that activity isn’t represented on this graph?

    I would think having a diversity of smaller communities is more in-line with the spirit of the fediverse, I’m not sure of the value in slicing the data in this way.



  • I used to think the same thing, but I did an effort post about this about a year ago (here’s the link)

    The article you linked to says something similar to my own understanding: basically, DRM circumvention for personal use is officially not allowed under DMCA and could absolutely be used against you in court, though the likelihood is low. The exceptions the author mentions are pretty nebulous, and the Library of Congress actually addresses the most common cases in their discussions and publication and affirms that they are not allowed.

    I don’t personally agree with their interpretation, but I think more people ought to know that it’s officially not legal to circumvent DRM for personal use.






  • The problem is that somehow you wind up in long heated arguments with “centrists” which wander away from the topic and get personal

    I’m not surprised I was identified by the bot, but it’s worth pointing out that ending up in heated arguments happens because people disagree. Those things are related. If someone is getting into lots of lengthy disagreements that are largely positive but devolve into the unwanted behavior, doesn’t that at least give legitimacy to the concern that dissenting opinions are being penalized simply because they attract a lot of impassioned disagreement? Even if both participants in that disagreement are penalized, that just means any disagreement that may already be present isn’t given opportunity to play out. Your community would just be lots of people politely agreeing not to disagree.

    I have no problem with wanting to build a community around a particular set of acceptable behaviors -I don’t even take issue with trying to quantify that behavior and automating it. But we shouldn’t pretend as if doing so doesn’t have unintended polarizing consequences.

    A community that allows for disagreement but limits argumentation isn’t neutral - it gives preferences to status-quo and consensus positions by limiting the types of dissent allowed. If users aren’t able to resolve conflicting perspectives through argumentation, then the consensus view ends up being left uncontested (at least not meaningfully). That isn’t a problem if the intent of the community is to enforce decorum so that contentious argumentation happens elsewhere, but if a majority of communities utilizes a similar moderation policy then of course it is going to result in siloing.

    I might also point out that an argument that is drawn out over dozens of comments and ends in that ‘unwanted’ behavior you’re looking for isn’t all that visible to most users; if you’re someone who is trying to avoid ‘jerks’ then I would think the relative nested position/visibility of that activity should be important. I’m not sure how your bot weighs activity against that visibility, but I think even that doubt that brings into question the effectiveness of this as a strategy.

    Again, not challenging the specific moderation choices the bot has made, just pointing out the problem of employing this type of moderation on a large scale. As it has been employed in this particular community is interesting.


  • I know this will ring hollow, considering I am (predictably) on the autoban list, but:

    I don’t know how this isn’t a political-echochamber speedrun any%. People downvote posts and comments for a lot of reasons, and a big one (maybe the biggest one in a political community) is general disagreement/dislike, even simply extreme abstract mistrust. This is basically just crowdsourced vibes-based moderation.

    Then again, I think communities are allowed to moderate/gatekeep their own spaces however the like. I see little difference between this practice and .ml or lemmygrad preemptively banning users based on comments made on other communities. In fact, I expect the same bot deployed on .ml or hexbear would end up banning the most impassioned centrist users from .world and kbin, and it would result in an accelerated silo-ing of the fediverse if it were applied at scale. Each community has a type of user they find the most disagreeable, and the more this automod is allowed to run the more each space will end up being defined by that perceived opposition.

    Little doubt I would find the consensus-view unpalatable in a space like that, so no skin off my nose.