Mikina

joined 2 years ago
[–] Mikina@programming.dev 5 points 1 month ago (3 children)

I've switched to vim on a whim few months ago, and it still is a pretty fun and satisfying experience. I couldn't get LazyVim to properly work on our Unity project, since the LSP can't handle the hundreds of projects it generates, but IdeaVim in Rider works pretty much the same, as far as the movements are considered.

However, the important thing is that I said fun and satisfying, not faster and efficient. I still make mistakes, I have to look into a keybind reference sheet every time I want to do something I'm sure has to have a special keybind but I've forgotten which one it is, but once you do that it feels good.

Slowly but surely learning new stuff, getting the hang of some motions you use often, not having to reach for your mouse, all of that feels good. It's still no way near the speed or efficiency of me just clicking the damn mouse, instead of fumbling around with VIM modes, undoing random actions because I missed one important key and now half of my text is gone, or just remembering that your clipboards get overridden by almost any action unless you do it differently.

So, if you want to get efficient and quicker in your programming, I highly recommend checking the keybind section of your IDE, and learning the few important keybinds it has, such as jump to next function/next parameter, search symbols, and the like. That will make you more efficient.

If, on the other hand, you want your editing to be a skill you can slowly continue mastering, eventually (after years of use) min-maxing, but always having some cool new things to learn that will feel good, them vim is pretty nice for that.

Just don't expect it will make you faster or more efficient.

[–] Mikina@programming.dev 102 points 4 months ago (5 children)

I think I know who killed him.

By 11, he was programming on his own—a skill he used to playfully torment his friends. One remembers Balaji’s idea of a middle-school prank: writing code that deleted a friend’s Skyrim save file.

[–] Mikina@programming.dev 1 points 4 months ago* (last edited 4 months ago) (1 children)

I use Pixel with GrapheneOS as my phone, and I just have a separate profile that only has WhatsApp installed and nothing else. Since the profiles are completely separated, it doesn't have access to anything else I do on the phone and it's not running in the background (the profiles are basically sandboxed fresh slates, and switching it can be set-up to behave in a same way as basically turning off the phone as far as the profile is concerned).

When the bridge asks me to log in again or refresh a session, I simply switch to the second profile for a minute and re-log in. I've heard iIt might be possible to set up an emulator and leave it running on the server, but that felt like too much effort.

[–] Mikina@programming.dev 1 points 5 months ago

Isn't the OpenAI one they offer the same one as the one provided at https://chatgpt.com/ without login? So probably something not as impactful.

Or do they share their unlimited subscription?

[–] Mikina@programming.dev 1 points 5 months ago

That's only for the 200$ one, and if you use it constantly, no?

[–] Mikina@programming.dev 2 points 5 months ago

Yeah, that's my experience as well. In addition to being lazy with updating, so if some kind of supply chain attack happens, I usually sorts itself out before I get to updating :D

But I did limit my browser extensions, after I a cause with Nano Defender taught me a lesson - it was a mildly popular anit-anti-adblock killer that worked where other adblocks were detected, but the developer sold the extension to a company that turned it into a info-stealer malware and pushed an update through chrome store, which got accepted and propagated, and some of my social network sessions got compromised. So, I just stick to more popular projects where something like this shouldn't happen, and don't use random extensions.

[–] Mikina@programming.dev 2 points 5 months ago

Yeah, that part about WhatsApp is annoying. I just have a spearate profile on Graphene that has only WhatsApp installed, and whenever it wants me to refresh a session I just switch to the profile and log in.

[–] Mikina@programming.dev 1 points 5 months ago

There is, but it requires you to log into the app every two weeks to maintain a session. You can setup a emulator to do it for you. I just have a separate profile on my Graphene with Only WhatsApp that I switch to and login whenever I get a warning.

[–] Mikina@programming.dev 2 points 5 months ago (3 children)

I've been using it for almost a year by now, and so far I didn't have any problems. I've not considered that problem though, so it might be happening and I was just lucky.

[–] Mikina@programming.dev 4 points 5 months ago

WhenI was setting it up, it took me only like two hours tops. The ansible project is well documented, has a clear setup guide, and the process is really just getting server with ssh access, changing DNS, changing around 5 values in the ansible config and running it.

[–] Mikina@programming.dev 2 points 5 months ago (2 children)

As far as I know the Discord bridge has some limitations, the major one being that IIRC it doesn't atually support calls. But just for chatting across servers it has worked well for me.

There's also the fact that you have to either trust the project with your password (as in, the the bridfe adds a matrix bot that runs on your server, but needs your pssword), since I think it uses the web version in the background (but then you can also use it for DMs and any server), or set up a bot on the discord server you want to bridge, which obviously cant be done if you're not an admin. It's a foss project, but there's always a small risk of it gping rogue.

 

Hello!

I've recently stumbled upon an amazing blog about getting credentials from Bitwarden vault through DPAPI and Windows Credential Storage, and what suprised me is that any low-privileged process can just ask for all information in Credential Storage, without requiring any user input (the article discusses it in the second half, even though the first half is about abusing DA credentials), through the CredEnumerateW WinApi call.

Since that vector was pretty interresting, I tried running their PoC for listing the cred storage on my, and several colleague machines, and was surprised that every machine had domain account credentials listed in plaintext, that could be grabbed by any low-privileged process just by calling this WinAPI.

I suspected that it's because of Outlook or Teams, because I found articles from few years ago mentioning that they do get saved there. However, one colleague did not have his credentials there, even though he was using Teams and Outlook, and had his password saved.

So, how did that password get there? Why most people we tried the PoC with do have a domain password saved, but some do not? Or is it because of Windows Hello? I'd love to get some kind of solution/recommendation about how to avoid having your password, in plaintext, in such an insecure space. Or was I dumb enough to save it into Edge somwhere, and have promptly forgotten about it?

And more importantly - how this isn't a pretty severe vulnerability, and is considered "as designed" by Microsoft? The fact that any process can just ask for your credentials is mind-blowing, plus it isn't even detected by EDRs we've tried it with when discussing it with our SoC.

 

There is one argument I've seen missing in most of the de/federation discussions, that I think should be mentioned, and warrants it's own discussion.

I've seen a lot of people mentioning that defederating with Meta means we have broken the promise of Fediverse, that you can use one account to interact with whatever service you choose, and that it should be inclusive.

But I don't agree that's the main idea. There is something that's more important, and to make sure I'm not misinterpreting it, I'll just directly quote various websites about the Fediverse I've found (I was just taking top results for Fediverse on DuckDuckGo, but I did select only the parts that are the most important point for me personally). But I do concur, I was not able to find a single source of truth, and I'm not really sure how credible the resources are, so please disagree with me if it's wrong or I've chosen some no-name site that just matched my rethorics.

https://www.fediverse.to/ has the following sentence as the main hero header:

The fediverse is a collection of community-owned, ad-free, decentralised, and privacy-centric social networks.

Each fediverse instance is managed by a human admin. You can find fediverse instances dedicated to art, music, technology, culture, or politics.

Join the growing community and experience the web as it was meant to be.

Another search result is for fediverse.party, which has the following quite in https://fediverse.party/en/fediverse/ :

Fediverse (also called Fedi) has no built-in advertisements, no tricky algorithms, no one big corporation dictating the rules. Instead we have small cozy communities of like-minded people.

The page also mentions some link for knowledge about the fediverse. Some of them are only tutorials about how to join, but there's also https://joinfediverse.wiki/What_is_the_Fediverse%3F , with the following part:

How does it compare to traditional social media?

...

Morals

  • Traditional social media is neither social nor media. It is not made for you, it is made to exploit you and it is full of misleading ads and fake news.
  • This is because the aim of traditional social media is to make a whole lot of money.
  • The aim of the Fediverse is to benefit the people.
  • The aim of traditional social media is to control and steer the users.
  • The aim of the Fediverse is to empower the users to control the Fediverse.

I wasn't able to find more websites directly about the fediverse, and I did not want to quote random articles. But for completion sake, here is a list of FAQ/About sections of websites that are about the Fediverse, but don't directly support or imply the point of view I was trying to make (one that can be best summarized by the Morals in the last quite):

The split seems to be 50:50, but at least for my DuckDuckGo search results, the https://www.fediverse.to/ is the first result you find, and that one is pretty clear about what Fediverse should be. I wanted to start a discussion about what do the users here see as a main selling point of the fediverse, and whether morals and non-profit nature of the instances is important to most of the users as it is to me, or whether you'd rather have interconnectness and inclusivness.

view more: next ›