Saik0

Does no one care about power consumption?

It takes several SSDs to make up the capacity difference between an HDD.

I run 62 16TB HDDs. To make up the same capacity in SSDs I need 2-4x the bays. I don’t know of any cheap systems that can hold ~250 bays of ssds.

So an SSD that may only take 1-3w all day… 2-4x that is already equal to the HDD regardless. You’re not going to make any ROI metric here.

My guess is that it’s the easiest and cheapest way to set up “MFA”.

TOTP is cheaper.

SMS is actually expensive at scale. An example would be Signal, the messenger app that doesn’t use SMS. They have overhead for sending backup codes/new account creation/Verification/etc… https://www.wired.com/story/signal-operating-costs/ 6 million a year. API integrations for SMS messages/codes are still like 1-5 cents per message.

TOTP’s requirements? A reasonably accurate clock on the server, and storing the shared secret in a database.

This is already a risk whether via the existing thumbnail storage

Not anymore. You can opt out of it for the most part.

# Leave images unchanged, don’t generate any local thumbnails for post urls. Instead the the
# Opengraph image is directly returned as thumbnail
“None”

Yeah that was 19.4. It’s doesn’t proxy everything unless explicitly set to. Just thumbnails I believe. But I could be wrong. And many instance owners would be allergic to that as it leaves them on the hook for storing content. For example… someone posts CSAM… a copy of that is now on your server. You get police raided and you’re fucked.

https://github.com/LemmyNet/lemmy/blob/705e86eb4c0079d0775f0c1490968f1183095fcc/config/defaults.hjson#L51

Actually going over it briefly looks like it has a few available options for what it will cache…

I refuse to enable it myself for the above reason. I would venture 99% of instances out there would also refuse for liability and bandwidth costs.

I’ve addressed the points you’ve brought up. I run my own instance. I can collect just about everything in the DB tables I’ve seen without being logged into the instance with some external work.

Are you trying to get my point? If you have a specific item that you believe is stored on a lemmy server that you think isn’t possible to obtain. I’m all ears. otherwise I think this conversation is done. This kind of response is pointless and I’m not interested in continuing if you’re going to act like that.

The hardest thing to collect would be private messages, and login information (which is hashed btw, so even your server operator doesn’t really know it). But messages are plaintext and openly federated. All the other information is really really easy to collect through other means.

but that instance owners have even more, probably more valuable info, like IP addresses from which not just geolocation but also wake times, device usage patterns and other gnarly stuff could be extracted, that could - together with other personalized surveillance info (like the usual adware stuff) - be aggregated to give a bigger picture.

I have IP behind the geolocation. How do you think that I know the geolocation? It’s an IP lookup. My interface that I shown in the image just doesn’t publish it because I don’t care personally. What I use that service for is simply to track where sensitive emails/documents go. Not to track lemmy. I don’t need specific resolutions. Just to know if they leak outside of what I expected.

Device patterns? The app you use is the app you use. That would be given away via your browser header. I also collect that with the tracking image. Just once again. Not shown in the graph cause I don’t care to track it personally (I’m only doing this as an example, not to actually aggregate data).

If you use lemmy over the web browser, browsers don’t really give up that much information unless you’re google themselves. In which case apparently chrome gives up a boatload of information to google’s domains.

not-so-public information

You’d have to give me an example of any of what you’re referencing. I can collect IP, web headers, access times, and if I tag enough pages or mark the image as non-cacheable could even see multiple views/accesses (you see views higher than actual visitors) I can track your movement across all of the fediverse.

that one can get some info about me through my (public) actions

Simply “viewing” the page (which pulls the image and is not necessarily “public”) is a direct rebuttal to obtaining data that isn’t “public”.

instance owners have quite a lot more information on their user’s activities

Not really. Only thing additional that could be identified is browsing patterns while on the site itself. I don’t think it’s that valuable. You likely already gave up what you’re likely to see by commenting in communities. That’s going to be tracked best through a proxy or something, not lemmy itself. And can even be tracked externally through other means. Ex: This post has a tracking image on it and because you need to connect to me to load it I now see everyone that had loaded this comment. So this can be done externally without even being an instance owner. Click view source to see it at the end of the post.

Votes are federated, kbin instances see them as “likes” publicly. Messages are federated, sent in clear text. And posts that are loaded can be tracked via other means… Think of sites that display ads… They do this exact thing and collect information by the boatload because they can inject on every page that shows an ad. Without needing to be an admin on the site itself.

Edit: In theory someone could canvas/comment on every post with a bot and embed tracking images everywhere. Rotate usernames doing it from different servers and rotate through domains that are all cnamed back to the same tracking node and you could attack the whole fediverse with this type of tracking. Probably already being done… But it would be visible in that we have the ability to check source of each comment. But who the hell is going to take the time to do that?

Edit2: Here’s example of what was collected with that embedded image. Keep in mind that this type of tracking can happen with REAL images as well, making it impossible to track. And I’m specifically not tracking much of anything. But things like IP address used to access is on the backend. There’s also Browser, OS, referrers… etc…

Correct. Canada and Mexico BOTH have “closed” borders and don’t just accept immigrants. In Mexico you cannot get citizenship and cannot own property. Canada actively complains to our sheriffs on the northern border for letting people go over to the north.

Americans need to clean up their own shit before assuming their self-assigned role as world police.

Not self-assigned when USA was the only serious country paying into NATO. Every other country failing to pay into NATO makes USA the de-facto police. Fortunately other countries have understood that and are now starting to pay more into NATO these days.

Every network manufacturer has had some CVE for something.

You’re thinking of extinction levels, I assume.

Absolutely. When some species go extinct (deer would effectively be completely destroyed in a year as an example), it has much further ringing effects through other species. At the rates we farm meat at the moment, I doubt “nature” could even supply (let alone “keep up”) for a few years. Then we’ll have knock on effects for a few more years before everything is just unrecoverably screwed.

A lot of people out there cannot do the vegan thing. There are good reasons. Let’s just advocate for a couple of things eat less meat when possible (pick up a salad or something for a couple meals a week. And switch to more sustainable meats when possible, chicken is less ecologically damaging than steak pound for pound as an example.

The weird push for “vegan only” is one that can never work… and in the process of forcing it to work, will likely cause WAY more damage than we’re currently doing, even if we only look at human behaviors.

Personally… I’d be much more worried about native animal populations if meat is banned. Eg… take away steak at the supermarket, and you might find that people will just start hunting a lot more.

Fuck off with this hYpOcRiSy bullshit

I don’t even find it hypocritical… I’d be sad too if I couldn’t eat the fish… It could have at least died to fit in my belly rather than just dying for no good reason.