@timsweeneyepic (credit to nini for remaking nyctba)

scrapers pretend to be browsers
browsers pretend to be scrapers
​:neocat_shocked:​

jokes aside, the switch pro controller is almost a perfect controller

the only things i’d change are the texture of the d-pad and making the triggers analog

tag yourself (cont. in replies)

World's most obvious rage bait on Steam discussions getting more awards in 5 hours than I got in the last 3 years of making workshop add-ons.
:neofox_floof_explode:

discord is like the top reference guide for how NOT to design an interface

🔁 Bachelor's thesis survey! Please boost! 🔁

As many of you already know, I'm a cognitive science student currently working on my bachelor's thesis about the relationship between internet users' identities and their online personas.

Specifically, I want to see how that relationship might be different for cis and trans individuals, as well as for entities with non-human identities.

I prepared a short survey to collect the data I'll need for the thesis and I would greatly appreciate it if you take the time to answer it and share it around, both on fedi and elsewhere! It is meant for individuals of all gender identities and ages and shouldn't take more than 15 minutes to complete.

Thank you for your time :)

https://docs.google.com/forms/d/e/1FAIpQLScWipDB0eBPd6T3qgs63QTil9CdlnyaTlte5c2qtx-Iagdl_Q/viewform?usp=dialog

why isn't it illegal to sell all-in-one PCs that can't act as a general purpose display input

... what the fuck.

@GlitchyZorua @sylventic regarding this site, there is a script served from cdncozyantitheft.addons.business and also a script served in the HTML too.

their "anti theft" script breaks common text editing (preventing keydown events when ctrl or meta are pressed)

if you're wondering how I found that, I just ran something like KeyboardEvent.prototype.preventDefault = () => console.trace()

@GlitchyZorua @sylventic this is stupidly easy to bypass, I have an extension installed that can ignore functions that only call debugger
it's called "Anti Anti Debug", though it can break some sites

EDIT: My personal fork of the extension is kinda busted. There is a button you can natively press in the dev tools that turns off debugger statements entirely which is better in 99% of cases.

has the F1 For Help hotkey literally ever helped anyone in the history of computing

How it feels to have executive dysfunction

@shortridge While working tech support, I got a call on a Monday. Some VPNs which had been working on Friday were no longer working. After a little digging, we found the negotiation was failing due to a certificate validation failure.

The certificate validation was failing because the system couldn’t check the certificate revocation list (CRL).

The system couldn’t check the CRL because it was too big. The software doing the validation only allocated 512kB to store the CRL, and it was bigger than that. This is from a private certificate authority, though, and 512kB is a *LOT* of revoked certificates. Shouldn’t be possible for this environment to hit within a human lifespan.

Turns out the CRL was nearly a megabyte! What gives? We check the certificate authority, and it’s revoking and reissuing every single certificate it has signed once per second.

The revocations say all the certificates (including the certificate authority’s) are expired. We check the expiration date of the certificate authority, and it’s set to some time in 1910. What? It was around here I started to suspect what had happened.

The certificate authority isn’t valid before some time in 2037. It was waking up every second, seeing the current date was after the expiration date and reissuing everything. But time is linear, so it doesn’t make sense to reissue an expired certificate with an earlier not-valid-before date, so it reissued all the certs with the same dates and went to sleep. One second later, it woke up and did the whole process over again. But why the clearly invalid dates on the CA?

The CA operation log was packed with revocations and reissues, but I eventually found the reissues which changed the validity dates of the CA’s certificate. Sure enough, it reissued itself in 2037 and the expiration date was set to 2037 plus ten years, which fell victim to the 2038 limitation. But it’s not 2037, so why did the system think it was?

The OS running the CA was set to sync with NTP every 120 seconds, and it used a really bad NTP client which blindly set the time to whatever the NTP server gave it. No sanity checking, no drifting. Just get the time, set the time. OS logs showed most of the time, the clock adjustment was a fraction of a second. Then some time on Saturday, there was an adjustment of tens of thousands of seconds forward. The next adjustment was hundreds of thousands of seconds forward. Tens of millions of seconds forward. Eventually it hit billions of seconds backwards, taking the system clock back to 1904 or so. The NTP server was racing forward through the 32-bit timestamp space.

At some point, the NTP server handed out a date in 2037 which was after the CA’s expiration. It reissued itself as I described above, and a date math bug resulted in a cert which expired before it was valid. So now we have an explanation for the CRL being so huge. On to the NTP server!

Turns out they had an NTP “appliance” with a radio clock (i.e, a CDMA radio, GPS receiver, etc.). Whoever built it had done so in a really questionable way. It seems it had a faulty internal clock which was very fast. If it lost upstream time for a while, then reacquired it after the internal clock had accumulated a whole extra second, the server didn’t let itself step backwards or extend the duration of a second. The math it used to correct its internal clock somehow resulted in dramatically shortening the duration of a second until it wrapped in 2038 and eventually ended up at the correct time.

Ultimately found three issues:
• An OS with an overly-simplistic NTP client
• A certificate authority with a bad date math system
• An NTP server with design issues and bad hardware

Edit: The popularity of this story has me thinking about it some more.

The 2038 problem happens because when the first bit of a 32-bit value is 1 and you use it as a signed integer, it’s interpreted as a negative number in 2’s complement representation. But C has no protection from treating the same value as signed in some contexts and unsigned in others. If you start with a signed 32-bit integer with the value -1, it is represented in memory as 0xFFFFFFFF. If you then use it as an unsigned integer, it becomes the value 4,294,967,296.

I bet the NTP box subtracted the internal clock’s seconds from the radio clock’s seconds as signed integers (getting -1 seconds), then treated it as an unsigned integer when figuring out how to adjust the tick rate. It suddenly thought the clock was four billion seconds behind, so it really has to sprint forward to catch up!

In my experience, the most baffling behavior is almost always caused by very small mistakes. This small mistake would explain the behavior.

@soop this thread has brought out Many Strong Opinions
I do not know if I will post my full opinion on what has been discussed in this thread yet

the grapheneos fedi account is like

how do you even describe their vibe

it transcends fosssib 🧵