Daily Shaarli

All links of one day in a single page.

January 25, 2025

Migrating from TypeScript to Rust | corrode Rust Consulting
IA : L’éléphant dans le couloir – Carnet de notes
Traduire du code C en Rust « safe » ? Deux chercheurs l’ont fait - Next
The Joy of Under-Engineering - Ham Vocke
FFmpeg By Example

FFmpeg By Example is a documentation website to showcase all the unique and different ways to use FFmpeg.

Unique 0-click deanonymization attack targeting Signal, Discord and hundreds of platform

Loading a ressource can deanonymise a user:

  1. Cloudflare CDN shares the nearest airport in its HTTP header Cf-Ray
  2. A favicon cache works: "Since everytime you load their site, your browser automatically downloads this favicon, this means a user from each one of this locations has visited the Namecheap.com site within the 5 minutes with the last visit from Tokyo, Japan.". So if you lead a specific content created only to target one user, you can know from which data center the content is loaded (and its nearest airport).
  3. As Signal uses Cloudflare caching for the attachments, the same attack can be exploited.

With an innocent-looking attachment, an attacker can deanonymize users and find their location within an approximate radius (tens of miles, depending of the datacenters).

It works only if the user clicks to download the attachment in this case.

  1. Push notification of Signal with an image can trigger the cache... So a 0-click exploit can exist.

If the target has push notifications enabled (which it is by default), they don't even have to open the Signal conversation for their device to download the attachment. [...]
An attacker can run this deanonymization attack any time and grab a user's current location without a single interaction.

A similar exploit can be used on Discord with custom emojis: the custom emoji is a custom content downloaded by one user.

Conclusion:

his attack can be used to track Signal accounts, correlate identities, find employees meeting with journalists and much more.
Any app using a CDN for content delivery and caching can still be vulnerable if the proper precautions aren’t taken.

Migrating from Python to Rust | corrode Rust Consulting
Running Inference In Web Extensions

This platform shipped in Firefox 133 to provide alt text for images in PDF.js, and will be used in several other places in Firefox 134 and beyond to improve the user experience.

Many Tasks are available in the browsers, exposed in browser.trial.ml.

Being better

About becoming vegetarians and vegan.

There’s a lot more I can say, but I’ve found the most powerful lever was moral consistency.

Elon Musk: Ein Hitlergruß ist ein Hitlergruß ist ein Hitlergruß | ZEIT ONLINE

Wer auf einer politischen Bühne bei einer politischen Rede vor einem teils rechtsextremen Publikum den rechten Arm schwungvoll und mehrmals schräg in die Höhe reckt, macht den Hitlergruß.

Suivi de réflexions de https://n.survol.fr/n/je-vous-salue:

Est-ce que ça peut être inter­prété comme un salut nazi ?
Est-ce que c’est crédible dans le contexte ?
Est-ce que c’est assumé par l’au­teur ?
Est-ce que c’est volon­taire par l’au­teur ?
Est-ce que c’est prémé­dité par l’au­teur ?

Learn Yjs by Jamsocket

an interactive tutorial series on building realtime collaborative applications using the Yjs CRDT library.

Oh No, This Startup Is Using AI Agents to Flood Reddit With Marketing Slop

A startup claims to use AI to automate browser navigation on Reddit. The software will be able to use Reddit alone.
Where are the human users in this mess AI is creating?

Framework Fatigue: The Real Reason Developers Get Angry About New Tech

Developers want to keep getting paid for what they already know and use. We worry that today’s optional technology will become tomorrow’s job requirement. That fear isn’t irrational - look at job boards today and count how many React positions you see compared to jQuery.

Allow arbitrary URLs, expect arbitrary code execution | Positive Security
sauravpanda/BrowserAI: Run local LLMs inside your browser
Intelligence artificielle : Stargate, le projet fou américain à 500 milliards de dollars - Next

Qu'est-ce qu'on pourrait faire de mieux avec 500 milliards?
Développer des infrastructures, faire avancer la recherche médicale, régler la famine de certaines populations, créer des boucles de rétroactions vertueuses de la population see "UN argument égoiste en faveur d'un monde meilleur".

Je doute fortement que l'investissement dans l'IA soit le plus rentable à long terme pour la population

Autre interrogation : le Texas. Le choix de l’État, dans lequel Elon Musk concentre une partie de ses activités, est significatif. La Silicon Valley a été écartée, tout comme des États plus froids. Les centres de données, en plus de leur voracité en énergie, sont en outre très consommateurs d’eau, dont la présence ne brille pas spécialement au Texas.

TILs are junk food

TILs (Today I Learned) are useless, have terrible signal-to-noise ratio, create FOMO.

True, but they are not meant to be the best raw material ever made. They are made to add some randomness in your feeds (or way your consume news or content). They are personal. They don't share or are structure as a lesson. Most of the TILs I read are on Mastodon, toots shared on the fly because someone learned something. The tag Today I Learned is missing, but it remains a TIL nonetheless.

TILs are a way to discover things. Why on earth do you need some random facts to spark your interest in something?

Good point.

There are other advantages to the TILs. They can be read on the fly, in public transportations. They don't need focus or immersion as a fiction book needs.

I think in between: a majority of TILs is undesirable, a few can be useful. A balance is healthy. It is sometimes convenient to put your concentration aside, and distract yourself while reading something short.