Daily Shaarli
January 25, 2025
FFmpeg By Example is a documentation website to showcase all the unique and different ways to use FFmpeg.
Loading a ressource can deanonymise a user:
- Cloudflare CDN shares the nearest airport in its HTTP header Cf-Ray
- A favicon cache works: "Since everytime you load their site, your browser automatically downloads this favicon, this means a user from each one of this locations has visited the Namecheap.com site within the 5 minutes with the last visit from Tokyo, Japan.". So if you lead a specific content created only to target one user, you can know from which data center the content is loaded (and its nearest airport).
- As Signal uses Cloudflare caching for the attachments, the same attack can be exploited.
With an innocent-looking attachment, an attacker can deanonymize users and find their location within an approximate radius (tens of miles, depending of the datacenters).
It works only if the user clicks to download the attachment in this case.
- Push notification of Signal with an image can trigger the cache... So a 0-click exploit can exist.
If the target has push notifications enabled (which it is by default), they don't even have to open the Signal conversation for their device to download the attachment. [...]
An attacker can run this deanonymization attack any time and grab a user's current location without a single interaction.
A similar exploit can be used on Discord with custom emojis: the custom emoji is a custom content downloaded by one user.
Conclusion:
his attack can be used to track Signal accounts, correlate identities, find employees meeting with journalists and much more.
Any app using a CDN for content delivery and caching can still be vulnerable if the proper precautions aren’t taken.
This platform shipped in Firefox 133 to provide alt text for images in PDF.js, and will be used in several other places in Firefox 134 and beyond to improve the user experience.
Many Tasks are available in the browsers, exposed in browser.trial.ml
.
About becoming vegetarians and vegan.
There’s a lot more I can say, but I’ve found the most powerful lever was moral consistency.
Wer auf einer politischen Bühne bei einer politischen Rede vor einem teils rechtsextremen Publikum den rechten Arm schwungvoll und mehrmals schräg in die Höhe reckt, macht den Hitlergruß.
Suivi de réflexions de https://n.survol.fr/n/je-vous-salue:
Est-ce que ça peut être interprété comme un salut nazi ?
Est-ce que c’est crédible dans le contexte ?
Est-ce que c’est assumé par l’auteur ?
Est-ce que c’est volontaire par l’auteur ?
Est-ce que c’est prémédité par l’auteur ?
an interactive tutorial series on building realtime collaborative applications using the Yjs CRDT library.
A startup claims to use AI to automate browser navigation on Reddit. The software will be able to use Reddit alone.
Where are the human users in this mess AI is creating?
Developers want to keep getting paid for what they already know and use. We worry that today’s optional technology will become tomorrow’s job requirement. That fear isn’t irrational - look at job boards today and count how many React positions you see compared to jQuery.
Qu'est-ce qu'on pourrait faire de mieux avec 500 milliards?
Développer des infrastructures, faire avancer la recherche médicale, régler la famine de certaines populations, créer des boucles de rétroactions vertueuses de la population see "UN argument égoiste en faveur d'un monde meilleur".
Je doute fortement que l'investissement dans l'IA soit le plus rentable à long terme pour la population
Autre interrogation : le Texas. Le choix de l’État, dans lequel Elon Musk concentre une partie de ses activités, est significatif. La Silicon Valley a été écartée, tout comme des États plus froids. Les centres de données, en plus de leur voracité en énergie, sont en outre très consommateurs d’eau, dont la présence ne brille pas spécialement au Texas.
TILs (Today I Learned) are useless, have terrible signal-to-noise ratio, create FOMO.
True, but they are not meant to be the best raw material ever made. They are made to add some randomness in your feeds (or way your consume news or content). They are personal. They don't share or are structure as a lesson. Most of the TILs I read are on Mastodon, toots shared on the fly because someone learned something. The tag Today I Learned is missing, but it remains a TIL nonetheless.
TILs are a way to discover things. Why on earth do you need some random facts to spark your interest in something?
Good point.
There are other advantages to the TILs. They can be read on the fly, in public transportations. They don't need focus or immersion as a fiction book needs.
I think in between: a majority of TILs is undesirable, a few can be useful. A balance is healthy. It is sometimes convenient to put your concentration aside, and distract yourself while reading something short.