duckduckfedi does anyone have that "cis guy shocks doll by ordering in perfect awawa" post. can't fucking find it.

playing around with sha256 git repos now that lix (HEAD, for the time being) supports em, and codeberg has for a while now

seems like there's no migration path at the moment for any repo that has submodules in it, since mixed object formats don't seem to be supported?

if you don't have submodules and don't care about breaking hashes, then you can pretty easily git fast-export | git fast-import between object formats

look inside supposedly open standard

paywalled spec (no, "but we have a reference implementation!" doesn't fucking count)

hello jpeg/jxl. hello c/c++. was going to say png is fine but it links to some normative references paywalled by iso and others. the fuck you mean you're charging money to tell me what sRGB is? fuck offfff

making a font with :3 as a ligature to center it

on that note if anyone can think of any way to do streaming hash verification of downloads that doesn't involve "buffer it into RAM" or "ask the user to accept a permission prompt to give access to some place on disk"(it should just act like a normal download), that would be cool

it poked at this a while back and it would be possible with https://developer.mozilla.org/en-US/docs/Web/API/Streams_API as long as there's a way to pass a stream directly to a "treat this file as if you downloaded it" thing.... which doesn't seem to be the case?

posting an incorrect sha256 on a website with a download link and seeing how long it takes anyone to notice

the world if SRI attributes applied to download links (so you can safely link to mirrors and have the browser check the hash for you)

thinking about e2ee chat key verification

does OMEMO not have a concept of user keys, just device keys? that seems suboptimal

since if Alice trusts Bob.Desktop, and Bob.Desktop mutually trusts Bob.Phone, there'd be no issue with treating it as if Alice trusts Bob.Phone, right?

i'm not sure how useful users assigning trust on a per-device basis as opposed to per-identity key (which every device holds a copy of. or you do cross-signing to build a chain back to the first device trusted and use that, either one works.)

do xmpp users make use of this property in practice?

body horror? as far as it's concerned, all "having a body" is horror.

okay it's not a straight upgrade because if you use nix flake update --commit-lock-file the url you get back is so fucking long

compare:

• Updated input 'home-manager':
    'github:nix-community/home-manager/f772b7f968365e7b2b70a860c509d214639556fe' (2026-08-31)
  → 'github:nix-community/home-manager/693e8ce0fb240a73c116a03cfd7b19269c87af88' (2026-09-04)

with:

• Updated input 'nixpkgs':
    'https://releases.nixos.org/nixos/unstable/nixos-26.11pre1064949.34ab99075ac4/nixexprs.tar.zst?lastModified=1788179007&narHash=sha256-maQBa7XmWJ%2Ba6te4QwF%2B%2BR1FIXUrjvki0AtGOOhyZn0%3D&rev=34ab99075ac4f7e40cf037eef32cb1c360bb85e9
026-08-31)
  → 'https://releases.nixos.org/nixos/unstable/nixos-26.11pre1066703.0968519e14f7/nixexprs.tar.zst?lastModified=1788404924&narHash=sha256-gxryTzdoDQLrvPdYp8cSbxXpB/LDhaQhiJFCmkqVugw%3D&rev=0968519e14f7aa7d3e9b389682bd74d2b51c8ce8' (202

(yes it's cut off, it was too long to fit on a full screen terminal. the point stands.)

also fun nix PSA: https://discourse.nixos.org/t/psa-use-nixos-org-tarballs-for-your-flake-inputs/79950

using the nixos.org tarballs (which are a straight(and perhaps even gay) improvement on fetching them from github) also means you don't need to use https://github.com/nix-community/nix-index-database in order to get command-not-found functionality. one fewer flake input, yipee. (especially one fewer flake input that's on github)

(yeah, it doesn't let you query for files as opposed to binaries, but that's fine for my use case. i just want to be told what packages provide a given binary)

does anyone have an example of triple base64 inside some protocol

where, to get from the bytes on the wire to some data, you need to (alongside decryption presumably), expand base64 three times

matrix has double base64 if you send an attachment in an encrypted room, where the first layer is the outer encryption, and the second layer is the base64ed key/iv/hash/etc

can we go 1 higher

richard nixos

does anyone have SSG opinions. currently using zola. is it worth migrating to latest zola or moving to $SOMETHING_ELSE

(ideally something packaged in nixpkgs)

emails leak:

[AO3] new deltarune fic chapter
[energy company] "read your fucking power/gas meter"
[AO3]*12 more various chapters of various levels of fucked up-edness

watching heavily modded (ultrakill) cybergrind is a trip

"no no, i play better with enemy voices on, full screen parry meme images, and fucking 10 DVD screensavers bouncing across my screen"

harm reduction? no i'm a harm increaser. harm maximalist. going to escalation training tomorrow.

e2ee chat design principles for what it's working on, some apply outside of that, feel free to challenge/ask for elaboration

• identity key fingerprints in usernames. don't make your server a CA
• rooms being distributed between servers would be nice, but is a really hard problem. don't bother for now
• likewise, federation isn't relevant. talk directly to the servers you need to, proxied.
• the server component that has to work, handling messages, should be as small scope as possible. non-critical stuff(media) goes on a different server, possibly even unrelated(sender-chosen)
• unauthenticated group message send/fetches. leave it up to the e2ee to filter out messages from non-members, ratelimit if needed. this reduces metadata stored
• message deletion/history on join is a per-group decision, "e2ee but you get a day of past history on join" is better than plaintext
• control over who can message you/join is important when identities are cheap and servers can't see content or moderate. "invite links" only?

irc servers are a machine that turns /connects with its username into [432] 4fbb09 Erroneous Nickname

wondering why every irc server has a hardon for fuckass name restrictions. "can't start with a number" is common(pretty much universal). hackint's anonymous registration says "Your accountname has to be lowercase letters." and they mean entirely. not start with.

sigh

infostealers don't even try anymore they just ship an entire fuckass copy of node.exe and make you download a 140MB binary to steal one discord token

Lately you’ve posted about #include. Add these as featured hashtags?