• 0 Posts
  • 292 Comments
Joined 1 year ago
cake
Cake day: February 10th, 2025

help-circle

  • That’s pretty slick.

    It looks like they’re ‘just’ creating 2d planes and attaching Wayland Surface or TopLevel (Desktop, App, respectively).

    I use XSOverlay and you can attach individual windows to the overlay (VR Smartwatch, kinda). This seems like a much more in-depth extension of that.

    Attaching individual applications is way better than the whole desktop in my experience. The desktop experience works well with a high resolution monitor… but in VR headsets you’re still resolution limited, so having JUST the application window can make it much easier to read/navigate.

    The only feature that I would like is the ability to pin windows to specific locations. I’d like to be able to pin a HomeAssistant application window over my thermostat, or have a monitor displaying the feed from my security camera next to my front door, etc.

    There are already virtual desktop applications that can do the desktop/windows trick, but they all seem to be anchored on you instead of being aware of the space that you’re in.



  • The goalposts didn’t shift, you started talking to a different person.

    This person says that this issue is small, the impact of exploiting this system would be minor (if it ever happened), and the hypothetical attack on this subsystem is also demonstrably not occurring.

    Therefore, treating this issue as if it were some sort of red-line issue or, really, even worth discussing outside of the context of the project itself (where changes can actually be implemented) is misrepresenting reality.


    As to your direct point, it wasn’t my point but I do agree with it so I’m happy to directly address your argument.

    The quote you seem to take issue with was :

    Wait, Digg gave the community to a Reddit moderator so Reddit could control the communities with the same name on both platforms? That’s wild.

    That’s also how the corporate side of Reddit works. Someone will register a subreddit, and then a bunch of related ones, so anybody who tries to use any of them has to follow the same set of rules — and if you piss off the wrong person in one, they can ban you from all of them. They can also use their “first” or “official” or even “user count” status to bully smaller subs into redirecting to them. Effectively centralising information.

    The Fediverse doesn’t work like that.

    Or, more plainly:

    The Fediverse doesn’t allow a single user to scoop up all of the similarly named/themed communities and use that power to dominate those topics of conversation.

    Your reply:

    Maybe Mastodon does not, but Lemmy, in particular lemmy.ml, works more like that than you realize. e.g. a change is soon going to give lemmy.ml veto power in what communities are allowed to be acknowledged as existing to new instances, which is baked right into the code and there is no way to change it. A third-party listing could have been used instead but… no, this is rather much more on-brand for the Lemmy developers to have chosen.

    Your reply references code affecting the Lemmy server instance, that runs once on server instantiation, which uses lemmy.ml as the source to populate the list of communities that users of the new instance will see when they click the ‘Communities’ link at the top. This is true.

    Your inference that lemmy.ml has the ability to veto what communities are allowed to be acknowledged as existing to new instances is a bit of hyperbole. Lemmy.ml is the source of the initial list, true.

    But new instances acknowledge communities existing regardless of those community’s status with lemmy.ml. The moment that a single user reads a single comment in a community that isn’t on the initially seeded list, then it appears in the new instance’s community list regardless of the status of that community on lemmy.ml.

    If we were a security researcher and were analyzing the scope of this problem we would consider that

    1. This only affects new instances, so the vast population of Lemmy as it stands now, is not affected by this code at all. Only a hypothetical future population.

    2. The list on lemmy.ml is not treated as authoritative. Outside of the initial values, lemmy.ml is not checked for any other functions related to adding or displaying communities

    3. Any attempts by lemmy.ml to game this system are both not happening and also easily detectable as the list is public and can be compared to other instances.

    So, this veto power isn’t being used. If lemmy.ml were attempting to leverage this power, it would be detectable. In the worst case, if were actively being exploited then it would affect very few people(none of the current Lemmy community), and the people that it did affect are impacted only until a user reads a comment or post from a ‘vetoed’ community.

    Also, this is an open source project so saying things like:

    and there is no way to change it.

    Simply make no sense at all.

    You can change it. Any admin who thinks it may be a problem can change it. I linked to the exact section of code where you can just change the URL and compile the .rs file again to use a different instance.

    You could change it so that the URL is read from the options file that the administrator sets prior to launching the instance. You could also submit that as a PR so that future administrators could just apply your patch (independent of it being accepted by Lemmy) because that’s how open source development works. That’s what the quote that you provided means:

    If you dont like it, fork it. Stop bothering us about it

    • Nutomic

    It sounds dismissive, because it is. This isn’t a product, you’re not a consumer. You’re going to people who donate their time and telling them to do work in a way that you want it done. They may agree, and you may be able to make good arguments to convince them but if they don’t, then brigading social media or spamming their issue tracker with requests isn’t going to get it done.

    If you don’t like it fork it and fix it. It is a fundamental concept in open source software that you can always fix problems that you see and other people can use your fixes regardless of what the project thinks. If you think the project is going in the wrong direction then you are perfectly within your rights to take a copy of the code and develop it in your own way and if you can find other people who believe like you do then they can use your changes as they see fit.

    But going online and misrepresenting the risk of some code update that you disagree with by exaggerating the scope of the problem isn’t how you get anything done except creating needless drama.



  • Yeah, for sure. Be aware, make your point known and offer alternatives… in the project that you want to change.

    Stirring shit on social media isn’t contributing.

    Create an issue in the issue tracker is free and takes as much time as writing a post on social media.

    This specific issue is something that is 1. Not an issue because the hypothesized ‘attack’ that’s available to lemmy.ml using this system is not being done and, if it was, would be easily detectable. 2. Trivial to change for any instance owner who wants to make another instance the source of their initial community grab. This code is ran once, when the instance first stands up, in order to receive a list of communities to populate the ‘Communities’ tab at the top and after that uses the exact same system as every other instance for adding and removing items from that list based on the local user’s subscriptions. It has no impact on existing servers or communities.

    The impact of this issue is currently non-existent and relies on a hypothetical situation that isn’t occurring. If the bar is that low for someone so that they will crash out on social media and swap projects, well that someone is going to be very busy swapping projects… because the FOSS world has an endless source of technical quibbles like this.















  • This brand of argument is basically ‘If you can’t do everything perfectly, then it is pointless to do anything especially the thing that you’re suggesting.’

    You see this person in every thread on every topic where people discuss things that they can contribute their expertise to. Their message is ‘it is hopeless, your plan won’t work, give up what you’re doing, you don’t stand a chance’.

    Honestly, and forgive the langue, but fuck those people. You know what your strengths are and what you’re capable of, not some faceless bot pushing violent political rhetoric who is, by its own admissions, not in the US.

    If you don’t want to participate in the tech landscape as it exists today, there is absolutely nothing wrong about avoiding it entirely and building something else. Companies will not be so complacent about their position in the market if they know there’s a completely Free alternative that does everything that they charge a subscription for.

    The people who are doing self-hosting today are exactly like the early adopters of the smartphone or any other technology. There’s always people trying new things and sometimes they succeed.

    People who are using privacy focused approaches to personal technology, like self-hosting, are beta testing the ability to use cheap, mass produced hardware and open source software to build a product ecosystem that meets their needs. That progress is enjoyed by anybody in the future who decides they also want to leave the walled gardens of Tech Giantopia.