smiletolerantly

joined 2 years ago
[–] smiletolerantly@awful.systems 4 points 3 days ago (1 children)

That ks for sharing this, this is fascinating.

Maybe the underlying rule is: the more you know about something, the more you are aware of its flaws, making the alternatives you know less about more attractive?

I don't really know, sorry :(

If you want to migrate, is going conduit - conduwuit - continuwuity (first version) - continuwuity (current version) maybe an option?

[–] smiletolerantly@awful.systems 1 points 3 days ago (2 children)

I went with continuwuity and am happy with it. Development happens at a steady pace, with sane priorities. The server is stable and I haven't had any issues to speak of, despite one minor bug that got resolved very quickly after creating an issue.

[–] smiletolerantly@awful.systems 9 points 3 weeks ago (1 children)

Did they still not release the actual torrents though?

[–] smiletolerantly@awful.systems -2 points 3 weeks ago (2 children)

And why would they implement it in a somewhat private manner if it could be implemented in a privacy-infringing manner?

I honestly don't think most democratic governments have an interest in making this privacy-infringing. Lobbyists/companies on the other hand... But all the more reason to write legislation that ensures age verification must be handled like this.

That already tells the government that I’m accessing porn because why else would I need to confirm I’m an adult online?

Cinema rickets for FSK18 movie? Ordering alcohol? Gambling? Renting a car?

Basically anything you're only allowed to do as an adult.

But that's kind of why I mentioned, it's just one rough draft for such a protocol.

[–] smiletolerantly@awful.systems 11 points 3 weeks ago

It should be Dot Dot! But it's Dot Dot Dot! - sanest Bitchard moment

[–] smiletolerantly@awful.systems -2 points 3 weeks ago (4 children)

It’s mostly just that I don’t want the government to know precisely which websites I visit. Nor do I want the the porn sites to know exactly who I am.

I understand, I want that too. It's easily possible though (just one example for a scheme):

  • you visit porn site
  • porn site sends your browser a random nonce
  • you/browser tell government service: sign this if I'm >18
  • government signs the nonce + a timstamp to prove freshness
  • your browser forwards the result to the porn site
  • porn site can verify signature per standard public certificate chains
  • now porn site has proof that you are >18, but knows nothing else about you; and government only knows that you wanted proof that you are an adult, but not for what site or purpose you wanted to prove that

Alternatively, if we go the "device has an age bracket field browsers access" route, it's even simpler, and just as if not more privacy preserving.

[–] smiletolerantly@awful.systems -4 points 3 weeks ago (6 children)

In that case: sorry to blow up on you. I have seen to many comments on here claiming these things while being 100% serious. I just saw your comment and incidentally had time to write the above for once, so, here we are.

I agree that there's no way to completely cut teens off from porn. Your torrent example is perfectly demonstrating this.

But I also do not understand the current outrage at anything trying to improve the situation, even when it's not some stupid "scan your face" scheme.

[–] smiletolerantly@awful.systems -5 points 3 weeks ago

I'd also like to think so. In this case though, this was clearly not what was intended, and also involved a lot of porn.

[–] smiletolerantly@awful.systems -5 points 3 weeks ago (12 children)

So let me get this straight:

When I was 13, I managed to figure out the router password, disabled child protection for myself, then watched porn on my Android 2.3 phone that I had managed to put a custom ROM on because I liked the way it looked and had no idea what a "launcher" was yet.

This is not a hypothetical btw.

My parents were smart enough to enable appropriate blocking and secured access to those settings. I'm not sure something on-device was available at the time, but I included the bit about the custom rom to demonstrate that, even though I didn't know WTF I was doing, I was more than capable of fucking around with the tech to get it to do what I wanted.

So were my parents in breach of their duties on child protection?

I don't think they were. They actually did educate themselves (visiting a course / parent meetup to discuss and learn how to protect me from the Internet), and implemented everything they learned.

I was just a little shit and found a way around this.

And this is NOT an edgecase. Because guess what. It takes one kid in the friend group to figure out a way to circumvent parental controls, and then EVERYONE knows how to do it.

It simply does not fucking matter how well intentioned, knowledgeable, and present the parents are (mine were all of that).

Going "this would not be a problem if parents parented" is the LAZIEST fucking excuse, and I'm sick and tired of reading about it on here.

(Because I probably have to make it clear: I'm not advocating for photo/passport scanning, third party age verification,... and all that bullshit. What I think would be a FANTASTIC idea would be privacy-preserving age verification. There are two good ways to do this: 1) on a login attempt, prove that you are of age by presenting a fresh, signed token from a government service proving that you are over 18, and nothing else; site does not get any info, government does not know what you were trying to access; 2) a device-level age field. Proof here comes from the device itself, and can be 100% privacy preserving; just a "yep, is of age". In this scenario... GUESS WHAT, PARENTS GET ENABLED TO PARENT "PROPERLY" BY PROVIDING THEM WITH A GOOD, SIMPLE, PRIVACY-PRESERVING TECHNICAL SOLUTION.)

Yes... But also you do need feeling/experience/skill. For example, one of the bread recipes I'm still often making, I've been using completely unchanged since I started learning how to make bread. The ingredients (flour, water, yeast/sourdough, salt) and their amounts have not changed.

Yet the result today is far better and more consistent than back then.

That's because time, room temperature, humidity,... are just as important. And before you say "that, too, is chemistry": yes, it is, but these are not variables most people can accurately measure or influence in a scientific way.

Instead, you quickly develop an intuition for how these things relate and come together.

A skill, so to speak.

[–] smiletolerantly@awful.systems 32 points 4 weeks ago

Federated ForgeJo can't come soon enough.

 

Not an ad, I'm not involved with Bento (or Stirling, for that matter). I've been unhappy with Stirling for a while (why do documents need to be uploaded to the server? That makes it really hard to safely host publicly. Why is it so slow? Plus, too many things are put behind a fucking paywall).

Learned about Bento this morning, tried it out, really liked it, spent an hour today packaging it for nixpkgs. It doesn't quite have feature parity with Stirling yet, but at least for me, everything I need is there, it's fast, and it keeps processing in the browser. Like, not even joking: the output of the build process/nixpkg are just a couple of static HTML files and some WASM. No server-side components at all. Really refreshing to see.

 

A while back I played a round with the HASS Voice Assistant, and pretty easily got to a point where STT and TTS were working really well on my local installation. Also got the hardware to build wyoming satellites with wakeword recognition.

However, what kept me from going through the effort of setting everything up properly (and finally getting fucking Alexa out of my house) was the "all or nothing" approach HASS seemingly has to intent recognition. You either:

  • use the build in Assistant conversation agent, which is a pain in the ass because it matches what your STT recognized 1:1, letter by letter, so it's almost impossible to actually get it to do something unless you spoke perfectly (and forget, for example, about putting something on your ToDo list; Todo, todo, To-Do,... are all not recognized, and have fun getting your STT to reliably generate the ToDo spelling!), or
  • you slap a full-blown LLM behind it, either forcing you to again rely on a shitty company, or host the LLM locally; but even in the latter case and on decent (not H100, of course, but with a GPU at least) hardware, the results were slow and shit, and due to context size limitations, you can just forget about exposing all your entities to the LLM Agent.
  • You also have the option of combining the two approaches; match exactly first, if no intent recognized, forward to LLM; but in practice, that just means that sometimes, you get what you wanted ("all lights off" with a 70% success rate, I'd say), and still a lot of the time you have to wait for ages for a response that may be correct, but often isn't from the LLM.

What I'd like is a third option, doing fuzzy matching on what the STT generated. Indeed, there seems to have been multiple options for that through rhasspy, but that project appears to be dead? The HASS integration has not been updated in over 4 years, and the rhasspy repos are archived as of earlier this month.

Besides, it was not entirely clear to me if you could just use the intent recognition part of the project, forgoing the rest in favor of what HASS already brings to the table.

At this point, I am willing to implement a custom conversation agent, but wanted to make sure first that I haven't simply missed an obvious setting/addon/... for HASS.

My questions are:

  • are you using the HASS Voice Assistant without an LLM?
  • if so, how do you get your intents to be recognized reliably?
  • do you know of any setting/project/addon helping with that?

Cheers! Have a good start into the working week...!

 

If you've been selfhosting conduit or conduwuit, you probabl are aware that the conduwuit project was discontinued a couple months back.

I've been holding out on updating my matrix homeserver until it becomes clear which fork(s) will survive long term.

I feel like I can't put off updating for much longer now, plus the tuwunel nixpkg and -module were merged yesterday, so now the two most promising forks are both options for me.

Still, I'm unsure what route to take. Here's my thoughts:

  • not going through another round of this in a couple of months from now would be great, so stability and long-term maintenance promises would be great
  • I assume incompatibility between the forks, if not now then very soon; this is a "pick an option, then stick with it and pray" situation
  • tuwunel apparently has a full-time paid dev working on it now, which is great; at the same time, that means features will follow the priorities of the (as of now unknown) sponsor of the project
  • it is, however, the officially endorsed successor
  • it also seems like few other people are actively involved, putting in question development practices, reviews, and what happens should the lead dev throw in the towel
  • lastly, while there's been a lot of apparently rapid progress (with releases 1.0.0, 1.1.0, and 1.2.0 at quite a fast pace), the repo itself seems... empty? Few issues, few PRs, commentlessly-deleted issues
  • on the other hand, continuwuity seems more active by commit/contributors count, but is seemingly 100% volunteer work
  • they do seem to backport tuwunel changes and features, which is great!
  • they are not officially endorsed

In short: I fucking hate community drama. What fork did you go with? Is there anything else to consider? I just want an up-to-date matrix homeserver, and not to have to tell my users "sorry, starting from scratch because we picked the wrong fork..."

Update: there's been some back and forth on the nixpkgs PR, esp. one user who posted a lot of receipts here:

@scvalex @queeek180 @Askhalion you wanted links, here's some links :)

claim legitimacy over or de legitimise other projects:

https://matrix.to/#/#ping:maunium.net/$V9aN1Wn0pId-JWbxH1WV5I8PAVMajooX7WMFKmDyh6E
https://matrix.to/#/#ping:maunium.net/$IsfOfe8anRYqbRAwj7OdlX_hS-kBbHUJTVhQW-32Etk
https://matrix.to/#/#ping:maunium.net/$-Bswk96jj3ns8xpSISKH0Y24pXZ2Xcd6Rwl8mRZQIaM (ironic)
https://matrix.to/#/#meowlnir:maunium.net/$zOmf7-NIHfQ_f_Ku9Q794GeKyu8n9v2MAvPtYjlGJIE (ironic that he asked https://matrix.to/#/#meowlnir:maunium.net/$nE57Bi_DmvodZJe7JDPS7NxUBlxeDLUBhYIWNzgNk0g despite having cherrypicked a bunch of fixes from continuwuity already)
https://matrix.to/#/#tuwunel:grin.hu/$svIUeuWfm2VWuHGSUMeT5VWWcZclraKcmUaDK3NiYEM ("June and I dealt with another "continuwuity" called "grapevine" last year")

threats against the project:

https://matrix.to/#/#ping:maunium.net/$o27P102ebbFa9U80e-FK-DxGTupy8IJ3TSWFYJm6hIs
https://matrix.to/#/#ping:maunium.net/$priRlTsBuH2YfTo_pb04xHUJpTeU2DKXdJ7tAVrR5w4

personal threats:

https://matrix.to/#/#ping:maunium.net/$5YefXN_uVR5WiGfj32j3Po9Q1JMKuTTfxve_8IHp1J8
https://matrix.to/#/#ping:maunium.net/$L-dXYMXucfJiLkyc5dvv4t7pQqUKMwnLEd9zzLjZlu0

attempting to get security details released early (knowing only he and three other servers have finished implementing):

https://matrix.to/#%2F%21NasysSDfxKxZBzJJoE%3Amatrix.org%2F%24_d2wJk45JtwblMHRVBdfeEV1cAU5flPuRebTAvfOr-s%3Fvia=nexy7574.co.uk&via=matrix.org&via=element.io
https://matrix.to/#/#tuwunel:grin.hu/$mgi2dDGnL-L9Jqjm_YZPhu4NoAx8q3OMF9KIfRiGwFs

other trivia:

Jason getting his server ACL'ed from all foundation rooms:
https://matrix.to/#/!WuBtumawCeOGEieRrp:matrix.org/$u8YRBq_s-OrOpl4IGt15iUHPBKubKa4A_n-u_WbgqAU` - zemos.net ban
https://matrix.to/#/!WuBtumawCeOGEieRrp:matrix.org/$l8pKC-mR0tjLFnbnmi_8xSXbHGA3vgew-QTRWAk-kCs - wildcard ban on his domain

if any of these events get redacted, feel free to reach out and I will provide the original events - unredacted. just as another layer of certainty, when i provide the events, you can verify the server signing keys yourself, fairly trivially, as well as calculate the event ID (which is a hash). fetching the event from your $CONDUWUIT_DESCENDANT homeserver is as simple as running @conduit debug get-pdu $id in your admin room, as well as checking validity with @conduit debug verify-json or @conduit debug verify-pdu.

UPDATE: i've just been informed json signing is based on the redacted event, not the full input.

Honestly, that first link is all the info I needed. Keep reading, <100 messages and it becomes clear that I do not want to put the continuation of my homeserver into Jasons/tuwunels hands. Going to migrate to continuwuity later today.

view more: next ›