Someone asked for an RSS feed for the security/privacy blog, I thought?

Well, hereby! There are three feeds:

https://much-security.nl/main.xml - a feed which is updated with both blog posts and external links relating to privacy/security I find interesting/useful.

https://much-security.nl/own.xml - a feed only containing the blogs posts themselves. For people who are only interested in that part.

https://much-security.nl/external.x... - a feed only containing external links. For people who'd like to stay updated on recent cyber security/privacy thingies.

Tracking: every time a feed is visited, a redis value for that feed get's incremented. No time, ip addresses, user agent or whatsoever is saved. Just one variable getting increased once.

New domain name will also be revealed soon (probs tomorrow, going to bed soon as I've just been sick) :D.

Oh and just a warning, the main/external feed are the only ones populated with exactly one item right now :P

So I built one of them Auto GPTs using Open Assistant and Python.

Essentially I have two chat rooms with each representing a different agent and some python written to facilitate the api communication and share messages between those two. Each agent is primed with a simple personality description, expected output format and a goal. I used almost identical inputs for both.

It boils down to "You are an expert AI system called Bot1 created to build a simple RPG videogame in python using pygame."

So anyway, I made that, and let it run for a couple of iterations and the results are just stunning, but not for the reasons you might expect. The short story is that they both turned into project managers discussing everything and anything *except* the actual game or game ideas and in the end they didn't produce a single line of code, but they did manage to make sure the project is agile and has enough documentation xD.

Presumably I need to tinker around with their personalities more and specify more well defined goals for this to lead to anything even remotely useful, but that's besides the point. I just thought others might find the actual conversation as funny as I did and wanted to share the output.

Here's a pastebin of the absolute madness they went through: https://pastebin.com/0Eq44k6D

PS: I don't expect anyone to read the whole thing word for word. Just scroll to a random point and check out the general conversation while keeping in mind that not a single line of code was developed throughout the entire thing

techie 1 : hey, can you give me access to X?
techie 2 : the credentials should be in the password manager repository
t1 : oh, but I don't have access to the password manager
t2 : I see your key A1B2C3D4 listed in the recipients of the file
t1 : but I lost that key :(
t2 : okay, give me your new key then.
t1 : I have my personal key uploaded to my server
t1 : can you try fetching it?
t1 : it should work with web key directory ( WKD )
t2 : okay
t2 : no record according to https://keyserver.ubuntu.com
t1 : the keyserver is personal-domain.com
t1 : try this `gpg --no-default-keyring --keyring /tmp/gpg-$$ --auto-key-locate clear,wkd --locate-keys username@personal-domain.com`
t2 : that didn't work. apparently some problem with my dirmgr `Looking for drmgr ...` and it quit
t1 : do you have `dirmngr` installed?
t2 : I have it installed `dirmngr is already the newest version (2.2.27-2)`
t2 : `gpg: waiting for the dirmngr to come up ... (5)` . this is the problem. I guess
t1 : maybe your gpg agent is stuck between states.
t1 : I don't recall the command to restart the GPG agent, but restarting the agent should probably fix it.
t1 : `gpg-connect-agent reloadagent /bye`

source : https://superuser.com/a/1183544
t1 : *uploads ASCII-armored key file*
t1 : but please don't use this permanently; this is a temporary key
t2 : ok
t2 : *uploads signed password file*
t1 : thanks
t2 : cool

*5 minutes later*
t1 : hey, I have forgotten the password to the key I sent you :(
t2 : okay
...
t2 : fall back to SSH public key encryption?
t1 : is that even possible?
t2 : Stack Overflow says its possible
t1 : * does a web search too *
t1 : source?
t2 : https://superuser.com/questions/...
t2 : lets try it out
t1 : okay
t2 : is this your key? *sends link to gitlab.com/username.keys*
t1 : yes, please use the ED25519 key.
t1 : the second one is my old 4096-bit RSA key...
t1 : which I lost
...
t1 : wait, you can't use the ED25519 key
t2 : why not?
t1 : apparently, ED25519 key is not supported
t1 : I was trying out the steps from the answer and I hit this error :
`do_convert_to_pkcs8: unsupported key type ED25519`
t2 : :facepalm: now what
t1 : :shrug:
...
t1 : *uploads ASCII-armored key file*
t1 : I'm sure of the password for this key
t1 : I use it everyday
t2 : *uploads signed password file*
*1 minute later*
t1 : finally... I have decrypted the file and gotten the password.
t1 : now attempting to login
t1 : I'm in!
...
t2 : I think this should be in an XKCD joke
t2 : Two tech guys sharing password.
t1 : I know a better place for it - devRant.com
t1 : if you haven't been there before; don't go there now.
t1 : go on a Friday evening; by the time you get out of it, it'll be Monday.
t1 : and you'll thank me for a _weekend well spent_
t2 : hehe.. okay.

Just found this today in the Terms for a VPN provider...

hide.me uses Google Analytics to analyze in aggregate information about our website visitors. When your web browser loads a page on our site, a small snippet of javascript code is executed within your browser which submits information about the device from which you are connecting such as your browser user-agent, language, screen resolution, referring website, etc. to the Google Analytics service. To enhance your anonymity, hide.me have opted to only allow Google to collect only a portion of the IP address. Google Analytics may also store a web cookie to facilitate the identification of users who revisit the site. If users are concerned with being tracked by Google analytics scripts on hide.me or any other site running Google analytics, we recommend installing a browser add-on which allows you to opt out.

source: https://hide.me/en/legal

ARE YOU FUCKING JOKING?!? GO BOIL WHAT SMALL MAN JUNK YOU HAVE AND EAT IT.

The following paper combines recurrent neural nets for vision with methods from reinforcement learning research:

https://proceedings.neurips.cc/pape...

Apparently an agent learned to catch a ball 85% of the time, without being explicitly told to track the ball. The RL algorithm rewarded the agent *only* for successfully catching the ball. The system itself used this reward signal to set its *own* policy/goal, which was used to guide it toward the goal of tracking the ball itself--all on its own.

Behold, the very infancy of the paperclip maximizer problem.

I'm retarded and never learned or was taught how to CSS

What's the simple toggle/config/property to throw onto things in CSS so different rendering engines will render things to look the same?

I just want 1 line of text, an input text box and a button on a web page opened by an app, to look roughly the same on iPhone, android phone and tablet.

Why the fuck did historically shit get fucked up so we have different rendering engines. I just want my fucking 1.5 em/rem to be legibly readable on these different platforms.

https://xkcd.com/927/

https://webaim.org/blog/...

an extra special fuck you shout out to apple

time to go down the rabbit hole of who knows what, i dont fucking know what a fucking viewport is yet