A "Showerthought" is a simple term used to describe the thoughts that pop into your head while you're doing everyday things like taking a shower, driving, or just daydreaming. The most popular seem to be lighthearted clever little truths, hidden in daily life.
Here are some examples to inspire your own showerthoughts:
If you made it this far, showerthoughts is accepting new mods. This community is generally tame so its not a lot of work, but having a few more mods would help reports get addressed a little sooner.
Whats it like to be a mod? Reports just show up as messages in your Lemmy inbox, and if a different mod has already addressed the report, the message goes away and you never worry about it.
I was thinking the other week about how it's getting to a point that I would consider a membership fee to access something like lemmy but guaranteed no AI or bots or bullshit advertising.
I know it isn't possible, but if it was, I'd pay a small fee to have it.
Do you think there will be safe places on the internet?
If it's connected, it's accessible. Won't matter what human level security we put in place when the datacenters these clankers run on have enough GPUs to brute force their way through.
Offline communication will make a resurgence, and will become indespensible when the resource wars the billionaires are funding reach the rest of the world.
If i had to guess, maybe everything would become invite-only
So like past torrent search providers, ike demoniod?
If the person who got invited by the person you invited gets banned, your whole family dies. It's the only way to keep people honest.
Internet vampires
How about just living in the actual woods with no internet? Gets more tempting by the day.
Yeah but where i live its to damn hot
I have a testing website. I have never gave the address to absolutely anyone, ever. It's not linked with anything. It's just a silly html site living in a domain.
It's still being ping and probed to death by bad actors. No necessarily AI scrappers. But it's dozens or hundreds of http petitions a day for random places all over the world.
There's no black forest. It's all light up and under constant attack, every tree is already on fire.
That's because it's numerically possible to sweep through the entire IPv4 address range fairly trivially, especially if you do it in parallel with some kind of botnet, proverbially jiggling the digital door handles of every server in the world to see if any of them happen to be unlocked.
One wonders if switching to purely IPv6 will forestall this somewhat, as the number space is multiple orders of magnitude larger. That's only security through obscurity, though, and it's certain the bots will still find you eventually. Plus, if you have a doman name the attackers already know where you are — they can just look up your DNS record, which is what DNS records are for.
It's not as simple as "only security through obscurity". You could say the same thing for an encryption key of a certain length. The private key to a public key is still technically just an obscurity, but it's still impractical to actually go through the entire range
IPv6 is big enough where this obscurity becomes impractical to sweep. But of course, as you said, there may be other methods of finding your address
I like seeing them try and then thinking "begone thot! There is no entry for you"
In fact, I might make a honeypot that issues exactly that
nepenthes is the tool for that
Servers which are meant to be secure usually are configured to not react to pings and do not give out failure responses to unauthenticated requests. This should be viable for a authenticated only walled garden type website op is suggesting, no?
I have suggested a couple of times now that ActivityPub should implement an encryption layer for user authentication of requests and pings. It already has a system for instances vauching for each other. The situation is that users of "walled garden" instances in ActivityPub lack means of interfacing with public facing instances that doesnt leave the network open for scraping. I believe a pivot towards default registered users only content service built on encrypted handshakes, with the ability for servers to opt-in to serving content to unregistered users would make the whole network much more robust and less dependent on third party contingencies like CloudFlare.
Then again, maybe I should just be looking for a different network, I'm sure there are services in the blockchain/cryptosphere that take that approach, I just would rather participate in a network built on commons rather than financialization at it's core. Where is the protocol doing both hardened network and distributed volunteer instances?
But an IP can have multiple websites and even not return anything on plain IP access. How do crawlers find out about domains and unlinked subdomains? Do they even?
@kossa @dual_sport_dork If you're using HTTPS, which is by and large the norm nowadays, then every domain is going to be trivially discoverable via certificate transparency logs: https://social.cryptography.dog/@ansuz/115592837662781553
Thanks for the link!
thinking about this, wouldn't the best way to hide a modern websie be something along getting a wildcard domain cert (can be done with LE with DNS challenge), cnaming the wildcard to the root domain and then hosting the website on a random subdomain string ? am I missing something
I do something something like this using wildcard certs with Let's Encrypt. Except I go one step further because my ISP blocks incoming data on common ports so I end up using an uncommon port as well.
I'm not hosting anything important and I don't need to always access to it, it's mostly just for fun for myself.
Accessing my site ends up looking like https://randomsubdomain.registered-domain-name.com:4444/
My logs only ever show my own activity. I'm sure there are downsides to using uncommon ports but I mitigate that by adjusting my personal life to not caring about being connected to my stuff at all times.
I get to have my little hobby in my own corner of the internet without the worry of bots or AI.
I have a DDNS setup. Pretty random site name. Nonetheless, it’s been found and constantly probed. Lots of stuff from Russia, China, a few countries in Africa, and India. A smattering of others, but those are the constant IPs that are probing or attempting logins.
DNS only translate a string address (www.mywebsite.com) to its IP address (xxx.xxx.xxx.xxx) so that it is easier to remember.
Bots just try a range of address and they don't need to know your domain name. You could have the most unintelligible domain name in the world, bots would still ping your website because they use direct IP addresses.
Yeah, that’s probably it. Just them spamming different numeric IP addresses to see if any get a hit.
Too late, it's dead!
Yeah it certainly is
Is this hopeposting ?
Kinda yeah, it's what I thought lemmy would be, but more and more it isn't
Fabulous insight. I think that would make me very happy. Bring back the forests! Burn down the Nazi trees!
Damn, how was this not big headline news?
China and Russia do this shit all the time. Now they used a new tool. It's really not big headline news. I'd love for it to be and burst that AI bubble tho.
How is Gemini fairing in the existing bot landscape? Usenet?
~shhh~ ~they'll~ ~hear~ ~you!~
FUCK WE'RE TOO LATE, YOU ACTIVATED THE BOTS! YOU DOOMED US!
My bad, I'm sorry
Back in the days of dial up and bbs this was a problem but you would still get robots trying to connect to modems by dialing every phone number possible.
The last reduct of mankind against the machines? Let's call it Sion
I think you're on to something maybe make a movie