Apropos #diday, quasi alle Studierenden und Mitarbeitenden an allen Hochschulen in Niedersachsen dürfen #BigBlueButton über die Academiccloud 'kostenlos' (vom Land finanziert) nutzen. Das ist #FOSS auf Servern in Deutschland und digitale Unabhängigkeit im richtig großen Stil. Hört man irgendwie viel zu wenig drüber.
Remote
defnull
@defnull@chaos.social
mastodon 4.6.9I'm this guy -> https://defnull.de/about/
tl;dr; #FOSS enthusiast, #python, #devop, #infosec, #noai. I write and rant about whatever technology or topic I'm currently obsessed with. 
251 Followers
248 Following
39 Posts
Joined October 28, 2022
Not a blog:
I made this!:
Github:
Codeberg:
#Codeberg is in a strange position where it is attacked by the pro-AI folks for banning AI slop projects, and criticized by the anti-AI folks for not banning AI hard enough (e.g. by not allowing non-free anti-AI licenses). Almost no one talks about the crypto rule change, which is probably a good sign. 
Every homepage should have this feature: Go to https://defnull.de/ and press 'w' 
Dear everyone,
The state of the internet:
A recent blog post of mine was requested 1691 times in a single day from clients with normal-looking user agents. The essential assets for that post (e.g. css files) were requested only 102 times.
94% of visitors were bots.
That does NOT include the tens of thousands of requests from clients that identify as a bot. I did not count those.
94% of visitors were bots that actively try to not look like a bot.
Are there any humans left?
I wanted a comment feature on my blog, but it is a static website with no server-side scripting, so... the form just opens your mail client when you hit 'Send'. Not sure if that's a good idea or trolling 
The blog on https://defnull.de/ was empty for years. All those texts were already there, but hidden as drafts until recently. I never published them, because ... I don't really know why. Now it's all public. Maybe someone will find some of it interesting.
Replying to
@isotopp@infosec.exchange @mohs@climatejustice.social Redis hängt ja normalerweise auch nicht am bösen Netz sondern spricht nur mit 'vertrauenswürdigen' Clients in der selben trust-domain. Ich hab jetzt nicht alles durchgeschaut, aber lass mich raten: Alle diese Exploits benötigen direkten Zugriff auf den socket?
Sind natürlich trotzdem Bugs aber ... meh.
Replying to
@jti42@infosec.exchange Do they really 'need' to resolve this scenario? If the goal is to get rid of obvious, resource hogging, low effort projects with no real users or community, then a vague ToU rule is fine. A large gray area is fine. If a project is obviously AI and a resource hog, mods now have the option to remove it. If not, they simply do nothing. Identifying and banning all AI projects was never the goal.
Replying to
@jti42@infosec.exchange @Codeberg@social.anoxinon.de @bizzfed@bizzfed.de
back-seat moderator; noun
(Internet) A user who is not a moderator but zealously identifies and polices rule-breaking by others.
Synonyms: minimod, back-seat mod
Small feature upgrade for my personal QR code generator. You can now also change color, size and effect. Because, why not?
Wow. Just wow. A #Wayland compositor in modded #Minecraft
It's outdated by now, but if you want to know why early release candidates for #BigBlueButton 3.0 destroyed SSDs and ate CPUs for breakfast, here you go: https://defnull.de/2025/bbb-hasura-graphql/
This is all fixed by now and BBB 3.0 scales really well nowadays. But the issues back in 2025 were interesting enough to write them down, so I did. Have fun!
Replying to
@isotopp@infosec.exchange Auf dem Supermarkt-Dach hier in der Nachbarschaft haben sie dieses Jahr Solar in Ost/West Ausrichtung installiert, mit einem relativ flachen Winkel, obwohl eine reine Süd-Ausrichtung problemlos möglich gewesen wäre. Vermutlich passt das besser zur tatsächlichen Strombedarfs-Kurve. Die werden sich ganz bestimmt etwas dabei gedacht haben.
My latest #FOSS Project: Yet another multi-tenant capable load balancer for large #BigBlueButton clusters.
https://github.com/defnull/bbblb
https://codeberg.org/defnull/bbblb
https://bbblb.readthedocs.io/en/latest/
Not ready for production yet, but on a good path. The aim is to have something fast and easy(er) to maintain that can fully replace scalelite (the reference implementation) and fixes some of its long standing bugs and issues.
Just released #BBBLB v0.0.18, a modern and full-featured loadbalancer for #BigBlueButton. It's on a good path to 1.0 and already used in production. If you are looking for a #Scalelite alternative, this might be an option.
I just witnessed someone throwing a tantrum because they were loosing access to the newest and most expensive AI model and being told to work with less expensive models now.
I mean a real, ugly tantrum. There were lots of swear words and some empty threats. Choosing beggars meets drug addict.
But on the other side... addiction is not a character flaw, and AI is extremely addictive. Those extreme reactions should not be surprising at all.
Replying to
I would have never found this myself, because I would have had no reason to look for it. It's a single character typo in a regular expression that has no effect on the intended functionality, but leads to catastrophic backtracking when fed with malicious input. Why typo? Because the same pattern is used twice, and only one of them was bad.
The library has 100% test coverage, including malicious input scenarios. But for this kind of issues you'd need a fuzzer. Maybe I should look into #fuzzing?
How not to handle reported security issues: https://defnull.de/2024/CVE-2024-49767_flask/#timeline
Days since an AI agent tried to sneak a security issue into one of my #FOSS projects: 0
Replying to
Maybe it backfired a bit, the frequency of AI generated PRs drastically increased. I guess the presence of an AGENTS.md is perceived as an invitation? People are actively searching for 'popular' projects that have one to farm internet points?
Replying to
It worked, in a way. I can now identify AI slop easier and also just refer to the agents.md while closing PRs without having to explain the same issues over and over again.
Replying to
@mariusor@metalhead.club @evan@cosocial.ca @hongminhee@hollo.social Multipart form data is not base64 encoded and way faster to generate or parse than b64 strings in json.
Replying to
@kalt@gts.code-feather.de wie SSO im Detail funktioniert das hängt natürlich von deinem AG ab, aber die Liste der angebundenen Institutionen und föderierten Login-Möglichkeiten ist lang und es gibt auch Wege über das DFN. Frag mal bei deiner IT nach, vielleicht hast du ja schon längst Zugriff und weist es nur noch nicht :)
Replying to
@carbonwoman@norden.social Naja, bei ShareLatex hat man zusätzlich zum Betrieb noch die Lizenzkosten vom Hersteller. Wenn der den Preis einfach verdoppelt, hat man halt ein Problem.
BBB ist echtes Open Source und Lizenzfrei, da zahlt man nur für den Betrieb. Natürlich ist der auch nicht kostenlos, aber wenn öffentliche Gelder hier in lokale Infrastruktur gesteckt werden, statt kommerzielle Anbieter reich zu machen, dann ist das ein großer Schritt in die richtige Richtung.
Replying to
@chpietsch @davidlohner @nb @milan
Ich zitier mich mal selbst (auf die klassische Art, quote posts gehen glaub ich nicht als Antwort?) https://academiccloud.social/@mhellka/113446749557611790
Replying to
Most PRs (>80%) come from users with Chinese characters in their bio. And they never reply to a negative review, even if the PR would be acceptable after some changes.
Imagine there is a pill that makes you more intelligent and creative. It's not perfect, has some nasty side effects, but it is helpful in some cases. The pill sells for 1$ and lasts a day. Most people can afford it and start using it, daily, because you feel less capable without it. They sell in the billions.
Experts calculated that the pill actually costs 100$ to make, uses scare resources also needed for cancer medication, and long term usage causes brain damage.
But now everyone is hooked.
Replying to
@eigenstil@chaos.social unfortunately not supported by the QR library, it draws to a canvas and those are raster images by nature. But if 300px per bit is not enough, you could probably use a raster-to-vector conversion tool and get pretty good results. Inkscape can do that, and most commercial layout or design software should also have that functionality built in.
Replying to
@jti42@infosec.exchange Small FOSS projects are not banned. Popularity is not a requirement to be on Codeberg. Being a human is.
The "no projects with the LLM taint wanted here" statement also does not match the actual Codeberg rules, it is a heavy exaggeration. So, are we talking about Codeberg here at all? The described scenario has a simpel answer if tested against the actual Codebergs rules: No, that is not a ToS violation because the 'mostly' threshold is clearly not met.
Replying to
@jef @MastodonEngineering But ... Object.hasOwn *is* a function? At least in all browsers released in the last 5 years? I seriously do not understand how this error can happen in a modern browser. https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/hasOwn
