Ah, sorry.

D-Bus has a similar mechanism to the one that got this hacker arrested. I guess I was expanding upon the previous conversation about how much stuff is considered inside the inner security circle for d-bus.

Apart from what everyone else here has said LegalEagle did some videos on this, and the big takeaway was that everybody needed to get a lawyer ASAP instead of trying to plead their case in the court of public opinion via podcast/youtube videos/whatever. Reckless Ben got the audio from his court case and used it to make a youtube video (he was representing himself). This whole thing went from ordinary mess to Great Big Mess with no signs of anyone trying to dial it down.

It think this is the one depending on how far the rabbit hole you want to go down:

• https://www.youtube.com/watch?v=HH09tltEw1U

Long story short: Microsoft just helped pop an alleged hacker using some windows device ID. I linked to a post in the hackernews thread about d-bus:

https://lemmy.world/post/49138921

https://news.ycombinator.com/item?id=48815684

They’re also transmitting mixed chinese/<insert local language here> language broadcasts into other countries via shortwave. The US gutted VOA in response.

Alice in Chains - MTV Unplugged

If I had to pick just one.

I was never as good as I always thought I was

Make a bingo card out of the phrases:

• “We didn’t do anything wrong.”
• “We paid Company X to do that.”
• “What’s a computer license?”
• “How much do they want?”
• “If it’s free then why are we talking?”
• “If it’s free then what did we pay Company X for?”
• “What does GNU mean?”
• [… some time later …]
• “Can’t we just pay them?”
• “Don’t pay Company X because they fucked this up.”
• “Why do we have to give everyone the changes we paid for?”
• “Whatever. I don’t want to hear about this again.”

Add your own phrases. It’s a fun game for all ages.

I ended up creating an account just to block communities/users. At the time there was a poster posting to his own instance that was federated with lemmy.world, and he was reposting nothing but reddit posts, and the volume was such that they had to go. With no algorithm there’s no way to just see subscribed stuff without losing out on discovering new things.

And just a tip, Lemmy will let you export (to JSON) your configuration options to include who you’ve blocked.

Who defines the untrusted applications though?

¯\(ツ)/¯

If GNOME wrote it then they probably trust it. If you’re using GNOME, then you’ve accepted their security model on some level.

At least you know to go look for it. Attackers will only get more sophisticated:

https://ioctl.fail/preliminary-analysis-of-aur-malware/

according to their stated security model, untrusted applications must not be allowed to communicate with the secret service.

That won’t be a popular stance to take when someone eventually steals a bunch of cached, unlocked credentials off of D-BUS because of an oversight somewhere in the npm/aur/pip/cargo/whatever ecosystem.

More rabbit hole:

• https://www.openbsd.org/papers/bsdcan14-libressl/mgp00001.html
• https://gpg.fail/ (including the presentation)
• https://github.com/FiloSottile/age
• https://jedisct1.github.io/minisign/
• https://github.com/jedisct1/encpipe

Hm. Had been thinking of it in terms of controlling the local file system.

Thanks.

people then concluded that FROST is harder to exploit in real-world scenarios than in the lab

What happens if there’s an extra 4GB of stuff laying around?

https://arstechnica.com/google/2026/05/no-google-hasnt-changed-chromes-local-ai-features-its-just-as-confusing-as-ever/