I wish it would allow specifying a key for key auth AND leaving password auth enabled

yeah that'd be cool

wtf...

freaking homebrew....

okay, 6.8 installed from snapshot.debian.org... next crash i'll boot into it.. firefox crashed and I managed to kill it without rebooting, but we'll see

Now my external DVD drive stopped working, I wonder if that's due to a kernel update or some userspace stuff.

cöassoc

1

ivanhoe

iv4nhoe

Close

ah 🙂

slowly hitting 110 on 10 words consistently.

If this keeps happening I'll need to switch distros again. Seriously this gives me flashbacks back to when I was using Arch.

arch has just kept on working for me

No idea, I tried it many many years ago. But what I remember is that I would constantly need to downgrade packages because an update broke something. Could be my memory is not accurate though 🤷‍♂️

idk

Where is "Total package downgrades" though :P

never had to do one?

Oh great, looks like the hardware is faulty 🙈

https://media.discordapp.net/stickers/1200249051195645952.gif?size=160&name=Turnin%27+Tux

New Raspberry Pi 5 launching today, 2 GB RAM

LMAO

crazy obs is still running from hours ago with no crashes...

nice

Hi @grim! I hope all is well with you, I was very happy to see that my plugins received close to 60 downloads in the last 2 months & I got some feedback & bug patches about it over email which I addressed. I am writing today with sad regards to this revision request https://keep.imfreedom.org/pidgin/nest/rev/9e246b0ea265 about my screenshare plugin. I am very concerned what somebody experienced, kindly note, I have attached here the virustotal (some trusted virus scanning site) + sandbox for the plugin https://www.virustotal.com/gui/file/0e019b5b4cc697b6044c48f4fd3029a8d49eec4ebc092868069ecc7932981787 I would like to resubmit my plugin to the plugin page as I have looked through all my source code & the compiled copy of my plugin (still from mid july of last year), and there was nothing related to viruses inside. Could it be possible that somebody received some sort of false-positive? So if it's possible, can you kindly elaborate to me about the details from this request as I cannot see any in the revision request. Also, if need be, I can publicly open-source the contents of my plugin to gain some awareness about its inner workings from the community. Thank you, so dearly for you concern & precious time. I sincerely hope we can get to the bottom of this unfortunate scenario!

Also, if there is anything that I can provide from my side. The backend switch manager which handles Reverse Tunneling of screenshare packets from my server which bypasses the NAT or as I said, the code of the plugin itself, I can do so. I would just hate to have my plugin reputation be jeopardized over something that was 99.9% a false-positive. I cannot find a single detail not through sandbox analysis like app.any.run or virustotal (as shown above) to say that my plugin is performing anything other than its purpose.

We have gotten credible reports that your plugin is doing things it shouldn't be doing. As your plugin is not open source, we can't not verify those claims and have to rely on the expertise of the reporters. Combine that with the fact that nearly all of the other plugins on https://jabberplugins.net/ are licensed under the GPL and you are not providing source code nor mentioning where the plugins come from is means enough to not promote anything there.

Okay, I understand! But please, I'd like to have this matter sorted because I am in NO WAY related to anything illegal & would never dare to step in that direction. As I mentioned originally, my purpose behind creating this plugin was to allow a secure way for my friend & work colleagues to share our screens & workflow with one-another over Pidgin. Ever since the days of MSN ended, many of my friends & relatives moved over to apps like Pidgin, Psi, and Adium as our alternative to free-speech conversation. The reason I first launched jabberplugins was to try & ressurrect the Pidgin Plugin domain, and have a repository similar to https://www.adiumxtras.com/ which tracks plugins by downloads & lets users get in contact with developers of plugins directly & openly. Although jabberplugins.net is still strictly meant to be used as a hub for my own ScreenShare over OTR plugin, I plan to publish more useful plugins there as time goes on. For example, ever since the start of August, I started working on a remote desktop (similar to TeamViewer/AnyDesk) extension to the ScreenShare plugin. The main reason for requesting you guys to publish my plugin on Plugins pag was to get more attention from the community & allow for people to connect with me about their feedback (which I happily was able to receive 6 emails about bugs/improvements that I could fix/add). But now, I am very sad because of this report, as I noticed that my plugin was no longer listed on the plugins page. So please, @grim I'd like to ask you from the bottom of my heart, how can we resolve this matter? I can make my plugin C code open-source, I can open-source the backend (traffic proxying) nodeJS code. Just let me know what I need to do & I'll do it.

I've laid out a path already... You're violating the licenses of nearly every plugin that's listed on that domain. That must be resolved. As far as getting ss-otr relisted, I have others looking into the malware claims but a lot of that concern would be alleviated by the source being available. Of course the source being available doesn't mean the binary was built from that exact source, so we'll still need verification. Regardless, due to this issue, we will be instituting a new rule for that list that all plugins must have an OSI approved license and their source code available.

Yes, I will fix that immediately!

OK, thank you for your direct clarity! I will get to work right away on providing an open-source version of the code. Also, is it also possible to host it on Pidgin Mercurial & provide some code-check to confirm that the plugin binary is the same as the source code? & as far as every plugin listed on my website; I will include credit to the author, its origin, and licence alongside it.

we only host code for people we've known for a long time. If you want mercurial hosting check out heptapod or source hut

❤️

1

win_for_the_win

take_the_profit

❤️

Close

Copy that, thank you for the recommendations! I will look into putting my code up on Source Hut right away. Also, thanks again for clearing up the details of this matter with me. I am so thankful for your openness & quickly addressing this issue with me. I feel it took a lot of weight off my shoulders as I was very worried/scared to see such a report in the first place. In the future, once I connect my real name/profile to this project, such reports would make me go in super-panic-mode. I really hope this is the first & last time! And, if there are any recommendations that you can make for me, I will be so happy to take note of them.

@grim if i host "Source hut" on my own servers (jabberplugins.net), will that merit the "open source" policy?

open source means that the source code is available for others under an OSI approved license https://opensource.org/osd it doesn't matter where it's hosted

And as far as code-checking goes, if i have a client side javascript code on the download page to SHA-check the release binaries with the source binary hosted with source hut. Is that a proper way to verify authenticity, or is there some other way to go about doing it?

verification is typically done by third parties or by the party compiling/installing the code, preferably by means of a reproducible build. a checksum of a binary just proves there was no corruption. to prove providence you need a signature or reproducible build

yes a checksum would do this

❤️

1

win_for_the_win

take_the_profit

❤️

Close

I even included a binary version of the screenshare plugin in a .rar on my ss-otr downloads page which includes the NSI file that creates the NSIS EXE that is found via the direct EXE download button ... just so users can make the installer themselves with MakeNSISW if they wanted

Got it!

if you provide modified binaries of software licensed under the gpl you must provide your modifications in source form upon request. I am requesting them.

❤️

1

win_for_the_win

take_the_profit

❤️

Close

Copy that!

@grim I have a miniscule issue, my jabberplugins server windows server 2019 1803 and it doesnt support wsl 2 ... so im going to host it on cloud. Will it be enough for me to provide a hyperlink to the source repo in a button in the menu bar of my site?

all you needed in the first place was a to make the source available, i'm not sure what path you're going down and why

Oh!

@grim im going to give a .tar.gz to you specifically but in public I just want to make the source available via a repository. Its just ... I wrote 3000 lines of code in this plugin & I would HATE to see someone else take credit for my work

This is ironic since this is precisely what you're doing with jabberplugins.net...

👍

1

hoehermann

mcscore

👍

Close

Wait! Hold your horses, once you see my plugin code ... your mind will change completely (and please do test it as much as you wish, along with the functionality etc). I wasn't prepared to open source my plugin code right away, but after seeing this report it seems there is no choice. And for the future, I would like to put the plugins' functionality in the users' hands. I am just trying to select the best licence to attach to the source code as I never dealth with open sourcing code before.

Hey @grim if I used code from https://github.com/nothings/stb (around 2000, mainly for safely converting bmp format to png format in Windows as there is no reliable built-in API conversion engine that is also C-compatible) ... but the rest of the 3700 lines of code are fully self-written. What is the most applicable licence to apply?

you're licenses need to be compatible

I am going to read more into it now!

@grim I sent you the source code .zip in DM

Did you get a chance to check it out ?

https://github.com/jabberplugins/pidgin-screenshare

@grim I am curious which part may have gotten flagged as a virus? I will be happy to remove/alter it or if you want just make a pull request & change it at your will

P.S. I'll be happy for any stars I can receive from any of you guys/girls for my hard work ❤️

womp womp https://www.theverge.com/2024/8/21/24225108/microsoft-security-update-windows-linux-dual-boot-errors

people still dual boot?

apparently?

It's so easy to just have two separate computers I wouldn't even consider dual booting anymore

yep

can you still dual-boot using separate drives?

Huh I dunno I haven't dual booted anything in years. I have a surplus of hardware right now for example...

but from what we seen with windows 11 is that, it's very much trying to do more apple like, it's like they forgetting that half the windows pc's are not tied to a single person's personal life.

It's technically possible, but the question here is whether the microsoft update screws with the trust store

Lilo then went to disney /s

1

grim

rw_grim

Close

depends on the distro

yeah, what I used the red would have been blue

people: tweaking seo so people can find their stuff in search engines me: does nothing not even an announcement Search for pidgin, hell even ibis got a blurb https://www.ilmarilauhakangas.fi/irc_technology_news_from_the_first_half_of_2024/

Nice

podman on freebsd, interesting... https://github.com/oci-playground/freebsd-podman-testing

Hey @grim did you get a chance to look at my plugin source code?

not yet, i have a ton of stuff to do, and to be honest this isn't a high priority thing for me.

I understand, but can you relist the plugin on the plugins page then? Or is it possible to get another peer-review?

did you fix the licensing issues with all the other plugins?

Yes

also until the code is verified i'm not readding it to the list. i understand that's a concern, but this is a volunteer run project, so yeah

So, if I want to accelerate the process, is it possible for me to self-verify it or do I need to find another user with trust to verify it ?

no, it will be verified by me and people i trust.

The only possible explanation may be the autoupdate procedure but the only thing pushed through that is the same EXE/installer that they originally downloaded (the .nsi script)

to be completely honest, a lot of your behavior is throwing all sorts of red flags, especially that it looks like you're trying to use the link to that page to establish credibility. And then there's your real discord account name. so this is how it's going to go down, it will be verified by me and people I trust, and if it's clean then it will be relisted. but that auto-updater stuff is very sketchy too...

I guess I can make a disable option for that autoupdate procedure?

take_the_profit from someone that doesn't want people to profit from their work while they're attempting to profit from other people's work... it's not a good look

I am not trying to profit from anyones work?

i mentioned this yesterday and you didn't respond to it.. you providing binaries for opensource plugins with no links to the original authors while advertising a donation link is you trying to profit off of other people's work

This plugin is literally a game changer because no other screenshare plugin existed in the past for pidgin

www.jabberplugins.net is the problem here

wait so

if i took the source code to ssotr, compiled it and put the compiled binary on my website with crypto addresses what would you call that?

I remove all the plugins from jabberplugins & only list my own ?

crypto addresses for donations

But

sorry i'm busy at work and you are, again, eating up a ton of my time

First off no one donated anything, and second of all ... that can all be changed I'll remove that

so i'm trying to respond quickly because as I stated earlier, i have a ton of stuff to do...

I'm sorry ...

like i get that you're excited about your plugin and stuff, but i am not paid support

My apologies ... I just want to get this matter sorted! I didn't do anything wrong ... & this whole situation is so crazy because my work colleagues are wondering what happened after I bragged to them about it in the first place

we don't do pay to play

hahaha fair enough

if you want to donate, that's cool, but you will not get special treatment because of it

❤️

1

hoehermann

mcscore

❤️

Close

I just dont want to waste your time

Im going take these steps + removing donations

it looks nothing like https://otr.cypherpunks.ca/ ??

I mean with how they have the "donate" button

if you say so..

Look, this is all very crazy because I literally didn't even do anything bad. I am so curious what that person flagged as a virus, I have all the binaries that the autoupdater pushed & it was just a compiled version of that nsi script

insert picture of not normal man

I will give said normal man some of my old hardware...

https://jabberplugins.net/ there

also just repurpose an old chromebook, i have plenty of those laying around

cool, will check later

Thank you. Again ... so sorry for bothering you at work

https://docs.imfreedom.org/contributors-guide/

🙏

1

win_for_the_win

take_the_profit

🙏

Close

@grim please dont check it out yet, I am going to add a checkbox button in the plugin config menu to enable/disable the autoupdater functionality

is that not in the contributors guide...?

Wonderful! Thank you 🙂

it's in the contributing guide...

OK @grim you can clone this repo whenever you have time to verify the code. I added the enable/disable option of automatic updates to the plugin config menu https://github.com/jabberplugins/pidgin-screenshare

After I make the builds for the updated version, I will also commit the libotr.so & libdeflate.so libraries onto the github

@grim I wanted to add MacOS support but do you know if pidgin for MacOS is popular or not OR is it better to make the plugin with support for adium since it also uses libpurple?

Oh wait, will Pidgin3 also be available through homebrew on MacOS? If so, maybe I'll just consider waiting for the Pidgin3 release next year before porting my plugin as a whole to it, alongside MacOS

https://portal.cfarm.net/machines/list/

ugh something recently changed in 1password that broke in firefox.. you have to refresh before logging back in. it's stupid but i keep forgetting to do it manually and am like "wtf is going on... oh that's right..>"

Hmm i haven't seen this before... to bad i basically built this myself..

hahah

i've been contemplating a riscv sbc too...

hahaha

although they do have ppc and sparc.. that might be interesting as i have no desire to run that or mips for that matter, but we're not really likely to hit any issues directly on those platforms anymore so shouldn't be a big deal

@grim did you get a chance to verify my source code yet?

no and i'm busy through the weekend...

So, can I get anyone else to do it?

i said yesterday and I'll say it again, this is not a priority for ME. I know it is for you, but I have a million other things to do.

I know ... but I didn't do anything wrong!

also I'll tell you this much in the mean time, you need to patch your server.

patch my server, what do you mean?

you server has known security vulnerabilities

Which ones!?

you need to run updates on your operating system

OK! I'll do that immediately ... you think someone could have compromised it?!

this is the dilemma.. you're behavior has been questionable and you're running an insecure operating system. Me and my contacts are trying to determine if you're trying to pull a fast one on me. which is also why i'm not looking at this until their assessment is done. 9 times out of 10 this kind of thing is just people don't know better, but we still have to error on the side of caution.

yeah ... I'm so sorry for anything that I did that may have made you feel suspicious about me! Honestly, because you felt that way about me is exactly why I felt I should help out with Pidgin ... I know, I just appeared out of the blue & then this happened, its not a good look for sure! But I just want you know to know that I AM HERE TO STAY. I'm so sorry to make all you guys feel this way about me, but I really just wanted to bring the community to life more. That's why I made the screenshare plugin, not only for my colleagues at work, but also for the Pidgin IM community. I wanted to bring a plugin that innovates the messenger, and that's why I made it!

this didn't happen out of the blue, all of your behavior has been suspicious and i noted that initially when you blasted up on irc, discord, and xmpp... then putting your plugin at the top of the list was suspicious too and forced me to setup sorting in that list to stop what you did.

Huge respect to you for answering questions here & working at the same time. I am sorry to bother you

yet you keep bothering me after stating this...

Yeah ... that top of the list thing was not good

I'll stop now, its just I just woke up & wanted to check here right away

review for what? your plugin stuff? there's nothing in reviewboard for it

No no

this is being done in private as most security issues are

I am referring to these

there's thousands of issues there.. you'll need to be more specific..

I mean, is it possible to assign myself to a specific one so that no one else works on it while I am? I tried to work on this one https://issues.imfreedom.org/issue/PIDGIN-17895/Implement-leaving-conversations but then I noticed Markus Fischer already did it? Review Board APP — Yesterday at 03:27 New review from Markus Fischer

Wow! What's that about

How was I already targeted in the span of just 2 months...

comment on the issue if you're going to work on it. but we're not really at a stage right now for new contributor to learn things, we need to move fast. so if you claim one and it's taking too long i'm going to take it over

Got it! I'll try to only take the ones that I can most likely finish in a reasonable time frame

from http://jabberplugins.net:81/sws.js explicit mention of keylogging ....

this is crazy though, how can I stop this from happening?

learn how to secure servers? that's not something i have the time to help you with

I just wanted to say that thanks to Pidgin, I was able to identify and provide information to the authorities on 4 different cybercriminals & counting ... and I will continue to do so

and in doing so you lost all trust with us 😉

I hope screenshare my plugin will help the community, maybe someone can fork it and support it on their own

💀

Or this criminal who was a part of the Qilin, RansomHub, and Knight ransomware affiliate networks

look, i'm going to be very clear here. You attempted to compromise all of our users by being a vigilante, you are no longer welcome in our community because of that.

Not all ... just cybercriminals from the forum exploit.in