blog/archive/2018/12/12.rss

   1 <?xml version="1.0" encoding="ISO-8859-1"?>
   2 <rss version='2.0' xmlns:lj='http://www.livejournal.org/rss/lj/1.0/'>
   3         <channel>
   4                 <title>Petter Reinholdtsen - Entries from December 2018</title>
   5                 <description>Entries from December 2018</description>
   6                 <link>http://www.hungry.com/~pere/blog/</link>
   7
   8
   9         <item>
  10                 <title>Learn to program with Minetest on Debian</title>
  11                 <link>http://www.hungry.com/~pere/blog/Learn_to_program_with_Minetest_on_Debian.html</link>
  12                 <guid isPermaLink="true">http://www.hungry.com/~pere/blog/Learn_to_program_with_Minetest_on_Debian.html</guid>
  13                 <pubDate>Sat, 15 Dec 2018 15:30:00 +0100</pubDate>
  14                 <description>&lt;p&gt;A fun way to learn how to program
  15 &lt;a href=&quot;https://www.python.org/&quot;&gt;Python&lt;/a&gt; is to follow the
  16 instructions in the book
  17 &quot;&lt;a href=&quot;https://nostarch.com/programwithminecraft&quot;&gt;Learn to program
  18 with Minecraft&lt;/a&gt;&quot;, which introduces programming in Python to people
  19 who like to play with Minecraft.  The book uses a Python library to
  20 talk to a TCP/IP socket with an API accepting build instructions and
  21 providing information about the current players in a Minecraft world.
  22 The TCP/IP API was first created for the Minecraft implementation for
  23 Raspberry Pi, and has since been ported to some server versions of
  24 Minecraft.  The book contain recipes for those using Windows, MacOSX
  25 and Raspian.  But a little known fact is that you can follow the same
  26 recipes using the free software construction game
  27 &lt;a href=&quot;https://minetest.net/&quot;&gt;Minetest&lt;/a&gt;.&lt;/p&gt;
  28
  29 &lt;p&gt;There is &lt;a href=&quot;https://github.com/sprintingkiwi/pycraft_mod&quot;&gt;a
  30 Minetest module implementing the same API&lt;/a&gt;, making it possible to
  31 use the Python programs coded to talk to Minecraft with Minetest too.
  32 I
  33 &lt;a href=&quot;https://ftp-master.debian.org/new/minetest-mod-pycraft_0.20%2Bgit20180331.0376a0a%2Bdfsg-1.html&quot;&gt;uploaded
  34 this module&lt;/a&gt; to Debian two weeks ago, and as soon as it clears the
  35 FTP masters NEW queue, learning to program Python with Minetest on
  36 Debian will be a simple &#39;apt install&#39; away.  The Debian package is
  37 maintained as part of the Debian Games team, and
  38 &lt;a href=&quot;https://salsa.debian.org/games-team/unfinished/minetest-mod-pycraft&quot;&gt;the
  39 packaging rules&lt;/a&gt; are currently located under &#39;unfinished&#39; on
  40 Salsa.&lt;/p&gt;
  41
  42 &lt;p&gt;You will most likely need to install several of the Minetest
  43 modules in Debian for the examples included with the library to work
  44 well, as there are several blocks used by the example scripts that are
  45 provided via modules in Minetest.  Without the required blocks, a
  46 simple stone block is used instead.  My initial testing with a analog
  47 clock did not get gold arms as instructed in the python library, but
  48 instead used stone arms.&lt;/p&gt;
  49
  50 &lt;p&gt;I tried to find a way to add the API to the desktop version of
  51 Minecraft, but were unable to find any working recipes.  The
  52 &lt;a href=&quot;https://www.epiphanydigest.com/tag/minecraft-python-api/&quot;&gt;recipes&lt;/a&gt;
  53 I &lt;a href=&quot;https://github.com/kbsriram/mcpiapi&quot;&gt;found&lt;/a&gt; are only
  54 working with a standalone Minecraft server setup.  Are there any
  55 options to use with the normal desktop version?&lt;/p&gt;
  56
  57 &lt;p&gt;As usual, if you use Bitcoin and want to show your support of my
  58 activities, please send Bitcoin donations to my address
  59 &lt;b&gt;&lt;a href=&quot;bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&quot;&gt;15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&lt;/a&gt;&lt;/b&gt;.&lt;/p&gt;
  60 </description>
  61         </item>
  62
  63         <item>
  64                 <title>Non-blocking bittorrent plugin for vlc</title>
  65                 <link>http://www.hungry.com/~pere/blog/Non_blocking_bittorrent_plugin_for_vlc.html</link>
  66                 <guid isPermaLink="true">http://www.hungry.com/~pere/blog/Non_blocking_bittorrent_plugin_for_vlc.html</guid>
  67                 <pubDate>Wed, 12 Dec 2018 07:20:00 +0100</pubDate>
  68                 <description>&lt;p&gt;A few hours ago, a new and improved version (2.4) of
  69 &lt;a href=&quot;https://tracker.debian.org/pkg/vlc-plugin-bittorrent&quot;&gt;the VLC
  70 bittorrent plugin&lt;/a&gt; was uploaded to Debian.  This new version
  71 include a complete rewrite of the bittorrent related code, which seem
  72 to make the plugin non-blocking.  This mean you can actually exit VLC
  73 even when the plugin seem to be unable to get the bittorrent streaming
  74 started.  The new version also include support for filtering playlist
  75 by file extension using command line options, if you want to avoid
  76 processing audio, video or images.  The package is currently in Debian
  77 unstable, but should be available in Debian testing in two days.  To
  78 test it, simply install it like this:&lt;/p&gt;
  79
  80 &lt;p&gt;&lt;pre&gt;
  81 apt install vlc-plugin-bittorrent
  82 &lt;/pre&gt;&lt;/p&gt;
  83
  84 &lt;p&gt;After it is installed, you can try to use it to play a file
  85 downloaded live via bittorrent like this:
  86
  87 &lt;p&gt;&lt;pre&gt;
  88 vlc https://archive.org/download/Glass_201703/Glass_201703_archive.torrent
  89 &lt;/pre&gt;&lt;/p&gt;
  90
  91 &lt;p&gt;As usual, if you use Bitcoin and want to show your support of my
  92 activities, please send Bitcoin donations to my address
  93 &lt;b&gt;&lt;a href=&quot;bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&quot;&gt;15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&lt;/a&gt;&lt;/b&gt;.&lt;/p&gt;
  94 </description>
  95         </item>
  96
  97         <item>
  98                 <title>Retten til kontant betaling er en rettighet som må brukes for å beholdes</title>
  99                 <link>http://www.hungry.com/~pere/blog/Retten_til_kontant_betaling_er_en_rettighet_som_m__brukes_for___beholdes.html</link>
 100                 <guid isPermaLink="true">http://www.hungry.com/~pere/blog/Retten_til_kontant_betaling_er_en_rettighet_som_m__brukes_for___beholdes.html</guid>
 101                 <pubDate>Tue, 11 Dec 2018 10:00:00 +0100</pubDate>
 102                 <description>&lt;p&gt;&lt;a href=&quot;https://www.fn.no/Om-FN/Avtaler/Menneskerettigheter/FNs-verdenserklaering-om-menneskerettigheter&quot;&gt;FNs
 103 menneskerettighetserklæring&lt;/a&gt; artikkel 13 første punkt lyder som
 104 følger:&lt;/p&gt;
 105
 106 &lt;p&gt;&lt;blockquote&gt;
 107 Enhver har rett til å bevege seg fritt og til fritt å velge
 108 oppholdssted innenfor en stats grenser.
 109 &lt;/blockquote&gt;&lt;/p&gt;
 110
 111 &lt;p&gt;Det er altså en menneskerett å kunne bevege seg fritt i landet.
 112 For å bevege seg fritt i landet, så må en kunne bevege seg uten å bli
 113 sporet.  Det vil i dagens samfunn innebære å bevege seg uten å legge
 114 igjen digitale spor og uten å være radiomerket.  Hvis en vet at ens
 115 bevegelser, hvor en befinner seg når, og hvem som befinner seg i
 116 nærheten, blir samlet inn og gjort tilgjengelig for fremmede, det være
 117 seg myndighetene eller private organisasjoner, så kan en ikke lenger
 118 bevege seg fritt.  Dette gjør at det er en forutsetning for å ha glede
 119 av retten til å bevege seg fritt i landet at en motstår fristelsen til
 120 å legge igjen digitale spor når en betaler for seg.  Rettigheter som
 121 ikke blir brukt, blir fjernet.  Den eneste måten i dag å unngå å legge
 122 igjen digitale spor når en betaler for seg, er å betale med kontanter,
 123 samt takke nei til å legge igjen navn og adresse (slik f.eks. Elkjøp
 124 ber om &amp;mdash; jeg sier de kan legge inn «anonym anonym» når
 125 datasystemet deres trenger et navn).  Personlig anbefaler jeg å
 126 konsekvent bruke kontant betaling når man beveger seg rundt, for å
 127 bidra til forsvaret av menneskerettighetene i Norge.  Kanskje noe også
 128 for deg?  Merk at det ikke er tilstrekkelig for å unngå sporing å
 129 betale med kontanter, men det er et lite steg i riktig retning.&lt;/p&gt;
 130
 131 &lt;p&gt;Det er flere andre argumenter i tillegg til
 132 menneskerettighetsargumentet for å bruke kontanter.  I går hadde
 133 Dagbladet en utmerket kommentar av sin journalist John Olav Egeland om
 134 hvilket
 135 &lt;a href=&quot;https://www.dagbladet.no/kultur/kontantlost-diktatur/70543434&quot;&gt;kontantløst
 136 diktatur&lt;/a&gt; som venter oss hvis mange nok slutter å insistere på å
 137 betale med kontanter.  Jeg anbefaler deg å lese den.&lt;/p&gt;
 138
 139 &lt;p&gt;Som vanlig, hvis du bruker Bitcoin og ønsker å vise din støtte til
 140 det jeg driver med, setter jeg pris på om du sender Bitcoin-donasjoner
 141 til min adresse
 142 &lt;b&gt;&lt;a href=&quot;bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&quot;&gt;15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&lt;/a&gt;&lt;/b&gt;.
 143 Merk, betaling med bitcoin er ikke anonymt. :)&lt;/p&gt;
 144 </description>
 145         </item>
 146
 147         <item>
 148                 <title>Why is your site not using Content Security Policy / CSP?</title>
 149                 <link>http://www.hungry.com/~pere/blog/Why_is_your_site_not_using_Content_Security_Policy___CSP_.html</link>
 150                 <guid isPermaLink="true">http://www.hungry.com/~pere/blog/Why_is_your_site_not_using_Content_Security_Policy___CSP_.html</guid>
 151                 <pubDate>Sun, 9 Dec 2018 15:00:00 +0100</pubDate>
 152                 <description>&lt;p&gt;Yesterday, I had the pleasure of watching on Frikanalen the OWASP
 153 talk by Scott Helme titled
 154 &quot;&lt;a href=&quot;https://frikanalen.no/video/626080/&quot;&gt;What We’ve Learned From
 155 Billions of Security Reports&lt;/a&gt;&quot;.  I had not heard of the
 156 &lt;a href=&quot;https://en.wikipedia.org/wiki/Content_Security_Policy&quot;&gt;Content
 157 Security Policy standard&lt;/a&gt; nor its ability to &quot;call home&quot; when a
 158 browser detect a policy breach (I do not follow web page design
 159 development much these days), and found the talk very illuminating.&lt;/p&gt;
 160
 161 &lt;p&gt;The mechanism allow a web site owner to use HTTP headers to tell
 162 visitors web browser which sources (internal and external) are allowed to
 163 be used on the web site.  Thus it become possible to enforce a &quot;only
 164 local content&quot; policy despite web designers urge to fetch programs
 165 from random sites on the Internet, like the one
 166 &lt;a href=&quot;https://securityaffairs.co/wordpress/68966/hacking/browsealoud-plugin-hack.html&quot;&gt;enabling
 167 the attack&lt;/a&gt; reported by Scott Helme earlier this year.&lt;/p&gt;
 168
 169 &lt;p&gt;Using CSP seem like an obvious thing for a site admin to implement
 170 to take some control over the information leak that occur when
 171 external sources are used to render web pages, it is a mystery more
 172 sites are not using CSP?  It is being
 173 &lt;a href=&quot;https://www.w3.org/TR/CSP/&quot;&gt;standardized under W3C&lt;/a&gt; these
 174 days, and is supposed by most web browsers&lt;/p&gt;
 175
 176 &lt;p&gt;I managed to find &lt;a href=&quot;https://github.com/mozilla/django-csp&quot;&gt;a
 177 Django middleware for implementing CSP&lt;/a&gt; and was happy to discover
 178 it was already in Debian.  I plan to use it to add CSP support to the
 179 Frikanalen web site soon.&lt;/p&gt;
 180
 181 &lt;p&gt;As usual, if you use Bitcoin and want to show your support of my
 182 activities, please send Bitcoin donations to my address
 183 &lt;b&gt;&lt;a href=&quot;bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&quot;&gt;15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&lt;/a&gt;&lt;/b&gt;.&lt;/p&gt;
 184 </description>
 185         </item>
 186
 187         </channel>
 188 </rss>