https://snee.la/posts/the-workings-of-whatsapps-end-to-end-encrypted-backups/

This is my analysis of WhatsApp’s backup mechanisms. The best possible thing you can do from a privacy PoV is to enable end-to-end-encrypted backups, which is disabled by default.

As far as I know, WhatsApp’s backups don’t go to meta’s servers, but instead google cloud / icloud. If your wife logged into her google account before, had backups enabled (frequency is weekly afaik), and signed into the google account again on the new phone - WhatsApp will restore the backups from the cloud.

If you enable E2EE backups, then you’ll be asked to enter your password, which only you can have. If you fail to supply that, your backups are lost forever. The implantation is a bit scuffed IMO, but still better than nothing. Things may have changed since I analyzed it in 2022.

Just purchased a server license (for life). Not only is this update jam packed full of nice features, but a lot of their updates are. I’ve been self-hosting it (on a VPS) for the past year and it’s about time I supported them

My website’s the one linked in this post: https://snee.la/

My email is at the contact page: https://snee.la/contact/

sneela [at] tugraz [dot] at

I’ll be sure to reach out if I find myself being unable to replicate it.

No worries, and good luck! My email can be found on my website if you want it :D

I wasn’t even talking about tikzplotlib. It’s just that pgf backend is now supported by matplotlib and you can produce pgf files with.

Ah… I’ve think I’ve heard of it, but I never really registered that. Thanks for the info :D

I could give you the tikz source of Fig 2 if you’d like. The patterns and colors of the plots took me almost a day to choose. I wanted to go for a color-blind friendly pallette and keep it looking still snazzy. (https://github.com/simon-pfahler/colorblind)

I’m familiar with matplotlib -> PGFplots (using the Python tikzplotlib library). Unfortunately, I’ve decided against using it for the paper as it produces quite unmanageable outputs. Especially if I rerun experiments + with new data, and later want to change patterns, colors… It was always more of a hassle. I used it for my Master’s thesis.

Instead, Python program -> show plot -> if okay, generate CSV.

In LaTeX, have PGFplot code which reads CSV file and generates the data that way. Much, much easier to maintain.

Thanks for your words!

Yes! We use TikZ for the diagrams, which can be a nightmare sometimes… but it gets better the more I use it.

Regarding the plots, we use PGFplots. I often use matplotlib for quick plots while running experiments, but the paper itself uses PGFplots with the data in a CSV for that sweet, sweet scaling when you zoom in.

CCC just wrapped up two days ago. https://events.ccc.de/congress/2025/infos/startpage.html

This happens every year with CCC, Defcon, and Blackhat. There are always interesting talks and you get a slew of posts from interested people.

…and there you go:

https://ccs25files.zoolab.org/main/ccsfb/1REOCPAR/3719027.3765061.pdf

https://misc0110.net/files/exfilstate_ccs25.pdf

From https://www.sigsac.org/ccs/CCS2025/accepted-papers/ (#378)

Literally published less than a day ago:

ExfilState: Automated Discovery of Timer-Free Cache Side Channels on ARM CPUs

At the same conference (CCS) that the paper referred to by the ars technica article was accepted.

You can implement a counting-thread that’s even more precise than the CPU’s timer (TSC on x86) platforms. This was shown in attacks on Intel SGX, where the rdtsc instruction to access the time-stamp counter is unavailable.

https://link.springer.com/chapter/10.1007/978-3-319-60876-1_1

https://arxiv.org/pdf/1702.08719

If you remove access to the timer, attackers will simply build one.

I need a recognisable domain name website that google or duckduckgo has picked as the product.

This doesn’t always work. For example, I used to (and still do) see a lot of fake websites when I l type revanced (https://revanced.app/) on duckduckgo, and I’ve nearly fallen for two of the fake ones before (I think two of .com / .org / .to…?)

Thankfully ublock origin warns users of this:

Otherwise, I’d have 100% downloaded some malware-loaded crap.

Not exactly what you asked, but do you know about ufw-blocklist?

I’ve been using this on my multiple VPSes for some time now and the number of fail2ban failed/banned has gone down like crazy. Previously, I had 20k failed attempts after a few months and 30-50 currently-banned IPs at all times; now it’s less than 1k failed after a year and maybe 3-ish banned at any time.

There was also that paid service where users share their spammy IP address attempts with a centralized network, which does some dynamic intelligence monitoring. I forgot the name and search these days isn’t great. Something to do with “Sense”? It was paid, but well recommended as far as I remember.

Edit: seems like the keyword is " threat intelligence platform"

PR Videos to save you a click:

https://www.youtube.com/watch?v=mWKhSrsj3V0

https://www.youtube.com/watch?v=-v283Og5DLw

Thanks loads! It’s pretty sick and now is my lock screen wallpaper ;D

These are gorgeous! If it’s okay with you, may I use this as my wallpaper?

https://metapixl.com/p/Stoy/797940603119447726

If yes, is there a high res image? Thanks!

Can single-branch handle cloning from a particular commit? I know that it’s possible to clone particular branches and particular tags with depth=1, but OP states cloning at a particular commit, not HEAD.

--depth=1? I use this all the time when I clone the kernel.

Edit: reread that you wanted to download code at a particular commit.

I suggest using two different spellings:

Mold is the fungus. To mould is to shape.

Nvm I’m an idiot. Lol

That seems to be the consensus online. But thanks for that tidbit! It feels even more bizarre now knowing that.

I wonder why a handful of people think the way I presented in the post. Perhaps American/British influences in certain places? Reading books by british authors and books by american authors at the same time? Feels unlikely.

This you?

https://lemmy.world/post/10541551

Yes, this would essentially be a detecting mechanism for local instances. However, a network trained on all available federated data could still yield favorable results. You may just end up not needing IP Addresses and emails. Just upvotes / downvotes across a set of existing comments would even help.

The important point is figuring out all possible data you can extract and feed it to a “ML” black box. The black box can deal with things by itself.