• 0 Posts
  • 18 Comments
Joined 1 year ago
cake
Cake day: August 13th, 2023

help-circle




  • For just regular text to be consumed by humans, it’s not that great, you probably want a word processor.

    It shines when you do a lot of more structural editing, stuff like “change all quotation marks on this line to be single tick”, “copy everything inside these parentheses and paste it after the equals sign”, “make the first word on the next five lines uppercase”, these are the type of things vim make easy that are not easy in other editors.

    So it’s great for code and config files. Markdown is borderline. You can have a setup that lets you live view how the markdown renders while editing in vim, so it can be pretty good, but the advantage might be a bit dubious.



  • tl;dr: Run vimtutor, learn vim, enjoy life

    It’s extremely powerful, for mostly the same reason that it’s incomprehensible to newbies. It’s focused not on directly inputting characters from your keyboard, but on issuing commands to the editor on how to modify the text.

    These commands are simple but combine to let you do exactly what you want with just a few keypresses.

    For example:

    w is a movement command that moves one word forward.

    You can put a number in front of any command to repeat it that many times, so 3w moves three words forward.

    d is the delete command. You combine it with a movement command that tells it what to delete. So dw deletes one word and d3w deletes the next three words.

    f is the find movement command. You press it and then a character to move to the first instance of that character. So f. will move to the end of the current sentence, where the period is.

    Now, knowing only this, if you wanted to delete the next two sentences, you could do that by pressing d2f.

    Hopefully I gave a taste of how incredibly powerful, flexible, yet simple this system is. You only need to know a handful of commands to use vim more effectively than you ever could most other editors. And there are enough clever features that any time you think “I wish there was a better way to do this” there most certainly is (as well as a nice description of how).

    It also comes with a guide to help you get over the initial learning curve, run vimtutor in a console near you to get started on the path to salvation efficient editing.





  • But that post is Mozilla clearly speaking out against SREN because they do not want to be compelled to block certain sites.

    Are you then talking about Google Safe Browsing? Which is enabled by default in Firefox, but which does not “monitor your activities”. It compares the site you are about to visit to a downloaded list of known bad ones and warns you if it’s on the list. Hardly an Orwellian nightmare. Just turn it off or ignore the warning if you do not want it. I keep it on because I’ve never seen a false positive on that list and I understand that even I’m vulnerable to attack.

    We should be free to customize programs, free to block what we don’t need

    And you are. If you don’t want to use safe browsing, turn it off, is right there in the menu. They have given you a default that’s best for most people and the option to customize.

    Further, since it’s free software there’s really no limit to your power to customize or get rid of what you don’t need. (I understand that this is not possible for most people, but that’s why you have the menu options, this is just a final line of defense.)


  • Security for the user is obviously what we are talking about. Regular people do not have the knowledge or patience to make informed decisions regarding their technical security; any model that relies on that is going to fail because people will click whatever they need to make stuff work. Even people who do understand the technology do stuff like disabling SSL verification, rather than going through the effort of adding the new CA to their cert list.

    Firefox is not doing the same as Chrome. Firefox is adding a feature to disable unverified add-ons on particular domains to stop attacks from malicious add-ons. Chrome is adding a feature that tracks the sites you visit and shares them with other sites to improve ad tracking.

    How are these features comparable at all?


  • That’s interesting. The first site on the list is the self-service login page for Banco do Brasil. Doing a little bit of digging suggests that attacking the users local environment to steal money via self-service is a widespread problem in Brazil. That would explain the need to block all add-ons that are not known safe for a page like this so they can’t swap that login QR-code. Here’s an (old) article detailing some of these types of attacks https://securelist.com/attacks-against-boletos/66591/

    I wish Mozilla would be more transparent about this, but I speculate that they might be provided these domains under NDA from the Brazilian CERT or police.

    TBH I think malicious add-ons are the new frontier of cybercrime. Most classic attacks methods are well mitigated these days, but browser add-ons are unaffected by pretty much all protections and all the sensitive business happens in the browser anyway.

    remotely monitored their browsing real-time

    it’s kind of inevitable that sometimes they have to support that giant

    What more specifically are you talking about here? The functionality we are talking about can not be used for remote monitoring. Are you saying Mozilla added this feature under duress from Google?



  • While I don’t completely understand the use cases for Mozilla’s add-on domain blocklist, I also don’t see any reason to assume malicious intent. Malicious add-ons are a very real and serious threat and it’s obvious that Mozilla need a way to quickly and remotely protect users. Doing so on a domain level is much less impactful than completely shutting down an add-on.

    Since it is obvious to the user if this is triggered, and the user has the option of disabling it per add-on or completely, what’s the real problem?

    (That said I think it’s great that people are being skeptical even of Mozilla)

    Edit: Sorry I misunderstood how this is displayed, it is not as obvious as I thought. Hopefully this will be improved. Though doing so might come with the drawback of making unwitting users more likely to disable the protection.