What is Hackers' Pub?

Hackers' Pub is a place for software engineers to share their knowledge and experience with each other. It's also an ActivityPub-enabled social network, so you can follow your favorite hackers in the fediverse and get their latest posts in your feed.

0
0
0

Ford flipped the switch which he saw was now marked "Mode Execute Ready," instead of the now old-fashioned "Access Standby," which had so long ago replaced the appallingly stone-aged "Off". - Douglas Adams, 1984.

0
0
0
0
0

Liberating out-of-copyright photos from SmartFrame's DRM

shkspr.mobi/blog/2022/05/liber

<html><head></head><body>

During the middle of the 20th Century, the UK's Royal Air Force took thousands of photographs of the country from above. Think of it like a primitive Google Earth.

Those photographs are "Crown Copyright". For photographs created before 1st June 1957, the copyright expires after 50 years.

Recently, the organisation "Historic England" started sharing high-resolution copies of these photos on a nifty interactive map.

Aerial Photo Explorer  You can explore over 400,000 digitised photos taken from our aerial photo collections of over 6 million photographs preserved in the Historic England Archive.  Use our nationally important collections of aerial photographs to explore your area. Find the place where you live or why not look for your favourite football ground, railway station or the places you visit?

But there were two problems.

Firstly, they claimed that the photographs were still under copyright. This (no doubt inadvertent) mistake was pointed out to them and was eventually corrected.

Twitter

The second, and to my mind more troubling, problem is that the photos were "protected" using SmartFrame's Digital Restrictions Management.

SmartFrame has some useful features - it allows for high-resolution photos to be loaded "zoomed out" in lower resolution. The user can then zoom in on a portion which then gets loaded as higher resolution. That's it really. SmartFrame's main selling point is that it "brings robust image control". AKA, it uses DRM to prevent users from downloading images.

It also promises "Complete image protection". This is nonsense. If you transmit an image to a user, the user can copy that image.

Here's how easy it is to download the images which SmartFrame claims to protect.

Screenshots

The obvious flaw in SmartFrame is that users can take screenshots of the high-resolution image. Zoom in, screenshot, pan left, another screenshot, repeat.

Of course, stitching together all those images is a bit of a pain. But perfectly possible to automate if you wanted to.

Canvas Chunks

The way SmartFrame works is by loading small "chunks" of the image and then drawing then on a <canvas> element.

In your browser's network inspector, you'll see each 256x256 sub-image loading.Screenshot of a network inspection panel. Dozens of JPEG images are being downloaded.The images are not encrypted, so they can be saved directly. Again, it is a manual and tedious process to scrape them all and then stitch them together.

Inspecting the network requests shows that they all use the same Accept Header of authorization/wndeym9ajvin,*/* - that appears to be common across multiple SmartFrame instances. Bad form of them to reuse that key!

Canvas Access

It's fairly easy to download anything drawn onto a <canvas> element by running:

 JavaScriptvar c = document.getElementsByClassName("stage") c[0].toDataURL() 

However, SmartFrame have overloaded the .toDataURL() function - so it produces a warning when you try that. It's simple enough to disable their JS once the image has loaded.

Of course, the <canvas> is smaller than the full resolution image - so you may need to manually increase its size first.

It's also possible to simply right-click on the <canvas> in the inspector and copy the Base64 representation of the image:

Screenshot of the context menu showing a download option.

Putting it all together

I am indebted to Stuart Langridge for connecting all the dots. He has written and fully documented some code which is, essentially:

  1. Grab the canvas
  2. Resize it
  3. Wait several seconds for the image chunks to fully load onto the canvas
  4. Turn the canvas into a Data URL
  5. Download the data

It looks something like this:

 JavaScriptvar container = document.querySelector("div.articlePage.container");container.style.width="6000px";container.style.maxWidth="6000px";setTimeout(()=>{  var stage = document.querySelector("canvas.stage");  var url = document.createElement("canvas").toDataURL.call(stage);  var a = document.createElement("a");  a.href = url;  a.download = "liberated.png";  a.click();}, 3000);

And that's it. A user can paste a dozen lines of Javascript into their browser's console and get a full-resolution PNG.

Warnings

This technique should only be used to download images which are free of copyright restrictions.

Companies should be careful before buying a DRM solution and ensure that it is fit for purpose. SmartFrame really isn't suitable as sold. Despite its grandiose claims of "Super-strong encryption" and "Multi-layered theft-prevention" - it took less than weekend to bypass.

It is possible that SmartFrame will update their systems to defeat this particular flaw. But, thankfully, DRM can never work effectively. You can't give users a locked box and a key - then expect them to only unlock the box under the "right" circumstances.As Bruce Schneier once said:

trying to make digital files uncopyable is like trying to make water not wet.

</body></html>

0
0
0
0
0
0
0
0
0

Imagine a publishing house with the mission of making knowledge and insights available to everybody for free, while ensuring high standards.

Well, the three universities of Berlin and the Charité have now joined forces to do just that.

They founded "Berlin Universities Publishing". Neither authors not readers pay. The pdf of books are freely available under a Creative Commons licence.

It's called "Diamond Open Access". They're just starting up. Much more to come.

berlin-universities-publishing

0
0
0
1

Hey Apple. Sort your fucking house out. I just got a notification summary that ‘Dad had another stroke’ when he hadn’t (he’s had a stroke before so there was a small reference in the message).
Naturally I shit my pants and tapped on the message straight away so wasn’t able to get a screen grab.

0
0
0
0

I'm still looking for a general "web development" podcast.

One that talks about new CSS or browser features, touches on PHP and JavaScript and Docker and AWS. Doesn't need to be evergreen, just "what's caught our attention".

Anyone know of one? If not, do I need to start one 🤔?

0
0
0
0
0
0
0
0

A bunch of tech CEOs are talking about being “AI-first”, the latest in a series of CEO fads like “return to office”, “founder mode” and “pivot to full fascism”. This one’s weird, though, because it only makes sense if… none of their workers are great at their jobs. anildash.com//2025/04/19/ai-fi

@anildash I feel that a lot of mangement fads are driven by the fact that most companies simply don't understand how to manage or train workers, and so they love gimmicks that allow them to work around that inability instead of addressing it.

Even the old "10x engineer" thing is a manifestation of this. Tech cos want people who self-manage (because they don't know how to manage) and can take on so much work they don't need to collaborate (because the workplace is bad at enabling collaboration).

0

📢 research call 📢

please boost! we're running a series of small group design workshops for community governance on fedi. if you are a user, admin, mod, dev, organizer - or have thought quite a bit about governance on fedi - and a legal adult in your locale, join us!

each workshop, scheduled based on peoples' availability, is:
🌐 2 hrs on Zoom
👥 w/ 6-10 people
💲 comes w/ $60 USD per person

details: dsmw.cs.princeton.edu/
sign up: princetonsurvey.az1.qualtrics.
questions: frictance@princeton.edu

An image acting as a flyer with the following text: Calling all decentralized social media users, admins, and devs for a research study about community moderation! The study involves participating in a 2-hour workshop on Zoom with 6-10 other people. Participants can get $60 each. Sign up at: dsmw.cs.princeton.edu and email frictance@princeton.edu with any questions.
0
0
0

I posted the same thing on both Bluesky and Mastodon where I have 3,578 and 3,404 followers, respectively. The posts were done Apr 28 in the afternoon. The engagement levels were (Bluesky vs. Mastodon):

- 1 vs. 0 comments
- 2 vs. 0 reshares
- 15 vs. 8 likes/favourites

0

With so many social programs being cut right now, and so many people in need, I'm changing up my sticker program a little.

You can still get one of my stickers, but I'm now *requiring* that folks donate to a food bank or similar. I'll still send you one at no cost with proof of donation!

We all need to pitch in if we're going to get through this together.

billhunt.dev/stickers/

Two different sticker designs - one says "Govpunk" and the other says "Move Carefully and Fix Things"
0
0
0
1
0
0
0

I'm still looking for a general "web development" podcast.

One that talks about new CSS or browser features, touches on PHP and JavaScript and Docker and AWS. Doesn't need to be evergreen, just "what's caught our attention".

Anyone know of one? If not, do I need to start one 🤔?

0
0
0

The @osuoslOSU Open Source Lab asked for help with funding to keep services going. They power hundreds of open source projects (@openstreetmap, CensusReporter, Debian, Sqlite, etc.) by providing free or low-cost co-location, VMs, storage, distributed mirroring, and more. They give experience to students at OSU, who help maintain the hardware and systems we all rely on.

They are a vital piece of the open source world, and need some ideas for funding. If something comes to mind, reach out and I will pass it along.

0
0
0
0

🚨 :OSI: The work of @osuoslOSU Open Source Lab is at risk as US academic funding faces historic challenges. The Lab hosts infra for over 1000 projects, and uses the opportunity to train students in critical skills. Nothing comes close to the value that OSL provides the global community.

If you or your employer can help support this critical work, check their website for donation and contact info.

:boost_love:

osuosl.org/donate

0
0
0
0
0
0

📝 I find it ironic that the web platform has such a strong ethos of "no breaking changes” but the tools we use to build on top of the web are like "BREAKING CHANGE ALL THE THINGS”

blog.jim-nielsen.com/2025/back

0
0
0
0
0

@maikekMaike There are a lot of female characters, but the main character is always male, and the primary interactions are main character -> non-player character, so there's not a lot of interaction between NPCs. I think there are a couple of parent-child relationships, but their interactions are largely mediated through the player!

0