"Entertainment services, namely, providing interactive multiplayer game services for games played over computer networks and global communications networks; providing computer games and video games downloadable over computer global communications networks; providing information on the video game and computer game industries via the Internet; and providing information on computer games, video games, video game consoles and accessories therefor via the Internet"

I would also suggest a 'Solo' button

down for me too

ALERT! Idle Game High Addiction

Status Updates: https://status.npmjs.org/incidents/cksjqc1w11v5?u=33mgrqjjqd...

I use Ackee, also a simple and open source alternative https://ackee.electerious.com/

Another alternative not listed in the article: https://www.offen.dev/

Came here to share Ackee. I haven't used it yet but it looks really nice.

<bgsound src="ue.mid" loop="-1"> is princeless

Little Snitch seems to have prepared for this.

https://blog.obdev.at/little-snitch-and-possible-deprecation...

That was before the WWDC 2019 announcement that all kexts are now deprecated and will be disabled soon. The Little Snitch team has been quiet about this.

Panic got some special exemptions to be in the Mac App Store previously, but they are not allowed to talk about it in detail. Perhaps LS is going a similar route and it will be revealed when Apple releases the next version of macOS.

How do people feel about Apple making these kinds of deals with Panic and others?

As a registered developer, there's a clear path to reach out to Apple and make my case, but that doesn't guarantee I can use the MAS. A lot of devs don't see a need for it though, because the Mac userbase, in general, knows how to get apps on the www.

As long as I can distribute outside, I'm okay with it. But I, and even the biggest Apple fans in the press, have acknowledged the walls closing in.

That's about a different deprecation back in 2018(?). Note this bit:

>But what happens if Apple will not or cannot provide the required features? NKEs will be deprecated, but not Kernel Extensions in general. We can still implement a Kernel Extension to augment the functionality of the NE framework.

Bam!

Very nice service but how do you manage the CDN subresource integrity (SRI) if the packages are different for each individual user?

It's possible to check subresource with es6 module but only if you know the signature first.(https://stackoverflow.com/questions/45804660/is-it-possible-...).

Even Webpack will not handle it with webpack-subresource-integrity (https://www.npmjs.com/package/webpack-subresource-integrity)

Of course HTTPS is strong but not a foolproof solution against man-in-the-middle attack.

SRI doesn't really protect against man-in-the-middle. They protect against somebody having access to manipulate the data on the CDN or a malicious CDN.

If an attacker is in a position to be man-in-the-middle and can already get around HTTPS, they might as well compromise the page loading those resources.

If you serve your start page yourself, or via a different cdn - then Sri would protect against malicious code from other cdns such as pika.

If, say, you serve example.com from one source, and link js via pika.cdn - then if pika is compromised, your site would be too. If using sri, the example.com infrastructure would have to be subverted.

All things being equal, mitm ssl or subverting a well run cdn is hard - but if you double the number of cdns in play, you make compromise of one of them twice as likely/easy. With sri, you get to keep your single point of compromise - but can leverage the benefit of a besboke cdn for your js. If any.

I could probably google this but I'm not well versed in security stuff. What would a MITM attack against HTTPS look like?

Not sure if it can be considered a MITM attack, but without subresource integrity the developers have to blindly trust the Pika CDN to host the same script file on that URL.

SRI might be impossible to implement in this case, not only because of the Differential Serving feature but the fact, based on their examples, that developers should link to the major versions of projects, which would mean that the content under the URL will change.

This is where a reliable IPFS-like CDN would shine.

There would be a number of ways to do this:

- Strip SSL by for instance blocking port 443 and hoping they fall back to HTTP.

- Get your own root certificate installed on the equipment of the user you are attacking. This is fairly common in corporate environments for instance.

- MD5 collision attacks (although almost every certificate would be SHA signed these days)

HSTS prevents the first of these if the client has connected to the server previously.

Chrome also hasn't trusted certs with MD5 since version 65.

HSTS Preload prevents that from happening even if they never visited the site