Allow to inject objects to actions without the requirement to define them in the container

This PR https://github.com/yiisoft/yii2/pull/18032 added action injection. But currently there is a requirement to define objects that are to be injected in the container. If the container knows nothing about the class type the exception will be thrown.
So the following code will work without definition of the type MyService in the container:
public function actionIndex()
{
    $service = \Yii::$container->get(MyService::class);
    $result = $service->doSmth();
    $this->render('index', compact('result'));
}

and this code won't work without defining MyService in the container (it will throw an Exception):
public function actionIndex(MyService $service)
{
    $result = $service->doSmth();
    $this->render('index', compact('result'));
}

The author of this PR @SamMousa has arguments against allowing injecting arbitary objects. You can read them here https://github.com/yiisoft/yii2/pull/18032#issuecomment-727220098.
But I have several arguments in favor of this idea.

The behavior of the container differs from other parts of the framework. In any other part if there is no definition in the container about the type, it will just try to create the object of this type. In action injection it will throw an exception.

As we can see in the example above developers can create any objects inside the action through $container->get() and disallowing them direct injection via function arguments doesn't protect against misunderstanding of what should be injected and what should not be.

As far as I understand this feature (action injection) was postponed for a long time. And the main argument to implement it in Yii2 framework was that it would be allowed in the 3rd version. So it will be easy in future to migrate from Yii2 to Yii3.
As I can see currently Yii3 allows to inject objects to the actions without the requirement to declare their types in the container (correct me if I'm wrong). So it would be more logical to allow the same thing in Yii2.

It can be fixed very easy. Just need to rollback this commit https://github.com/yiisoft/yii2/pull/18032/commits/03b7c845ca25745785bb4ff5ef5d2cbc760bcc74.

Arguments 1 and 2 are invalid.

The behavior of the container differs from other parts of the framework.

You are comparing a container misused as a service locator with dependency injection; these are not the same things.

As we can see in the example above developers can create any objects inside the action through $container->get() and disallowing them direct injection via function arguments doesn't protect against misunderstanding of what should be injected and what should not be.

The argument that people can write bad code in other ways is not an argument to add new ways for people to create bad code.

Ok, let me add some more code to my example. Let's say I have my service class and it also has a dependency - a repository object.
class MyService
{
    private MyRepository $repository;

    public function __construct(MyRepository $repository)
    {
        $this->repository = $repository;
    }
}

If I skip the definition of MyRepository inside the container, it will be created for me by the container (with its dependencies if there are any). That's why I'm writing that the behavior differs from other parts of the framework. So when I'm injecting to the action I'm actually expecting the same behavior. If this behavior is undesirable we should force to define any class that is supposed to be injected (and their dependencies) inside the container.
It is also interesting how other frameworks implement action injection. May be it is not the main argument but it is also something to be considered. As far as I remember Symfony allows to inject objects from App namespace (with excludes set in the config).

But proper code wouldn't do that...
Instead you would have an interface that is implemented by your service, then your action requires the interface not a concrete implementation. This means you must configure that relation in your container since it won't be able to construct an interface.
In your example if you define MyService in the container it will still auto create the dependency, you just have to configure the dependency that you're injecting not the child dependencies.

@SamMousa in theory you're correct. In practice, you're not always creating an interface for every possible service especially if you're more than sure it won't be replaced ever.

True, but even then, configuration in the DI container is just one line. At the very least if we do it, it should become optional imo.

I think either we don't do it or we do it by default. Making it optional doesn't make sense to me since you'll have to take that into account when developing extensions.

In that case my vote is against it.. It doesn't do any favors to code quality and we shouldn't forget that this is mostly about injecting classes that have no configuration and therefore can just as well be constructed..
In most cases we will either inject a service defined in the container or a component defined in the application, both cases are supported.

Makes sense. Won't be implemented.

we shouldn't forget that this is mostly about injecting classes that have no configuration and therefore can just as well be constructed.

If I understood you correctly you mean that we inject mostly services and they can be constructed with a contstructor call (new Service()). But services has a lot of dependencies, mostly components that can be injected into it instead of using service locator (for example a Mailer). So we can not just instantiate a service, we need to inject it. And this dependencies can be constructed automatically for us, so we can completely skip a service definition from the container.
Now I can use Yii::$container->get() to get any service from a container.

You are comparing a container misused as a service locator with dependency injection

You are right, it is not the proper way to do. But I can also inject dependencies via controller's constructor (overriding it). It is the proper way of using DI, isn't it? And I can do it without defining the service in the container. My main point is an illogical behavior that allows constructing dependencies in one place but denies it in another one. Why is an action injection a special case that we should always take care of?
The problem with injecting services to controller's contructor is that if I have many actions and each of them use it's own service I need to inject all the services inside the constructor. Despite of that I won't use all of them except the one. The alternative is to break the controller into separate action classes with their own constructors and map them by actions() method. But if action is very simple (create the form, validate the input, pass a dto to the service and render the view) then it can be too complicated to have a separate class for an action.
The action injection simplifies things a lot. But with current implementaion I need to do somewhere in container's configuration
Yii::$container->set(Service1::class);
Yii::$container->set(Service2::class);
Yii::$container->set(Service3::class);
...
These definitions can be omitted because they are needed only for inecting them in the actions. Services have dependencies themselves (the 3rd parameter) but I can skip defining them because they will be constructed automatically in most cases.
So my main argument that we have an illogical behavior that contradicts the rest parts of DI usage in the framework.
This feature (action injection) is a great way to reduce the code amount needed to define an action. But it can be improved by removing the redundant service definitions (like in my example above). They do not serve any other purpose except allowing action injection.
Also it is not working the same way as Yii3 will. And we missing one of the main purpose of implementing these feature.

You misunderstand. Services you want to inject. But services most likely have some configuration and therefore will already be defined in your components or in DI config itself (and thus you can already inject them)

But services most likely have some configuration and therefore will already be defined in your components or in DI config itself (and thus you can already inject them)

Ok, I got it.
But they can have no explicit configuration (when all their dependencies can be resolved automatically by the container). In this case their definition in the container is redundant in my opinion. And in my personal workflow they do not have explicit configuration in most cases.
And what about my other arguments about an incosistent behavior and Yii3?

I don't think the Yii3 argument is relevant. The whole point of a major
upgrade is to allow for changing behavior.
Also, I'm not too deep into Yii3, but I'd probably argue against action
methods as a whole. Action classes make more sense and solve the discussion
by using pure constructor injection.
On Mon, 23 Nov 2020, 08:08 dmotitsk<EMAIL_ADDRESS>wrote:

But services most likely have some configuration and therefore will
already be defined in your components or in DI config itself (and thus you
can already inject them)
Ok, I got it.
But they can have no explicit configuration (when all their dependencies
can be resolved automatically by the container). In this case their
definition in the container is redundant in my opinion. And in my personal
workflow they do not have explicit configuration in most cases.
And what about my other arguments about an incosistent behavior and Yii3?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/yiisoft/yii2/issues/18388#issuecomment-731970722, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AAEFRTKJZSU3DAXTBAACEZ3SRIC75ANCNFSM4TXGYYJA
.

I don't think the Yii3 argument is relevant. The whole point of a major upgrade is to allow for changing behavior.

I constatly refer to Yii3 because as I understand this post https://github.com/yiisoft/yii2/issues/17722#issue-535273746 the whole idea was to make it easier to migrate from Yii2 to Yii3. And it is not the situation when we have a feature for a long time in Yii2 and we rework and reintroduce it in the next major version. As for me if this was decided to be implemented after the feature freeze it should be done keeping Yii3 in mind.

Action classes make more sense and solve the discussion by using pure constructor injection.

I used action classes with constructor injection before action injection became available. It is OK but for the simple cases it can be an overkill. Either way if Yii3 completely disallow action methods of controller it will be too different from other frameworks.
As for me action injection is a great "framework-level sugar". You implemented a great feature, but as for me, you were too strict requiring service definition in the container. First time when I wrote an action after this feature was presented I was very surprised that my service wasn't injected and I got an exception. Because I was used to the fact that the container creates undefined classes automatically.  I expected one thing from my experience with the framework, but got the opposite.
These feature is cool and it makes much convinient to define actions but I think we can move it one step further as it is done in Yii3 and other frameworks. Those who want to explicitly define services in the container can continue to do this. Those who want to ommit services with empty $params argument will be able to skip this. And it will not take much work to implement.

And it is not the situation when we have a feature for a long time in Yii2 and we rework and reintroduce it in the next major version.

We didn't have this for a long time, if you want an easy migration path you don't use the Yii2 version and wait for Yii3.

First time when I wrote an action after this feature was presented I was very surprised that my service wasn't injected and I got an exception.

I don't see an issue here, you get surprised but it fails hard so you learn and you can now write cleaner code because of it.

actions but I think we can move it one step further...

And I think that would hurt code quality instead of helping it. Regardless, I'm done discussing this, I think we've both have repeated our arguments and further discussion serves no purpose.
Note that I did not make the decision, I've just explained my reasoning and preference.
If you want you can easily use your own controller class and change the behavior however you want.
Don't get me wrong, I don't mind the input or criticism, but I'm not going to spend time in a debate when there are no new arguments coming forward :)

Hi @dmotitsk,
i think i have a solution for you. I am missing it as well, it would be really nice to have proper RequestModel auto injected in action method, without setting it up manually.
so my solution is (still in work in progress, but it is already working):
i created an action filter, which makes possible to auto register missing class names just before the action run, and clear it after run. It uses the same logic as bindInjectedParams

namespace system\base;

use Yii;
use yii\base\ActionFilter;
use yii\base\Controller;
use yii\base\InlineAction;

class OnDemandClassDefinitionRegister extends ActionFilter
{
    protected string $registeredClass;

    public function beforeAction($action)
    {
        if ($action instanceof InlineAction) {
            $method = new \ReflectionMethod($action->controller, $action->actionMethod);
        } else {
            $method = new \ReflectionMethod($action, 'run');
        }

        foreach ($method->getParameters() as $param) {
            $name = $param->getName();

            if (
                ($type = $param->getType()) !== null
                && $type instanceof \ReflectionNamedType
                && !$type->isBuiltin()
            ) {
                $this->registerClassDefinition($action->controller, $type, $name);
            }
        }

        return parent::beforeAction($action);
    }

    final protected function registerClassDefinition(Controller $controller, \ReflectionType $type, $name)
    {
        $typeName = $type->getName();
        if (($controller->module->get($name, false)) instanceof $typeName) {
        } elseif ($controller->module->has($typeName) && ($controller->module->get($typeName)) instanceof $typeName) {
        } elseif (\Yii::$container->has($typeName) && (\Yii::$container->get($typeName)) instanceof $typeName) {
        } elseif ($type->allowsNull()) {
        } else {
            $this->registeredClass = $type->getName();
            Yii::$container->set($type->getName(), $type->getName());
        }
    }

    public function afterAction($action, $result)
    {
        if (isset($this->registeredClass)) {
            Yii::$container->clear($this->registeredClass);
        }
        return parent::afterAction($action, $result); // TODO: Change the autogenerated stub
    }
}

In controller following markup can be used:
public function actionEvents(EventRequest $request)
    {

Request object itself:
<?php

namespace modules\schedule\backend\requests;

use Illuminate\Support\Carbon;
use yii\web\Request;

class EventRequest {
    private Request $request;

    public function __construct(Request $request)
    {
        $this->request = $request;
    }

    public function start(): string
    {
        return Carbon::parse($this->request->get('start'))->toDateTimeString();
    }

    public function end(): string
    {
        return Carbon::parse($this->request->get('end'))->toDateTimeString();
    }
}

for this i did registered main request in DI container (only one request should exists)
\Yii::$container->set(Request::class, fn() => \Yii::$app->request);


fix cheatnet fork cache

Introduced changes

Breaking changes

Checklist

[ ] Linked relevant issue
[ ] Updated relevant documentation
[ ] Added relevant tests
[x] Performed self-review of the code
[ ] Added changes to CHANGELOG.md

@jainkunal can you take a look at the failed tests, or should we do that instead?

I will give it a try, most of the tests didn't pass for me locally even without the change so I assumed it was unrelated. I will see what I can fix.

I will give it a try, most of the tests didn't pass for me locally even without the change so I assumed it was unrelated. I will see what I can fix.

Hey @jainkunal, could you give some more insight on what were the errors when you ran tests locally and "most of the tests didn't pass"?
All checks do pass on master branch, and the 3 tests that failed seem to be connected to the change in this PR.

@jainkunal closing in favour of #1002 (cache parsing was off) - full credits to you for finding this bug 👏

@jainkunal
Released today in:
https://github.com/foundry-rs/starknet-foundry/releases/tag/v0.9.1


get_open_trees_from_one_zoom.py emits warnings for missing taxa even if bespoke versions exist in OT_required

There are 2 files in https://github.com/OneZoom/tree-build/tree/main/data/OZTreeBuild/AllLife/OpenTreeParts/OT_required, labelled  4795972.nwk and 5205266.nwk which are transferred in step 2 to the OpenTree_all directory, as a stand-in for taxa that are missing from the current OpenTree.
The get_open_trees_from_one_zoom.py script complains that it can't find these taxa on the OpenTree, which is true, but that warning doesn't need to be emitted, because we have provided substitutes. So the warning code needs a small tweak to avoid warning when taxa are present in the OT_required directory.

I think it's actually build_oz_tree and not get_open_trees_from_one_zoom that outputs this warning. I will look into it.

Thanks! I've almost fixed up the new tree. Just hitting a recursion problem (will post in a second)

Actually, I can't repro this. Here is the output when I run get_open_trees_from_one_zoom:
WARNING:root:Could not find the following taxa: 385878, 747323, 5205266, 4795972, 523271

And when I run get_open_trees_from_one_zoom:
WARNING:root:Subtree file OpenTreeParts/OpenTree_all/523271.nwk does not exist
WARNING:root:Subtree file OpenTreeParts/OpenTree_all/747323.nwk does not exist
WARNING:root:Subtree file OpenTreeParts/OpenTree_all/385878.nwk does not exist

So I don't see anything about 4795972.nwk and 5205266.nwk.

I think you may have skipped step 2. When I skip it, get_open_trees_from_one_zoom gives:
WARNING:root:Subtree file OpenTreeParts/OpenTree_all/523271.nwk does not exist
WARNING:root:Subtree file OpenTreeParts/OpenTree_all/747323.nwk does not exist
WARNING:root:Subtree file OpenTreeParts/OpenTree_all/385878.nwk does not exist
WARNING:root:Subtree file OpenTreeParts/OpenTree_all/4795972.nwk does not exist
WARNING:root:Subtree file OpenTreeParts/OpenTree_all/5205266.nwk does not exist

Thanks for checking. I'm actually running from a new version of the files. I'll post a PR - just trying to track down a bug

I'm still getting the subtree error in stage  #54, and I don't believe I should be:
WARNING:root:Could not find the following taxa: 4795972, 5205266

I'm actually seeing 4 missing with all your changes:
WARNING:root:Could not find the following taxa: 523271, 4795972, 5205266, 747323

Not sure why we see different things, but I'll dig into it

Hmm, that's weird. Both  https://tree.opentreeoflife.org/opentree/argus/opentree14.9@ott523271 and https://tree.opentreeoflife.org/opentree/argus/opentree14.9@ott747323 are ctenophores, and I have been fiddling with those. They shouldn't be being substituted, though.

Ah, I have an idea @davidebbo : you might need to clear out all the files from data/OZTreeBuild/AllLife/BespokeTree/include_OTT3.6draft1/ before starting the pipeline. We should probably add that to the instructions.

Yes, that was it! Now down to the same as you: 4795972, 5205266.
Base.PHY has Aenigmarchaeota_ott4795972@ and Diapherotrites_ott5205266@, which don't exist in the open tree. So aren't these warnings expected?

They don't exist, but I grabbed them from a previous open tree version, and put them in the OT_required folder, from where they get copied in step 2. So we aren't missing them from the pipeline, just from v14.9 of the open tree. Since we have explicitly provided them as bespoke OpenTree additions, I don;t think we need to warn (or if we do, we should say "not in the open tree that you used, but have been provided separately."
It's not worth too much work thought. There are only two files! It's just nice to be able to complete without errors.

Oh, I get it now, sorry! As it stands, the tool is not smart enough to not look for those in the big tree. Maybe we don't need this warning at all, since if we were missing something, we should catch it in the next step (build_oz_tree).

It's a good point that we probably catch them later. I guess we can turn it into an "INFO" string instead.

Yes, that was it! Now down to the same as you: 4795972, 5205266.

I added an rm command to the steps to clear out that directory, so we don;t have the same problem again.

Something in the latest CtenophoresWhelan2017.PHY is causing add_ott_numbers_to_trees to blow up: dendropy.dataio.newickreader.NewickReader.NewickReaderMalformedStatementError: Error parsing data source on line 1 at column 47: Malformed tree statement
You're not seeing this?

I made a typo and have force pushed a change. Do you want to grab the PR again and retry?

Yep, all good now! Bed time for me, so I'll continue tomorrow.

Great. Sorry not to have let you know about the update. I think I'm happy to merge this now.

Yes, please go ahead and merge if it all seems good!


make it so you can disable the auto-play button or move it somewhere else

it usually appears on the video no matter what theme you choose for the interface. there should be an option to move the auto-play button somewhere else since it looks out of place in the original spot

Yeah, this is planned to be done very soon.

@lightbeam24 since it has been two weeks, I must ask if it has been finished or if it is almost finished because I can't see it in the customtube settings yet

It's done now, but it's part of the very large 1.3.0 update that will take a while to come out. A beta will be released for it before then.

Alright, thank you for the reply.


Binary Ninja crashing when using Find

Version and Platform (required):

Binary Ninja Version: 3.5.4526 Personal, ec37d737
OS: windows
OS Version: 11
CPU Architecture: x86_64

Bug Description:
When running Find against a large bndb, the latest version of Binary Ninja is outright crashing on my system. It doesn't look like an OOM event, but Binary Ninja doesn't seem to have a comprehensive crash dump utility, so I'm not really sure how we're expected to give crash logs in these scenarios? The best I can do is give the Windows Error Reporting event details.
Steps To Reproduce:
Might not be able to reproduce on your side - open a large binary and run Find against some hex string.
Expected Behavior:
To complete the search.
Screenshots:
Additional Information:
From the Windows Error Report:
Faulting application name: binaryninja.exe, version: 3.5.4526.0, time stamp: 0x6504376e
Faulting module name: binaryninjacore.dll, version: <IP_ADDRESS>, time stamp: 0x650436ac
Exception code: 0xc0000005
Fault offset: 0x0000000000799466
Faulting process id: 0x3874
Faulting application start time: 0x01da3ac84c0e5f28
Faulting application path: C:\Users\Ben\AppData\Local\Vector35\BinaryNinja\binaryninja.exe
Faulting module path: C:\Users\Ben\AppData\Local\Vector35\BinaryNinja\binaryninjacore.dll
Report Id: c4e018c5-cb67-4540-9917-c11c7d79bf6d
Faulting package full name:
Faulting package-relative application ID:

Does this repro with latest dev?

Just tried with Personal 3.6.4740-dev and the problem persists.

@commonbreed could you please share the binary so that I can reproduce it?
Also, in many cases, the "find" is not the best way to find code patterns. IL matching is better in many cases. I suggest you join our slack (https://slack.binary.ninja/) and ask us about it.

We've been able to reproduce this and are getting the fix into the stable build that's just about to go out!

Fixed in 4.0.4905

Still happens consistently on 4.0.958.
123mb binary. Searching for small values with "Find All" ticked = hangs.

Still happens consistently on 4.0.958.
123mb binary. Searching for small values with "Find All" ticked = hangs.
Win11 i7-14700k 64GB DDR5-5000MHZ

Hi @zkxjzmswkwl, thx for the report. Could you please share with us a binary that can trigger the issue?

Which find type is selected in the drop down? Can you try with the advanced search option?


Undefined symbols for architecture armv7:   "OBJC_CLASS$_UnityAppController"

Hi guys
Does anyone know why i'm getting this error when trying to build:
Undefined symbols for architecture armv7:
  "_OBJC_CLASS_$_UnityAppController", referenced from:
      objc-class-ref in libreact-native-unity-view.a(UnityUtils.o)
      objc-class-ref in libreact-native-unity-view.a(RNUnityViewManager.o)
ld: symbol(s) not found for architecture armv7

I recently updated unity version, i can build and run just fine to physical device. But when trying to build to archive im presented with the above error?

any solution ?

Yeah so it appears 2020 version of unity does not build the unityframework for armv7 anymore.
So setting the architecture in Xcode to arm64 only solved the issue.
Running into issues on android now though!

On 15 Jul 2021, at 19:15, Harish SN @.***> wrote:

any solution ?
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or unsubscribe.

Everything is set to arm64. Unfortunately that didn't help. Is there any other possible solution to the issue?

These two solutions worked for me
First one
have solved this by selecting armv7 and arm64 both on buildsetting it worked for me.
Second One
Just Downgrade the Unity version because after 2020.1 unity does not support armv7 by default so choose 2019 or 18 but make sure to back-up your Unity project


Feature request: Search for other versions

I was about to report a bug, but discovered that I had two versions of youtube-dl.  One was installed a long time ago using -

sudo curl https://yt-dl.org/downloads/2016.02.10/youtube-dl -o /usr/local/bin/youtube-dl
sudo chmod a+rx /usr/local/bin/youtube-dl

and the other was installed using

sudo pip install --upgrade youtube_dl

which youtube showed me that I was using the old version.
It would be good to have youtube-dl look into common paths to see if there is another verision - old / new installed and give user a warning. If this is too much to do on each run, this should atleast happen if there is a bug / error.
A web check to see if a newer version exist (on error) would save a lot of debugging and redundant bug reports.

Managing different versions of youtube-dl is your responsibility not youtube-dl's. youtube-dl can't know all the possible common path your particular package manager may use.


New logo

Integration of the new logo by @funelie
Fixes #569

Do git commit --amend --author "name <email>" to set the author to @funelie's preferred name and email.

Done.

I'd call them logo_joined.svg, logo_split.svg, and logo_square.svg instead, just to make the names clearer. (Also "split" instead of "splitted" sounds more correct to me.)

Thanks a lot @funelie!


How many Self-Practice Exercises are there in total?

Curious about that, hehe...

At least six... could be more depending on the progress we are making.


Last fixes

[x] Is the paragraph font the same as Commbus - Avenir Next?

[x] On the home (at the bottom) These links need to link through to the individual pages

[x] On the contact page, the email is cut off, can we change this so that it all fits onto one line, please?

[x] On the Google map, the pin is in the wrong place, the blue marker is correct, is there a way to hide the red pin so that it only shows the blue pin?

[x] On the Weddings, Parties, Events & Hospitality page the finer details page aren't formatting correctly. They aren't picking up the paragraphs.

[x] On the additional services page, can the boxes be left or right aligned like they are on the home page as opposed to in the middle:
These 3:

Left or right like these:

[x] Can there be more space between these sections so double the white gap on the page: (between tow bar, hire shop, looking for something different, land)

[x] Can you let me know how to add the images to the blog, please (as described in earlier issues, need 3 so text then image, text then image, text then image)

[x] There are still some mobile issues, on the home page the hero image is still stretched and the writing overlapping, the writing in the finer details section is overlapping the box, the 'view more' button is still really tiny - can you go through mobile and double-check all pages, please?

[x] Animations still pending

[x] Setup image on the contact page so that it can be changed in contentful - would like it to be this one (instead of the tow bar)

[x] Sorry, I thought I could edit this myself but I can't - where there is the download image I need it to be changed to this image attached (it says download brochure instead of download showcase). It is on the: weddings, parties, events, hospitality, hire option 1, hire option 2, hire option3, hire option 4 and contact page.

@dharmveer97  how are you getting on with these, do you have a date of when they will be complete? Let me know if there is anything you need from me. Thank you

Hey, @kpierduta some issues are closed by me have a look at them.
Aslo add on sanity.
and Me and Kunal working on animations.

@dharmveer97  I know you are still working on the contact page as there will be more downloads, but just to mention the bigger download image, I need to be able to change it in Sanity to this one (the only difference is that it says 'Download brochure' instead of 'Download showcase'
I have managed to change all the others, thank you.

The contact page is looking great @dharmveer97

[ ] Just a couple of minor text changes (see image below)

[ ] Link up downloads to Mailchimp list
https://www.gatsbyjs.org/packages/gatsby-plugin-mailchimp/

Brochure download Mailchimp list ID is 8e473db50c
All hire option downloads - the 4 near the bottom of the contact page will go to the same list. The Mailchimp ID is 0d88b23380

[ ] Add the 5 PDFs to files in Sanity
4. Deckerdence Full Wrap around Marquee.pdf
1. Deckerdence Bus Bar.pdf
3. Deckerdence Half Wrap around Marquee.pdf
Deckerdence Digital Brochure.pdf
2. Deckerdence Bus Bar with Awning.pdf

@dharmveer97

[ ] Can you add links to home page hero section, so:

Find out more = /hire
link up email (mailto:) and link to telephone number (tel:)

[ ] On mobile the first testimonial is overlaying the box at the top and the bottom. The second testimonial is overlaying the box at the bottom.

[ ] On mobile, some of the blog images aren't loading (on the main overview blog page /journal

[ ] The YouTube icon you added is pixelated (I've attached a bigger version of this for you)

[ ] On mobile the YouTube sits below the other icons, can you make them smaller so that they fit all onto one line

[ ] Can you add a line at the bottom of the footer than is centered that says ©Deckerdence 2020 | Terms & Conditions | Privacy Policy (then can you add the links for the terms and conditions and privacy policy pages here)

@dharmveer97 @iamkunall
just a quick note to say that I need the testimonial to pull onto the wedding, event, party and hospitality page (I am not able to edit one in Sanity, it would be better if it can pull one from the testimonials page) or if not happy for it to be set up so I can add one myself on Sanity, thanks guys

[ ] @dharmveer97
https://deckerdence.netlify.app/testimonials/ I added some more testimonials yesterday, they look great, but they just lose the row pattern as you go down - so they don't alternate grey and white - could you help me with this please?

[ ] @dharmveer97 On the contact page I need the bigger download image to be this one attached, I can't change it in sanity (the only difference is that it says 'Download brochure' instead of 'Download showcase'
I have managed to change all the others, thank you.

[ ] @dharmveer97 could you give me the PDF for the brochure download - I managed to get the 4 other downloads, just can't get this one.

[ ] @dharmveer97  only last thing is I need a testimonial to pull onto the wedding, parties, events, hospitality page - I can't edit it in Sanity


Fix index.astro small mistake

publishedAt property is contained within data property of post
Initially index.astro was accessing publishedAt property in post itself.

@all-contributors please add @SterbenVD for code

Nice catch! Thanks for your contribution :) @SterbenVD


create ExposureWidget as a core  widget + properly connect exposure signals

Adds two new core widgets:

A general exposure widget that takes any camera neame
an exposure widget that follows the current camera device (getCameraDevice) as closely as possible. Though not perfectly, see https://github.com/micro-manager/mmCoreAndDevices/issues/181

There's also a bugfix in here. Previously if you loaded a config before opening napari then the exposure widget would not fill with the correct value - now it does.

Test failure is unrelated: https://github.com/tlambert03/napari-micromanager/issues/153 so this is ready for review

can you rebase on main?

@tlambert03 or @fdrgsp if you get a chance to look at this sometime that'd be great - the exposure not prefilling has been driving me nuts


finetuning validator

Proposed changes:

closes #9335

Status (please check what you already did):

[x] added some tests for the functionality
[ ] updated the documentation
[ ] updated the changelog (please check changelog for instructions)
[x] reformat files using black (please check Readme for instructions)

@joejuzl  We need the actual NLU training data in this validator and we'll also need the loaded data in for the ConfigValidator (NLU data as well as story data, where the story data is needed to replicate the validations previously done in _ensemble.py). Which means we load the NLU data 3 times (2 x in validators, 1 x in provider) and story data 2 times.  Is it ok if I adapt this component such that it takes TrainingData as input? ... Or am I missing something? 🤔

@ka-bu
The CombinedDataImporter (which should always be in the importer chain) caches the methods such as get_nlu_data so it should be fine.


Discord verification

I need to disconnect from my the old discord and connect to the new one

Do you have access to your old Discord account?


Allow SREs to list pipelines and teams.

There may be security implications to adding this permission to SREs. Check some rendered pipelines as an admin somewhere before merging this.

This repo needs to have its PR approval count set to 2.

hmm:
$ gds sandbox kubectl get teams
No resources found.
$ gds sandbox kubectl get pipelines
No resources found.

There may be security implications to adding this permission to SREs. Check some rendered pipelines as an admin somewhere before merging this.

I had a look at gds sandbox kubectl get pipelines -A -o yaml | less and gds sandbox kubectl get teams -A -o yaml | less and I'm pretty confident that we're alright.  It's basically the same content that went in in the first place.

Any reason why this isn't being given to dev role too?

@blairboy362 any reason you haven't merged this yet?

@philandstuff I was waiting for someone to respond to @chrisfarms' question.

Any reason why this isn't being given to dev role too?

No reason. Doesn't need to be done as part of this PR, and could come in later if we're bothered a lot about this.


Confusing Instructions for React Challenge 2 => Build a Campers Leaderboard

Challenge Name
Build a Camper's Leaderboard

https://www.freecodecamp.org/challenges/build-a-camper-leaderboard
Issue Description

The description of this challenge is confusing:

The video provided shows older objectives.
The API shown in the video is also diff than the one provided in the objectives
It is also not clear whether we have to make an API call or we can just get the data using copy/paste.
The reason for providing two APIs are also not clear. Since it seems both provides the same data(maybe) or just the ordering is diff.
Or if one provides top 100 according to all time and other according to recent then, should we make an API call for sorting?
How the sorting is to be done is also not clear.

Screenshot

Hi thanks, for reporting. Yes this challenge has gotten stale with the old videos. We are doing away with this challenge and moving it to the Take home projects on our new curriculum
One of the team members (@Em-Ant) is migrating the same under our ownership to Glitch.
I understand that this is a required project on the Certification path on the production site.
@QuincyLarson can you please guide what are we planning to mitigate this on the current production?

Update: Here is the link on how its going to work going forth https://forum.freecodecamp.org/t/freecodecamps-new-certificates-heres-how-were-rolling-them-out/141618

To be moved in https://github.com/freeCodeCamp/freeCodeCamp/issues/16118

@rajatvijay Thanks for pointing this out. We are removing the videos completely on beta. So this inconsistency will cease to exist in a couple weeks when we ship beta.


chore(key): Rename Key to ApiKey

Coverage decreased (-0.3%) to 30.055% when pulling 91fafe374de8555b46f3a089cfd86a27a83254b4 on chore/rename_key_in_api_keys into d54af3d471848ebe138616b7b2f9884cb5637779 on master.


[ZEPPELIN-1519] Fix notebook importer AM/PM omission problem

What is this PR for?
When loading note from storage (or importing note), AM/PM informations are gone. So dates are always in AM.
Fix this problem.
What type of PR is it?
Bug Fix
Todos
What is the Jira issue?

https://issues.apache.org/jira/browse/ZEPPELIN-1519

How should this be tested?
Do some changes on sample notebooks, and see file changes.
Screenshots (if appropriate)
Questions:

Does the licenses files need update? NO
Is there breaking changes for older versions? NO
Does this needs documentation? NO

Thanks. LGTM and merge if there're no more discussions.


Blog app - setup and controllers

General requirements

Make sure that there are no linter errors.
Make sure that you used correct Gitflow.
Make sure that you documented your work in a professional way.

Ruby requirements

Follow our list of best practices for Ruby.

Project requirements

Make sure that the project has Postgres database set up.
Make sure that the app handles the URLs used in the wireframes.
For each URL there should be:

A route.
An action in the correct controller.
A view file.

Thanks a lot for the reviews @mmsesay @andersonlebon .


clear explanation of an Activity

as discussed with @cmaumet , @dbkeator and @satra on November 2nd
What do we mean by Activity ?
Currently the examples encapsulate everything related to the run : an activity is the call of an Agent on a specific set of entities, and includes parameters (as defined in a batch.m for example)
Perhaps we should rather separate user-oriented graph definition from a more complete description, which would contain Activities, and the full set of parameters

Don't know it that helps but there is an analogy with docker images VS containers
Containers are running instances of docker images
This binding is very simplistic yet  is emphasizes that activities can be containerized

@cmaumet does that comparison make sense ? If yes, should we write something about it ?
If not, do we still need to clarify what an activity is ? where ?

@remiadon - thanks for following up on this thread. I think the question about activity is also about the level of granularity at which we represent the pipeline. We touched on that in our submitted abstract but I think the usecases should also help build some clarity. I think we can close this issue.


Major Update

Selects now are not hardcoded!

We now call a function that returns the information we want.

Response now follows a standard!
// One Client
{
    "message":
    {
        "cod_cliente":"0000000000",
        "nif":"000000000",
        "nome":"Cliente Final"
    }
}

// Multiple Clients
{
    "message":
    [{
        "cod_cliente":"0000000000",
        "nif":"000000000",
        "nome":"Cliente Final"
    },
    {
        "cod_cliente":"0000000001",
        "nif":"000000001",
        "nome":"Cliente Final1"
    }]
}

General Fixes

Fixed wrong README.md.
Renamed wrong files that were changed when the imports of them changed.

Está passado. Bom trabalho.
Valeu Breno
Beijocas
On Wed, Dec 11, 2019, 23:41 Breno Salles<EMAIL_ADDRESS>wrote:

Selects now are not hardcoded!

We now call a function that returns the information we want.

Response now follows a standard!
// One Client
{
"message":
{
"cod_cliente":"0000000000",
"nif":"000000000",
"nome":"Cliente Final"
}
}
// Multiple Clients
{
"message":
[{
"cod_cliente":"0000000000",
"nif":"000000000",
"nome":"Cliente Final"
},
{
"cod_cliente":"0000000001",
"nif":"000000001",
"nome":"Cliente Final1"
}]
}
General Fixes

Fixed wrong README.md.
Renamed wrong files that were changed when the imports of them
changed.

You can view, comment on, or merge this pull request online at:
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17
Commit Summary

Improved JSON response object
Updated README.md
Merge branch 'master' of
https://github.com/Cepos-e-Mabecos/bd2-group2
Fixed missing function

File Changes

M README.md
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-0
(2)
M api/alergias.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-1
(10)
M api/app.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-2
(18)
M api/clientes.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-3
(13)
M api/consumos.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-4
(4)
A api/databaseutils.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-5
(5)
M api/datasementa.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-6
(10)
M api/ementas.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-7
(4)
M api/funcionarios.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-8
(4)
M api/itens.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-9
(4)
M api/locais.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-10
(10)
M api/locaisconsumo.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-11
(16)
M api/restaurantes.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-12
(4)
M api/tiposementa.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-13
(22)
M api/tipositens.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-14
(22)
M api/tiposrefeicao.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-15
(22)
M database/e_select.sql
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-16
(6)
M database/g_trigger.sql
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-17
(12)
M docker-compose.yml
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-18
(2)
M web/index.php
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-19
(2)

Patch Links:

https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17.patch
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17.diff

—
You are receiving this because your review was requested.
Reply to this email directly, view it on GitHub
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17?email_source=notifications&email_token=AJL5ZAGNQBU763EQLXS4OVDQYF3BVA5CNFSM4JZWYASKYY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4H75AEAA,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AJL5ZAAQ6YEDQJWTN2VDZADQYF3BVANCNFSM4JZWYASA
.

On Wed, Dec 11, 2019, 23:41 Breno Salles<EMAIL_ADDRESS>wrote:

Selects now are not hardcoded!

We now call a function that returns the information we want.

Response now follows a standard!
// One Client
{
"message":
{
"cod_cliente":"0000000000",
"nif":"000000000",
"nome":"Cliente Final"
}
}
// Multiple Clients
{
"message":
[{
"cod_cliente":"0000000000",
"nif":"000000000",
"nome":"Cliente Final"
},
{
"cod_cliente":"0000000001",
"nif":"000000001",
"nome":"Cliente Final1"
}]
}
General Fixes

Fixed wrong README.md.
Renamed wrong files that were changed when the imports of them
changed.

You can view, comment on, or merge this pull request online at:
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17
Commit Summary

Improved JSON response object
Updated README.md
Merge branch 'master' of
https://github.com/Cepos-e-Mabecos/bd2-group2
Fixed missing function

File Changes

M README.md
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-0
(2)
M api/alergias.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-1
(10)
M api/app.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-2
(18)
M api/clientes.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-3
(13)
M api/consumos.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-4
(4)
A api/databaseutils.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-5
(5)
M api/datasementa.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-6
(10)
M api/ementas.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-7
(4)
M api/funcionarios.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-8
(4)
M api/itens.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-9
(4)
M api/locais.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-10
(10)
M api/locaisconsumo.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-11
(16)
M api/restaurantes.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-12
(4)
M api/tiposementa.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-13
(22)
M api/tipositens.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-14
(22)
M api/tiposrefeicao.py
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-15
(22)
M database/e_select.sql
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-16
(6)
M database/g_trigger.sql
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-17
(12)
M docker-compose.yml
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-18
(2)
M web/index.php
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17/files#diff-19
(2)

Patch Links:

https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17.patch
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17.diff

—
You are receiving this because your review was requested.
Reply to this email directly, view it on GitHub
https://github.com/Cepos-e-Mabecos/bd2-group2/pull/17?email_source=notifications&email_token=AJL5ZAGNQBU763EQLXS4OVDQYF3BVA5CNFSM4JZWYASKYY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4H75AEAA,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AJL5ZAAQ6YEDQJWTN2VDZADQYF3BVANCNFSM4JZWYASA
.

Please, be careful with what you comment. I expect tomorrow morning a better review and an even better comment.
Have a good night.


Name change to angular-safeguard

angular2-locker -> angular-safeguard
I just wanted to post an issue regarding the changing the name of this library. It is officially unadvised to use angular2 in the name of packages and when it moves to angular3/4 it will become confusing. As angular-locker is already existing and for angular1 I have decided to rename to angular-safeguard!

Now it makes sense on the name change.  Do you have a plan for rollout/upgrade?

I'm going to deprecate the other package and point to this one


Add other domains owned by admiral?

Many other domains were found that are owned by Admiral and point to the same IP as #1. There's a list at https://pgl.yoyo.org/adservers/admiral-domains.txt

Thanks for this! I'll have a look when I'm at a computer
On Aug 12, 2017 11:55 AM, "KeenRivals"<EMAIL_ADDRESS>wrote:

Many other domains were found that are owned by Admiral and point to the
same IP as #1 https://github.com/paulgb/BarbBlock/issues/1. There's a
list at https://pgl.yoyo.org/adservers/admiral-domains.txt
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/paulgb/BarbBlock/issues/4, or mute the thread
https://github.com/notifications/unsubscribe-auth/AAC0XRsMHcj3UPhAvHkJToJddeujsbYlks5sXcr6gaJpZM4O1cvW
.

That list is woefully incomplete. See my comment here for some analysis.
Sample admiral domains not in that list:
btez8.xyz
innocentwax.com
completecabbage.com
4jnzhl0d0.com
h78xb.pw

Let's kill the whole Admiral thing with fire!

I've merged #8 which adds more Admiral domains, if there are still some missing I'm happy to add them as they are discovered

I support adding all domains pointing to the same content - it's likely all these domains would eventually have found their way into EasyList in the first place. Might be less likely now.

Maybe block that IP too in anticipation of more domains being added?

#8 is still not even close.
It has...

Some but not all - e.g. breezybath.com - of the domains currently on <IP_ADDRESS> (the same ip that unknowntray.com is served from)
Some but not all - e.g. axiomaticalley.com - of the domains currently at <IP_ADDRESS>
Some but not all - e.g. btez8.xyz - of domains currently at <IP_ADDRESS>

It's missing...

owlsr.us and 65+ other domains that have been or are currently on <IP_ADDRESS>
roastedvoice.com and 64 friends from <IP_ADDRESS>
17ars.xyz and past domains hosted by <IP_ADDRESS> but not photos.hollywood.com that's there now
lewdwind.com and 20+ domains formerly at <IP_ADDRESS>
spottysense.com and many formerly at <IP_ADDRESS>
and more
and more
and 30 more
and commoncannon.com and a dozen more
and more
and chickenstation.com and 100 others
and these
and those
and frailoffer.com and friends
and granodiorite.com and others
and 43 more except there's an innocent one too

...  I think that demonstrates my point.  Someone else want to take a turn?
You just have to walk the related domains on a tool (like threatcrowd) that lets you do so easily.
It's trivial to verify these even when you're learning the naming patterns, since they all serve up the same image
Some starting points that I haven't already exhausted above include...
tzwaw.pw
0D7DK.XYZ
pz37t.xyz
3jsbf5.xyz - beware, there's at least one domain (apstylebook.com) that'd be a false positive.
The biggest problem is that they use google/amazon hosting and so you can't trivially blacklist everything that resolves into their IP space.

@tofof Given the ones that I have seen seem to use valid SSL certs from Let's Encrypt, do you think crawling the CT logs is a viable way of checking for these?

What about doing it the other way around? As you said, it's trivial to verify a domain. What about checking all suspicious domains? If one is found, it's sent to some central server to be added to the list. Another way would be to just blacklist the IPs. This would have some false positives, but if it becomes a default filter for ublock/adblock it would have the effect of forcing them to clean up their IP ranges. But really, how often do you have a legitimate reason for loading random .js from a .xyz domain?
@lol768
They issue hundreds of thousands of certificates each day, but if you manage to get the first filtering down it's feasible, then you can use DNS to filter out more.
@mvasilkov
I don't think that's feasible. Maybe by sending abuse notices to the registrars, since they care more about quantity than quality.

Also, playing cat-and-mouse with domains is not really a problem. It costs at least $1 to register one, and much less to find and block it.

Reading @tofof I realize that indeed the BarbBlock, if it has the merit to exist, does not include and may never include should it be but a far more exhaustive list, for the sole reason that such a list seems to be a challenge.
Computing-fiction: what would be fantastic would be to have the ability to define a checksum of the famous landing-picture and block connections on that criteria (provided the image doesn't change a pixel here and there). Otherwise, how on earth can a list be conceived otherwise than with try-and-succeed/try-and-fail policy? It's just impossible. We are facing networks as dirty as bots.

Actually, @lol786's suggestion sounds like a great idea for keeping track of new registrations from this company. It could be automated as a nightly script.

Given the ones that I have seen seem to use valid SSL certs from Let's Encrypt

"Seem" ... if the result is equivalent to cutting a hand because of a whitlow, I'd be more than cautius with that very way of proceeding.

That's just a way of narrowing down the search space; we'd still verify that the domain behaved like the others.
I'd like to keep this to a pure domain blacklist, as opposed to running code on the client, for a few reasons: 1. it's more portable to existing blocking extensions, 2. it's more performant, and 3. I'm more comfortable with the legal defensibility (I am confident that a passive blacklist can never be illegal; I don't want to speculate about the legality of a more active client-side approach)

Well, @paulgb you have the merit of having built and a centralized list (even if improvable), a place to discuss it and moreover an open-mind to carry on and develop the list. I do congratulate you for this initiative and for your work. I stay tuned of course and at this time and in order to avoid a chaotic result I stick on your list updated with all others included in my uBlock Origin settings, once a day.
let's keep on doing it!

@zymase
You can just check the image dimensions, or the length of the body. This works for me:
def isAdmiralDomain(domain):     try:         response = requests.get('https://' + domain)     except:         return False     if len(response.text) == 179:         return True     else: 	return False

Otherwise, how on earth can a list be conceived otherwise than with try-and-succeed/try-and-fail policy? It's just impossible. We are facing networks as dirty as bots.

Start of with the LE cert list. Filter away anything that doesn't end with .com, .xyz, or .pw. Issue DNS queries for everything. If the whois isn't protected, remove it. If they're not using whatever registrars they're using, remove it. Then use tor/proxies (it's kind of counter productive for them to block IPs) for the final verification.
Why not literally treat them as bots? I don't have any, but SMTP accounts are allegedly quite cheap. What if you'd just send bulk abuse notices to the registrars and accuse them of being C2 servers for some botnet? They generally don't care if the notices are valid, they only care about the quantity of notices they're getting.
@paulgb

That's just a way of narrowing down the search space; we'd still verify that the domain behaved like the others.
And this job can be automated easily, as long as the domain can be identified once you can put it in the list forever.

GitHub stripped away the formatting, so you need to add some newlines and indentation.
The images are identical right now.
CRC32: 8db019c1
MD5: 681e062bb33b9ba28f3427e7283c81a8
SHA1: 3fcf7e14e92043a00926d340d45778b618bc87a9
SHA2: 32afacb9285649aa4af43ea03e7cd9a522aa3e6d0554a2dabe308fac4531be5f

@anon182739 your first steps may be valuable for coders of which I am not unfortunately. I try to embrace the problematic conceptually but I'd be unable to translate an idea, a solution into code. At my little level a target is defined with a domain name and/or an IP but here we have hundreds, maybe thousands of domains all calling a same goddam static picture with a dynamic name. This is one scenario where I'd really love to be smarter and able to code.  Maybe are you on the right path, I don't know.

Another identifying mark is the robots.txt, which is unlikely to change:
User-agent: * Disallow: /
The 404 page seems nonstandard:
404 page not found
(it's not HTML)
Content-Type:"text/plain; charset=utf-8"
The registrar is enom for the .com domains and namecheap for the .xyz and .pw domains.
They all use the same 4 nameservers. You should be able to enumerate from that, it's an uncommon combination.
NS-1212.AWSDNS-23.ORG
<IP_ADDRESS>
NS-1627.AWSDNS-11.CO.UK
<IP_ADDRESS>
NS-305.AWSDNS-38.COM
<IP_ADDRESS>
NS-697.AWSDNS-23.NET
<IP_ADDRESS>

@zymase
You want to block the domain names. You can get a new IP for almost nothing, getting a new domain name costs some money. The picture's name changes, but the site's structure is the same.

Also worth noting is that you can query however many admiral domains you want with Tor. If they start blocking IPs, then their ads won't work anymore.

@anon182739 ,

You want to block the domain names. You can get a new IP for almost nothing, getting a new domain name costs some money. The picture's name changes, but the site's structure is the same.

That's not what I meant. Point is as everyone I can block domains, IPs, IP ranges but I don't understand -- coder or not -- what reference to consider in this scenario. It's not because I cannot understand that it means its not understandable of course. There's nothing but a picture, we all know it and I've repeated it at least a dozen times, and besides your picture size checking and the nameserver approach, where, what to "hold", see what I mean? But I'll stop laying the obvious, doesn't help.
The point is and remains that an unknown number of domains, when called, resolve to one picture, as if a sonar detected hundreds of echoes all pointing to a wreck 30,000 feet below sea level. Above my understanding.

@zymase
I don't understand what you're trying to say. You can look at a domain and see if it has that picture. If it does, it also has the script we want to block.
The domains don't resolve to the picture. The domains resolve to Google IPs, which then serve that picture. The domains all point to different IPs.
The purpose is to block the script they use, the easiest way to do this is to block the Admiral domains so they can't serve the script.

anon182739 wrote:

Filter away anything that doesn't end with .com, .xyz, or .pw.

I wouldn't use such a filter. First of all, Admiral has at least one .us domain that I've already prominently mentioned in this thread; it's literally the first domain I name as 'missing'. Second, there's no reason to think they won't expand to other TLDs. Nine months ago, noone had spotted any .xyz Admiral domains - I doubt they were using them yet.

@anon182739 the problem is not to know if a domain links to the picture, the problem is to now on what criteria build a list. we're not going yo analyze the whole web domain after domain to see the ones which point to that picture, right? So on what basis will the list be built other than adding the finds of participants : we're not in a hunt or a tombola, right? So on what criteria will this list be built? It's not like phoning "Hey, I found another one" ... there must be a common point to all domains pointing to that picture, or is there?

@zymase
You've stated that you don't understand and are not a coder. It's acceptable to be interested, to use the emoji-response features, etc, but please don't clutter a single-issue thread with philosophical meanderings, well-wishings, tortuous analogies, and otherwise "laying the obvious," whatever that means.
To address your final point:
No, there is no reason to think that there must be a common resource, accessible to the public, that would identify all such domains.
If instead you mean that there must be a reason for these domains? Yes, the reason is that Admiral owns them and happens, for now, to serve the same content from all of them. They could just as easily serve nothing but a 403 or 204 error code, or just blackhole connections.
The list's criteria are already stated: it is a list of domains who have misused DMCA takedowns to attempt removal from other lists. This issue is suggesting that affiliated domains that are owned by the same company and used for the same purpose be included alongside the singular example named on a DMCA takedown thus far. The criteria for inclusion that's being proposed, then, is similarly obvious: Admiral-owned domains that appear to serve the same (lack of) content and presumably host the scripts used in serving advertising at affiliated websites.
Quite contrary to your assertion, such a list, if built, will be built exactly the same way all other advertising-blocking lists are built: on the finds of participants reporting "I found another one".  The starting points are found when an Admiral-protected website (e.g. thewindowsclub.com) uses scripts hosted on an Admiral server to display its contents.
I have already outlined the best possible way to find more Admiral domains given a starting domain: by using tools meant for that, i.e. tools that identify spatially- and temporally-related domains.

@tofof Thanks for the analysis you've been doing, I have only been skimming this conversation while working on providing all the blacklist formats people want but now that that's done I want to take a real stab at automating some of this.

@zymase

We're not going to quest the whole web, domain after domain to see the ones which point to that picture, right?
You can narrow it down enough so you don't need to check the entire web.
@tofof
What's wrong with scraping DNS/cert lists? They can easily make sure that 1 domain = 1 ip and avoid tainting each other, it's non-trivial to make it harder to verify the domains.
@paulgb
I'm already working on it, I've managed to hack together a python script that does the job. Should I post it here, or is 'security by obscurity' better?

@zymase

We're not going to quest the whole web, domain after domain to see the ones which point to that picture, right?

You can narrow it down enough so you don't need to check the entire web.
@tofof
What's wrong with scraping DNS/cert lists? They can easily make sure that 1 domain = 1 ip and avoid tainting each other, it's non-trivial to make it harder to verify the domains.
@paulgb
I'm already working on it, I've managed to hack together a python script that does the job. Should I post it here, or is 'security by obscurity' better?
It turns out they only have 159 domains apparently, all the "different starting points" were somehow interlinked.
https://pastebin.com/6mPnXBiR

Great stuff, is this from the CT log or just from grabbing the IPs already found?
Let's keep the script apart from this, but if you're not a paying GitHub user I can create a private repo and add you to it so we can collaborate.

This naming scheme is interesting.
If you visit any admiral domain (example: http://abandonedclover.com http://abruptroad.com) you get that image:
http://abandonedclover.com/6f044848f5e9030b6fd409a7e153defd6d8c4e58fb082a44da549ed3e421f9755aedb08132895be1e0d578e7
But each time you refresh the page, you get a new URL:
http://abandonedclover.com/f1e5b5d86bcceb851312e5cc5f7bce26bb10ab951c152cb63a5068954caaa20d196ab3a042d306f561b71c22
You can use it multiple times, and across different domains. I really wonder how this works? Is it a signature of some sort?
@paulgb
This is from scraping one domain (hfc195b.com) and recursively querying the results from threatcrowd. It seems to cover all of the "starting points" listed though, except for 0d7dk.xyz pz37t.xyz 3jsbf5.xyz that weren't reachable. So this should be all of their domains.
Sure, or I can send it in a PM if you want. It's not of much use now though.

Sure, a PM works for me. My email is<EMAIL_ADDRESS>Cheers.

Oh, you can't send GitHub PMs anymore apparently.
Gmail filters any anonymous e-mail addresses since they're used for spam. If you already have github premium, it's probably easier to do it that way.

Ok, I created a repo.

I can't see anything. Where do I get the notice?

Try this link: https://github.com/paulgb/iptool/invitations

Thanks, it works now.

There might be a point to running it without Tor, it's a bit finicky and seems to give some false negatives. This could be intentional, but I don't think so since I could get them with Tor on a second try. Some IPs gave really many domains, one or two were probably responsible for 70% of the domains.

Interesting, shodan gives me IPs that don't have any domain names registered according to threatcrowd
https://pastebin.com/w3HZ4Ker
query: "X-Datacenter: Content-Length: 179 Date: Mon 2017"
Replace Mon by any other week day, it's just to split it up so it doesn't get past 2 pages which is the free account limit, you can also add month if you don't want to create account

It turns out they only have 159 domains apparently, all the "different starting points" were somehow interlinked.
https://pastebin.com/6mPnXBiR

FFS.
No, that list is incomplete.
It doesn't "turn-out" that it's done already. It turns out that people are willing to pass off trivially incomplete lists with claims of completeness that will be vacuously repeated to the detriment of any effort to build such a list.
It's missing tons of the ones I already pointed out.  It includes false positives, too, like its literal first lines, which are google and not Admiral domains. And it has double entries.
It is barely any different than the list already attached to this repository.
It's missing, at minimum:

owlsr.us, al102.xyz, 3jsbf5.xyz, and all the others that I already pointed out from the very first line of my earlier missing list.

It's missing roastedvoice.com, and presumably the others I already pointed out from the SECOND line of my missing list.

It's missing 17ars.xyz, and presumably the others I pointed out on the THIRD line of my earlier list.

lewdwind.com and presumably the others I pointed out on the FOURTH line of my earlier list.

b6227.xyz and presumably many others from the SIXTH line of my earlier list.

granodiorite.com and presumably many others from that line.

0D7DK.XYZ and others from that starting point.

pz37t.xyz and others from that starting point.

3jsbf5.xyz and others from that starting point.

And that's just the ones I explicitly named as examples already of what was missing before.
I am very tired of people posting short lists and saying "work's done, this is all of them!" I especially can't wait until these singular examples get added without adding any of the others from all the links I already provided, much less any from anyone else making even the slightest attempt.

@anon182739

What's wrong with scraping DNS/cert lists? They can easily make sure that 1 domain = 1 ip and avoid tainting each other, it's non-trivial to make it harder to verify the domains.

I never said a single thing against scraping cert lists, please take your fallacious statements elsewhere.
It is in fact trivial to make it harder to verify these domains, and I have already provided an example of two ways they could to do it in this very thread. Again, please peddle falsehoods elsewhere.

@tofof
Rude.
owlsr.us
Honest mistake, it probably timed out because it IS in there, it was just marked as "not admiral" because the request timed out or something similar. Tor is somewhat finicky, but if you have a cleaner IP you can re-run the script (ask @paulgb to add you)

al102.xyz, 3jsbf5.xyz
dead

roastedvoice.com

This Domain Name Has Expired - Renewal Instructions.

17ars.xyz
dead
lewdwind.com

This Domain Name Has Expired - Renewal Instructions.

b6227.xyz
dead
granodiorite.com

This Domain Name Has Expired - Renewal Instructions.

0d7dk.xyz
dead
pz37t.xyz
dead
3jsbf5.xyz
dead
Worth noting is that a fair amount of the ones marked as dead were checked, but marked as not-admiral because they were, well, dead.

It includes false positives, too, like its literal first lines, which are google and not Admiral domains.

They are admiral domains. They serve the Admiral malware and act as C2 server for the botnet. How are they not admiral domains?

And it has double entries.

Caused by differences in case, it can be resolved by adding a line in the script.

Checking who.is history (make sure to disable JS otherwise it fetches it again), you can see that the dead domains have expired. Except 17ars.xyz apparently, unless someone else registered it.
Isn't it a security risk to be loading random JS from domains that they're not taking very good care of? They're not attaching a hash from what I can see.

Except 17ars.xyz apparently

Name
REACTIVATION PERIOD
Organization
NAMECHEAP
Address
11400 W. OLYMPIC BLVD, SUITE 200
Well, that explains that.

@anon182739
My apologies. First, thank you for your work. Please forgive my outburst; literally the very first example I provided (one I know is live and is Admiral) was omitted. That, with the immediate appearance of so many more omissions, caused me to overstate things.
Given that you've verified that your tool has timed out on at least one positively-Admiral domain, can I ask what assurance you have that others that I haven't manually called out didn't get similarly classified?

I never said a single thing against scraping cert lists, please take your fallacious statements elsewhere.

I'm sorry, I missed your reply on it. But what are your thoughts on it? You could dynamically add domains to the filter, so whenever a .us domain is spotted you add it to the filter. It would still be useful to narrow things down.

It is in fact trivial to make it harder to verify these domains,

Harder? Yes. Hard? No. I used the wrong word there.

and I have already provided an example of two ways they could to do it in this very thread.

I missed them. But it's hard to obfuscate it indeterministically, they will still have some kind of recognizable pattern. It's enough to find the pattern once, then that domain's useless forever and you've costed them $1.

@anon182739
I think that the idea of scraping cert lists is potentially clever. I see a few potential hurdles, however.

Sheer volume of certs per day is large. Filters might help, but I think they're more likely to be more trouble than they're worth - if you fail to include e.g. .us and then at some future point find Admiral domains with that TLD, now you have to .. what, go back through the cert logs to some starting point and rescrape a whole set of domains you'd filtered before? Doesn't seem like filtering is a meaningful reduction in workload at that point.
If the domain purchase and the cert application happen concurrently, before DNS has populated, does a verification script risk hitting the domain before it's "live" and miscategorizing it as non-Admiral?

The ways to make things harder I'm referring to: at any point, Admiral can just blackhole incoming traffic* or serve up http status codes instead of the helpful image saying "Hi I'm Admiral". Particularly when they can put their scripts behind completely random filenames.
*incoming traffic other than to their randomly-named-at-creation script, of course
At some point they have to actually use their servers, and we can see references to the scripts "in the wild" on other pages, and catch them that way. But that's the super-slow super-manual way of doing it.
Fundamentally I don't think I agree with your assertion that there has to be a pattern that's externally recognizable. It's very beneficial to us right now that there is, but I don't think that has to be the case at all.
I do, however, wholeheartedly agree that going after domains is worthwhile. It definitely costs less for us to hunt them than it does for them to buy them, at least in the current balance.

@tofof
None, except that Tor isn't that finicky. If you have a more reliable internet connection you can run the script. Security through obscurity is probably useless, it was just an instinctive reaction, https://pastebin.com/tsBH5s7A

For the unaware: Admiral tracks hits to their domains and blocks you if you have too many in too short a period, presumably to defeat exactly this sort of listbuilding.

Are you sure? I don't think that happened, but it's possible the API timeout saved me from it. In any case, you can use Tor stream isolation for each requests. If they block Tor, that's just a net win since it means some people get "free" adblocking and proxies are plentiful anyway.
Do you have any other information/documentation like this about admiral?

Regarding those googleusercontent.com lines - Yes, they serve up Admiral content right now, but that's just because Admiral is hosting on Google Cloud platforms. I maintain that they're false positives, at least until their use in the wild can be verified.
 I make that claim from my experiences trying to pin down their bootstrapper 6 months ago, when that definitely was the case, and I was getting served explicit error messages stating that I was being deliberately blocked. It's possible that you have to be hitting the script file or something other than the landing image to trigger that, though.

Sheer volume of certs per day is large.
I checked. It was large, but not very large. 100k-200k a day, this is about 2 per second. Certainly manageable.
Filters might help, but I think they're more likely to be more trouble than they're worth - if you fail to include e.g. .us and then at some future point find Admiral domains with that TLD, now you have to .. what, go back through the cert logs to some starting point and rescrape a whole set of domains you'd filtered before? Doesn't seem like filtering is a meaningful reduction in workload at that point.

You only have to go back and re-check the ones with .us domains. You can check the registration date of the first ones spotted in the wild and go back from there.

If the domain purchase and the cert application happen concurrently, before DNS has populated, does a verification script risk hitting the domain before it's "live" and miscategorizing it as non-Admiral?

You need to have a valid DNS entry for Let's Encrypt, it's all automated.

The ways to make things harder I'm referring to: at any point, Admiral can just blackhole incoming traffic*

They still have to receive the HTTP request, so they can't blackhole it entirely - they still need to send some TCP packets to be able to listen.

or serve up http status codes

And then those will be identifiable, like they are now. Or they'll all be random which will also look strange - why would an nginx server send an apache 404?

Particularly when they can put their scripts behind completely random filenames.

The filenames are valid for all domains right now.
As said before, they only need to have a detectable signature once to be blocked.

we can see references to the scripts "in the wild" on other pages, and catch them that way. But that's the super-slow super-manual way of doing it

That can be automated too. Compile a list of sites that use admiral, see what domains they link to. Admiral is free of charge to use, and you can use e.g. shodan if you ever find a pattern for the bootstrapper to find domains using it.

Admiral can just blackhole incoming traffic* or serve up http status codes instead of the helpful image saying "Hi I'm Admiral".

I'm not so sure about this. When a domain registrar receives an abuse notice for a randomly generated .xyz domain registered with whoisguard that only serves randomly named obfuscated JS files, what will they think?

I maintain that they're false positives, at least until their use in the wild can be verified.

They're only serving admiral content though. I maintain that they're valid admiral domains, since they're functioning exactly like admiral domains besides for being unused.

I was getting served explicit error messages stating that I was being deliberately blocked

Did this block you from getting the actual scripts too? How long did it last for? Would it be possible to block all tor exit nodes/similar?

Also, the robots.txt will still be identifiable unless they want to get revealed by internet archive.

The filenames are valid for all domains right now.
That's interesting, I missed that earlier.

Did this block you from getting the actual scripts too? How long did it last for? Would it be possible to block all tor exit nodes/similar?
Yes, I distinctly remember that it blocked me from getting the scripts. I also remember it unsurprisingly caused some sort of failure to be able to load Admiral-protected content on affiliated sites. The first one lasted fewer than 10 minutes, another lasted at least 2 hours. No, I doubt it would have had any effect against traffic routed through (different) Tor exit nodes - my recollection is that it was a simple "we've timed you out" sort of error page and didn't seem very sophisticated.

@anon182739

Also, the robots.txt will still be identifiable unless they want to get revealed by internet archive.

How so? A simple block-everything robots.txt is hardly unique to Admiral.

The first one lasted fewer than 10 minutes, another lasted at least 2 hours.

So in other words, it increases on subsequent violations.

I also remember it unsurprisingly caused some sort of failure to be able to load Admiral-protected content on affiliated sites.

How does that work? If you block the servers, won't that have the same effect?

No, I doubt it would have had any effect against traffic routed through (different) Tor exit nodes

You're misunderstanding me. What if you run a script to make sure all Tor exit nodes and open proxies get blacklisted on purpose? It will decrease the appeal of Admiral if webmasters know that anyone using  a proxy/VPN can't read their site.
I tried to get banned by force refreshing the page some hundred of times, how many requests did you do?

How so? A simple block-everything robots.txt is hardly unique to Admiral.

It's uncommon, so it helps filtering. How common is blackhole+namecheap+whoisguard+robots+lets encrypt?

                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:--  0:00:17 --:--:--     0curl: (52) Empty reply from server
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
Are they already blacklisting, or is it just Tor?

It's uncommon, so it helps filtering. How common is blackhole+namecheap+whoisguard+robots+lets encrypt?
Ok, fair enough, as part of the rest of the pattern it's helpful.

I tried to get banned by force refreshing the page some hundred of times, how many requests did you do?
I got it within a few dozen refreshes of the script at the time, probably within a 15-minute interval or so. Certainly nowhere near 100.

How does that work? If you block the servers, won't that have the same effect?
Yes, it does. If you outright blocked the Admiral servers, some Admiral-protected sites didn't serve any content; others still did. It depended on the bootstrapper that was used.

I got it within a few dozen refreshes of the script at the time, probably within a 15-minute interval or so. Certainly nowhere near 100.

Wild guess: they were banning VPN exit nodes left and right and decided to stop it

If you outright blocked the Admiral servers, some Admiral-protected sites didn't serve any content; others still did. It depended on the bootstrapper that was used. If you outright blocked the Admiral servers, some Admiral-protected sites didn't serve any content; others still did. It depended on the bootstrapper that was used.

How many different bootstrapper scripts are there? What did you find out about them? What's the point in blocking the servers if that just kills the site too?

How many different bootstrapper scripts are there?

I have no idea. I know Admiral offers several different tiers/configurations of services, perhaps they're related to those, but that's just speculation.

What did you find out about them?

Nothing helpful that I can recall; the few notes I took during the poking I was doing mostly have to do with killing the inline script after it was loaded, rather than the bootstraper.

What's the point in blocking the servers if that just kills the site too?

That's what caused me to quit working on this at the time.

How do they inject the ads again? Could you just block the re-injected images or similar?

I don't think Admiral directly injects ads except when it's configured to serve `less-intrusive' ones to replace the ads that it's protecting. All of my efforts were toward the script that takes over and blanks the page when it detects an adblocker.
I'd like to show you an example, but right now I'm actually having trouble getting Admiral to function, i.e. to actually annoy me with a popup and blank the screen. I have a feeling there's a hack somewhere I'm forgetting to disable.

The scripts have some kind of optimization layer, do you know what it is? Pagespeed supposedly only removes whitespace and the usual, but it's a pagespeed URL.
https://js.intercomcdn.com/frame.3db8f7f5.js
!function(e){function t(r){if(n[r])return n[r].exports;var o=n[r]={exports:{},id:r,loaded:!1};return e[r].call(o.exports,o,o.exports,t),o.loaded=!0,o.exports}var n={};return t.m=e,t.c=n,t.p="https://js.intercomcdn.com/",t(0)}(function(e){
https://js.intercomcdn.com/shim.cada1405.js
!function(n){function t(o){if(e[o])return e[o].exports;var r=e[o]={exports:{},id:o,loaded:!1};return n[o].call(r.exports,r,r.exports,t),r.loaded=!0,r.exports}var e={};return t.m=n,t.c=e,t.p="https://js.intercomcdn.com/",t(0)}({0:function(n,t,e){
They begin in the same way.

No, I don't know what it is, but working on reversing minified code is honestly way out of my specialty.

https://wordpress.org/plugins/admiral-adblock-suite/
public static function doesURIContainRandomFilename($uri, $seeds)
Does what it says on the tin if you're interested.

It also has other interesting stuff, gives away some information about how it's structured internally. owlsr.us is used as gateway, it might have been specially registered for that purpose.

Wordpress Plugin
Easy install. No JS code required. Proxy requests to minimize risk of adblocker intervention.

Custom Integration
Proxy Requests through your own domain to minimize risk of adblocker intervention.

Also, there are lots of API endpoints we can use to identify domains.
http://staging.owlsr.us/js?p=asd
http://owlsr.us/record

@anon182739: thanks again for your script, it's very helpful. I've been playing with it for a bit now, and I notice a couple things.
Obvious statement: unfortunately, your script is limited by the threatcrowd data.
Less-obvious: there are domains that are Admiral that threatcrowd completely lacks.
For example:
https://otx.alienvault.com/indicator/hostname/2znp09oa.com shows profitrumor.com among the related domains, which is an Admiral domain.
But unfortunately, threatcrowd's picture of that is a big zilch:

Yes, it's a shame. What services are there to get all domains with a given nameserver? Because they all share the same 4 nameservers.

https://otx.alienvault.com/otxapi/indicator/hostname/whois/2znp09oa.com Here, just parse this JSON and use as starting domains for the script, it doesn't matter that they're not in threatcrowd. (1 domain per line, no http before)

Yeah, just was looking at that myself, looks like it's possible to at least walk that api's space as well.

@tofof No need for walking, since you can do queries on DNS name servers.
grep -P '"domain": "[^"]+' --only-matching | cut -c 12-

https://pastebin.com/CYvL1GyJ
20 more

I strongly believe these ones are the only ones that are active in the wild:
https://pastebin.com/Bu2gFH9J
I ran script that created 600 accounts and got the script URLs, these are the only ones in the list. The least common one (jadeitite.com) is present 8 times, the most common one (82o9v830.com) is present 20 times.

On thing on the topic of unminifying code, etc.: In order for this project to be bulletproof should it end up in court, I can't include any links obtained that way. Since a judge is unlikely to be technically adept enough to understand nuance in this area, I'd rather keep a good distance from anything that could be made to sound like reverse engineering to someone non-technical.
The network-based approaches are defensible though, so as long as we stick to that route we'll be fine.

Clean room reverse engineering is legal. So by analogy, you should be able to share domains you got from observing the script's behavior, but not by reverse engineering them.
If you're worried about the legal aspects, keep in mind that the CFAA is very broad. Bulk registering accounts could be illegal in theory, depending on the definition of "authorization".
(a) Whoever—
(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—
(C) information from any protected computer;

It's not just the CFAA that I want to steer clear from, it's also DMCA 1201 which was the basis of Admiral's takedown against EasyList.
In general I guess my stance is: given that there are many ways of obtaining the list, we should do it in the way that is least likely to be misunderstood by a judge.

Are you worried about takedowns or legal responsibility?
If the former, use a git provider based outside of the US (bitbucket is australian, launchpad is british, osdn is japanese, ow2 consortium is french, self-hosted gitlab onion is in the jurisdiction of anonymous proxy)
If the latter, use a throwaway account and Tor

But that misses the goal of the project entirely! I'm not trying to evade any laws, quite the opposite. I'm trying to show that Admiral's interpretation of the law is incorrect, that it wouldn't hold up in court, and that they know that.

If you're not violating any laws, avoiding takedowns is just a convenience thing. DMCA takedown notices are for copyright infringement, circumvention of technical protections as defined in 17 USC § 1201 isn't copyright infringement.

I agree with @paulgb that Admiral's interpretation of the DMCA - that an item in a list constitutes a 'copyright circumvention mechanism' - is incorrect, and should be challenged. I understood that to be the primary reason for the creation of this project: to invite, challenge, and disprove this legal theory.
Expanding the list to include related Admiral domains that appear to function identically to the DMCA-takedown'd one seems in line with that goal.  Particularly for a list created by crawling publically accessible networks and observing the content that Admiral willingly serves up (its landing page image).

I agree with that interpretation @anon182739 but Admiral's stance is that it does and that's how we got here.
@tofof exactly

On the topic of reversing minified code - as far as I understand, none of that has been done in generating any of the list to this point. The list and addendum that @anon182739 has linked to is built from walking the recorded observations on threatcrowd - starting from a known Admiral domain, examining what IPs it was hosted on and what other domains were hosted on those IPs, and recursing, then examining for each domain its current public home page to see if it identifies itself as part of the Admiral protection scheme.
Note that the content that Admiral domains serves explicitly covers such a use: "if you arrived here on accident and are not looking for information about this domain, feel free to hit back in your browser or close the tab." In other words, when we purposefully visit the domain and are exactly looking for information about it, that image is meant to be our answer. It spells out what type of content ("Javascript, HTML, CSS, video and images") is served and for what nominal purpose ("to control access to copyrighted content ... and understand how visitors are accessing their copyrighted content") it does so. Whether this is an honest summary of Admiral's use of these domains is another matter.
My mentions of reversing minified code were with respect to observing the behavior of the Admiral scripts themselves, and in historical context where I was examining those scripts in support of an entirely different project (Reek's Anti-Adblock). Also note that minification is not for the purposes of obscuring or defeating an observer; if it was, you wouldn't leave function names like "hasDisabledAdBlocker" intact. Minification is simply to reduce the size of the file that needs to be transmitted, so that content loads faster. At any rate, no knowlege nor use of Admiral's scripts were involved in creating the list and addendum thus far.

[moved to its own post for clarity and importance]
At any rate, no knowlege nor use of Admiral's scripts were involved in creating the list and addendum thus far. In fact, I would say that the algorithm that produced the list and addendum thus far is superior in that respect to the unknown provenence of the items from pull request #8. I would actually recommend that @paulgb replace that list with the ones derived here, and will shortly create a pull to do so that he can merge if he agrees.

Yes, I would accept that PR. I suspect that most of the entries are
duplicates anyway and it would be good to have the record of provenance.
On Aug 15, 2017 3:13 PM, "tofof"<EMAIL_ADDRESS>wrote:

[moved to its own post for clarity and importance]
At any rate, no knowlege nor use of Admiral's scripts were involved in
creating the list and addendum thus far. In fact, I would say that the
algorithm that produced the list and addendum thus far is superior in that
respect to the unknown provenence of the items from pull request #8
https://github.com/paulgb/BarbBlock/pull/8. I would actually recommend
that @paulgb https://github.com/paulgb replace that list with the ones
derived here, and will shortly create a pull to do so that he can merge if
he agrees.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/paulgb/BarbBlock/issues/4#issuecomment-322560938, or mute
the thread
https://github.com/notifications/unsubscribe-auth/AAC0XSmOaSAfZZ8nT5mJFFQicZ24ZrtTks5sYe3fgaJpZM4O1cvW
.

@tofof
No, the addendum (https://pastebin.com/CYvL1GyJ and https://pastebin.com/Bu2gFH9J) isn't from threatcrowd, it's from using a script to register accounts and get the script domain they use.

I ran script that created 600 accounts and got the script URLs, these are the only ones in the list. The least common one (jadeitite.com) is present 8 times, the most common one (82o9v830.com) is present 20 times.

@anon182739 seems focused on the feasibility of maintaining such a list in a hostile environment; throwaways, tor, non-US providers all work toward that goal. That's a potentially valuable process too, but quite in contradiction with the stated goals of this project.

That's true. I was linked here from elsewhere and didn't read the project goals. I'm mostly interested in the technical side of things and what actions give the end result of a more complete list.

Is there any other place where admiral is being discussed? This seems to be the only active github issue about it, are there any active threads elsewhere?
https://github.com/anon182739/admiraljs - 206 admiral JS files from different domains, might be useful.  They're all identical save for the domain name referenced, so a regex should block them.

It's trivial to observe hundreds of Admiral domains, they probably number in the thousands.

If someone actually wants to make a serious attempt,

Could not this higher level principle be applied:
This exceedingly eccentric blog suggests corralling the evil via ASN blocking.  Guilt by association seems like a grand idea, but implementing it is not in my wheelhouse.
@tofof @paulgb @anon182739

This was released on 2018-11-01 updated day after: https://github.com/jkrejcha/AdmiraList - but hasn't been updated since then.
(Using NoScript, I saw Issu using a creepy-sounding domain 'shallowsmile.com' and found this thread)

There is no need to block any ASNs. It is sufficient to register a few hundred accounts with fake information and see which domains are being offered.


refactoring map_to_int_range function

I was absolutely sure I had opened a pull request for this single commit this morning and merged it.
Weirdly I don't see it anywhere on the master branch. Maybe I was still not fully awake and simply dreamt of doing it during breakfast ?! :-P
I'm confused. There we go again...

You wrote it as a line comment to my pull request that was already merged. thanks!


Fixed some transactions related endpoint problems.

@bogdanpetrea this one needs a rebase, also the tests are failing.


[Candidate 1v1 Sakura Forest II ZH v1] Crackling is audible near river and water sound is not easing well

Observed behavior
Crackling is audible near river and water sound is not easing well.
Expected behavior
No crackling is audible near river. Waster sound fades in and out nicely.
Videos
https://github.com/TheSuperHackers/GeneralsRankedMaps/assets/4720891/df899de1-0f6a-4443-8d38-291738c4b687

Not sure if should be blocker.

tried to make it a bit better hope it worked

The crackling appears to be gone. What I can still hear is

Water splashes sound radius is larger than water wave sound
Water wave sound has no easing

Perhaps take a listen at river sound of Winding River Revised. There it sounds good.

The crackling appears to be gone. What I can still hear is

Quieter water splashes sound radius is larger than louder water wave sound
Water wave sound has no easing

its only one sound file also winding river should have cracling noises aswell as it shows in wb its the same sound file as on sakura

well as designed than i dont wanna overload the map with noises

Are you sure you want to close this? I just listened again and it does not sound good.

updated

I was unable to hear out a difference.


User experience in the recurring snapshot/backup page

https://github.com/rancher/longhorn/issues/236

@yasker

@yasker This scene is similar to the edit disks in node page, only edit row has a cancel button, and new row only has a remove button.
Or add a cancel button to left of save button?

We need to keep it consistent styles with the node disk edit page.
For example, node disk edit page has one action to enable the edit for the whole page. We don't need to do pop out here, but one action to start editing the recurring list would be helpful.
Also, there are cancel/save options.
The deleted line wasn't obvious from UI perspective.
I think we can just copy what we've done with the disks editing pop out page and put it here?


Transparent bg on image preview

Sveltia info
Sveltia 0.8.4
Problem
If I upload a white path png on the collection list it appear with a white background,

on the editor instead I see the image correctly, but not on the preview

What's the expected result?
All images positions should have the same background:
background-image: linear-gradient(45deg, #eee 25%, transparent 25%, transparent 75%, #eee 75%), linear-gradient(45deg, #eee 25%, #fff 25%, #fff 75%, #eee 75%);
background-size: 16px 16px;
background-position: 0 0, 8px 8px;

Participation

[x] I am willing to submit a pull request for this issue.

Will check what’s happening here.

Just shipped v0.9.0 with the fix! 🎉


Dev

ok good for new kubernetes ressources

:tada: This PR is included in version 1.4.0 :tada:
The release is available on:

GitHub release
v1.4.0

Your semantic-release bot :package::rocket:


New release Qiskit Terra - Numpy Matrix

What should we add?
Good morning, the current documentation of qiskit highlights that the NumPyMatrix class will be deprecated.
Which class will implement the same functionality ?
"The NumPyMatrix class is deprecated as of Qiskit Terra 0.22.0
and will be removed no sooner than 3 months after the release date. "

That is part of the linear solvers package and done for HHL. The linear solvers package, including HHL, and all that support logic is now deprecated and being removed. For HHL the message refers to the textbook where HHL is described etc. See https://learn.qiskit.org/course/ch-applications/solving-linear-systems-of-equations-using-hhl-and-its-qiskit-implementation. Now you will see a link in there in Section 4 referring to a qiskit implementation - the link has the code which can now be found here https://github.com/anedumla/quantum_linear_solvers along with the NumPyMatrix class.

Thank you, so the implementation will be available also after deprecation here https://github.com/anedumla/quantum_linear_solvers ?
Could you provide a deprecation time estimation please?
Thank you very much

so the implementation will be available also after deprecation here

Yes, and the code is already available there now.

Could you provide a deprecation time estimation please?

The linear solvers logic, including HHL, was deprecated in version 0.22 (you see that in the message you posted). The earliest it could be removed from Terra, compliant with Qiskit deprecation policy, is in version 0.24 which is currently planned for end April (27th)


Deprecated Constant in new 0.6.9 - DEVICE_CLASS_PROBLEM

The new 0.6.9 (non dev) update introduced a new deprecated constant.
2024-01-29 06:59:23.570 WARNING (MainThread) [homeassistant.components.binary_sensor] DEVICE_CLASS_PROBLEM was used from ge_home, this is a deprecated constant which will be removed in HA Core 2025.1. Use BinarySensorDeviceClass.PROBLEM instead, please report it to the author of the 'ge_home' custom integration

Can you try 0.6.10-dev0 and let me know if it resolves this issue?