privacy

This magazine is from a federated server and may be incomplete. Browse more on the original instance.

Clbull, in Gitlab now requires phone number/credit card verification

Well they can just GitOut

buzz,
@buzz@lemmy.world avatar

Better to train Microsoft ai?

QuazarOmega,

How about training HI on Codeberg? ;)

Landsharkgun, in Google Update Reveals AI Will Start Reading All Your Private Messages

I’m sorry, is the article quoting a fucking LLM as the interviewee? What the fuck is this? I feel like I’m taking crazy pills.

Zerush, in Mozilla says Apple’s new browser rules are “as painful as possible” for Firefox
@Zerush@lemmy.ml avatar

Apple always had been painfull for any third party devs. Also Vivaldi worked several years to create a browser which works in this iPhone thing, and now, after it’s release, Apple admits Chromium. https://file.coffee/u/BPIaDNFX7YJkKtXuMdWNJ.gif

hperrin, in New Advertisement and Internet connection permissions for Simple SMS Messenger on Google Play Store...

Wow, the new owners enshittified those apps really fast.

ono, in The Boost android client for Lemmy is displaying these dark pattern ads pretending to be system notifications. What security/privacy conscious Lemmy clients do you recommend?

I start with whatever is on F-Droid, and narrow it down from there.

Jerboa was the only option there until recently. I see Voyager and Eternity are there now. I’ll have to give them a try.

WeLoveCastingSpellz,

thunder is awesome too

refurbishedrefurbisher,

Eternity FTW

schizoidman,

Voyager is currently many versions ahead of the one listed on F-Droid. It is still usable but you may want to get the latest version from GitHub.

ono,

If new versions don’t make it to F-Droid, they might as well not exist for me. There are only a couple of apps that I find important enough that I’ll spend time manually building/pulling/installing, and a Lemmy reader isn’t one of them. Thanks for the tip, though.

carzian,

Have you considered using github.com/imranr98/obtainiumYou give it the repository of the app and it will handle checking for new versions and updating them

ono,

Part of what I value in F-Droid is the additional layer in the build/release process, because it makes tampering more likely to be detected.

It’s still nice to know a tool like obtanium exists, though. Thanks for the link.

jacktherippah,

This is exactly the reason why I don’t like F-Droid as a way to get apps. You’ll have to trust an additional party when getting your apps, and updates are often a couple days behind. I prefer to get it straight from the developer’s GitHub or Coderberg or whatever.

ono, (edited )

You’ll have to trust an additional party when getting your apps, and updates are often a couple days behind.

I know how it works, and in this case, that’s fine with me.

F-Droid has an excellent track record; better than many developers have. And I’m not addicted to having the latest versions of everything on the day they’re released. In fact, not immediately jumping on the latest versions has saved me from nasty bugs more than once.

FutileRecipe,

Part of what I value in F-Droid is the additional layer in the build/release process, because it makes tampering more likely to be detected.

Barely and not really. “F-Droid can’t ensure the apps are safe. You still need to trust the upstream developers. We only do some basic check.” forum.f-droid.org/t/…/2

ono,

N + 1 > N

FutileRecipe,

N + X - Y ? N

Except now you’re adding an additional party to trust (the -Y). So it could still be considered less secure than N.

ono,

So it could still be considered less secure than N.

It could be, or it could not be. Depends on the particulars, and on the needs of the individual.

Mind, I’m not going around presuming to tell other people what’s better for them, as one or two others in this thread are doing. I’m just stating what’s a good fit for me.

FutileRecipe,

Depends on the particulars, and on the needs of the individual.

That’s not really how things like security works. It’s either more secure or it’s not. The security of a thing does not depend on needs. Now, does the application of it or does someone need it to be more secure? That’s where risk acceptance and the needs of the individual come into play.

I’m not going around presuming to tell other people what’s better for them, as one or two others in this thread are doing.

Same. I’m not saying “stop doing this.” I’m just trying to educate people and make sure they’re not operating with a misunderstanding. Needs of the individual and all that. I think some people just go crazy for something that’s not big tech, and then quit looking at the particulars.

ono,

Depends on the particulars, and on the needs of the individual.

That’s not really how things like security works.

If that were true, threat modeling wouldn’t exist. ;)

I think some people just go crazy for something that’s not big tech, and then quit looking at the particulars.

I expect that’s probably true. It’s safe to assume I’m not one of them, though. Cheers.

FutileRecipe, (edited )

If that were true, threat modeling wouldn’t exist.

I feel like we’re talking about different things. I’m talking about static concepts, if X is more secure than Y, not individual setups where something is tweaked. Threat modeling is tailoring the security to your needs. It doesn’t bend security of a static object or make the application of something less than what it is. It requires one’s actions to do that by not utilizing it.

Take bullet proof glass, for example. Bullet proof glass is more secure than regular glass. Now, do you need (does your threat model require) bullet proof glass? No? Ok, that doesn’t mean bullet proof is now less secure than regular glass, it’s just unneeded.

FutileRecipe,

I’m not sure why people insist on F-Droid, considering the F-Droid Security Issues.

ono,

I use it because, contrary to what that scare piece you linked would have the reader believe, it’s better for my needs than the alternatives.

(I’m no stranger to software development and security, by the way. I understand the pros and cons.)

FutileRecipe,

that scare piece you linked would have the reader believe

So an indepth and critical analysis of something is now a “scare piece?” Ok.

jack23, in One of the Most Controversial US Spy Programs Just Got Quietly Renewed

**The article:**On December 22, President Joe Biden signed a $886 billion defense bill that renewed one of the US government’s most controversial spy programs. Tucked in the 3,000-page legislation is an extension of the administration’s power to warrantlessly surveil foreigners overseas, and snoop on Americans in the process.

The authority, known as Section 702 of the Foreign Intelligence and Surveillance Act (FISA), has been the subject of intense scrutiny over the past few months. Set to expire on December 31, in the weeks leading up to that date, lawmakers were still in heated debates over whether and how to allow it to continue. But these conversations were halted after Congress and the Biden administration squeezed a short-term extension of the spy program through the annual defense bill, potentially keeping it in effect until 2025.

Many civil liberties advocates are criticizing the extension, saying that it skirts a rare, bipartisan push to protect Americans’ privacy. This stopgap measure, they argue, kicks a crucial debate on government spying into the new year—or beyond. In the meantime, it allows federal authorities to hold onto a power that they’ve routinely abused.

“It’s tragic,” says Elizabeth Goitein, senior director of the Brennan Center for Justice’s Liberty and National Security program. “Abuses and civil liberties violations are going to continue at a completely unacceptable rate,” she adds. “For every day, every week, every month that Section 702 continues without reform, that is what’s happening.”

Under Section 702 of FISA, federal investigators do not need a warrant to tap the phone calls, texts, and emails of foreigners outside of the country. But a loophole also lets them access messages that Americans exchange with targets abroad. These communications are funneled into a database that investigators can later search, again without a warrant. Numerous reports have documented the FBI’s “persistent and widespread” misuse of this authority to spy on Americans, running unauthorized searches on Black Lives Matter protesters, for instance, or January 6 rioters, and even a US senator.

In 2021, the FBI conducted about 3 million so-called “backdoor searches” on US residents. Last year, amid pressure from lawmakers and advocates to curb warrantless spying on Americans, that number dropped to about 119,000.

Still, the extent of this intrusion was troubling enough to spark a reform push from Republicans and Democrats. Earlier this month, Rep. Andy Biggs (R-Ariz.) introduced a bipartisan bill to renew a version of Section 702 with key changes, including a warrant requirement for law enforcement to pull Americans’ communications. It sailed through the notoriously divided House Judiciary Committee with support from both sides of the aisle.

Before leaving for winter recess, the House was set to vote between advancing Rep. Biggs’ proposal or a competing bipartisan effort sponsored by Rep. Mike Turner (R-Ohio), which experts said would broaden Section 702 surveillance powers. But many lawmakers didn’t want to rush the vote. Instead, they opted to temporarily extend the spy program through the 2024 National Defense Authorization Act, an annual measure that sets funding and policy priorities for the Pentagon. According to House Speaker Mike Johnson (R-La.), who had tacked the extension onto the NDAA in the first place, this move buys “necessary time to facilitate the reform process.”

The short-term extension officially stretches the spy program for four months, into April 2024. But under a little-known provision of the FISA law, a special court that oversees the program has the power to let it run for an additional year, until April 2025.

It’s a win for the Biden administration, which had been cranking up the pressure on Congress to keep the surveillance authority intact. In a House Homeland Security hearing last month, FBI director Christopher Wray acknowledged that the bureau had misused its Section 702 power in the past, but assured lawmakers that the agency was now operating with more restraint. Wray also warned that now was no time to strip the FBI of any authorities. Since Hamas’ October 7 attack on Israel, he said, a “rogue’s gallery” of groups have called for violence against the US. “702 is critical to protecting Americans from foreign terrorist threats,” he urged. “Please don’t throw the baby out with the bathwater.”

“Do not let it expire,” echoed Rep. Jim Himes (D-Conn.) on the House floor during its vote on the defense bill. “If it expires, Americans and allies will die.”

But many advocates say that by failing to add a warrant requirement and other key changes to Section 702, lawmakers had fumbled a chance to protect both Americans’ safety—and their rights. “It’s extremely disappointing,” says Sumayyah Waheed, a senior policy counsel with the civil rights group Muslim Advocates. There were bills introduced “to actually make the reforms that we desperately need in Section 702.” But “instead of allowing that debate to continue, this was kind of shoved through in a ‘must-pass’ piece of legislation.”

“There were a lot of opportunities for Congress to get this right,” says Andy Wong, advocacy director of Stop AAPI Hate, an organization for advancing the rights of Asian Americans and Pacific Islanders. “They sort of dodged the responsibility here.”

Wong says that leaving such a sweeping surveillance power in the government’s hands puts communities at risk. He points to the wrongful arrest of Professor Xiaoxing Xi, a Temple University physicist who was accused of espionage after the FBI misread emails he wrote to his Chinese colleagues—emails obtained in part under Section 702. Asian Americans and other communities of color often “face heightened scrutiny and suspicion,” he explains. “Really innocuous behaviors may be misinterpreted or viewed through a biased lens and lead to a lot of unwarranted suspicion and potential harm.”

Dr. Xi’s story may be among the more extreme, notes Goitein of the Brennan Center, but there may be other harms that are less obvious but also serious, largely because of the government’s extreme secrecy concerning its use of Section 702. “People can be subject to tax audits, be denied public benefits or public jobs,” she says. “There are any number of ways in which people’s lives might be affected by these searches, and they would never know it.”

When Congress returns in 2024, lawmakers will be expected to take up the reform effort once again. According to Majority Leader Steve Scalise (R-La.), leadership is trying to figure out a “fair process” for ironing out differences in the House proposals. Senate leaders Chuck Schumer (D-N.Y.) and Mitch McConnell (R-Ky.) also have pledged to work with the House on a bill that can be passed “early next year.”

Some experts are stressing the need to make sure the Biden administration acts swiftly since it now has room to drag its feet. “Even if Congress manages to pass a strong reform bill in the spring,” argues Goitein, “the administration has no real incentive to sign it because they know that they can continue surveillance until April 2025.”

Waheed from Muslim Advocates acknowledges their disappointment in what she described as “this setback,” but says, “We look forward to continuing the fight next year.”

BananaTrifleViolin, in Dropbox is sharing users' files with OpenAI, here's how to opt out

I deleted my account.

TGhost,
@TGhost@lemmy.ml avatar

😍✊

tjhart85,
@tjhart85@kbin.social avatar

Same, it's kind of a symbolic gesture since I apparently haven't used DB since 2018, but still, I cited them sharing files with AI companies as the reason.

Fake4000, in Question about phones: Am I overreacting?

Probably your best option now is getting a pixel phone and flashing it with graphene os.

If you can’t get a pixel phone you may want to use something like lineage os and make sure you don’t add any Google services to it.

lemann,

100% this is the best choice for op IMO.

A big pro is that they literally don’t need any Google services whatsoever by the sounds of things

MonkderZweite, (edited )

And then install your main Apps from F-Droid (all Open Source and reviewed) and put eventual proprietary apps (get them from Aurora instead of Play) in a Shelter/Insular profile.

jvrava9,
@jvrava9@lemmy.dbzer0.com avatar

deleted_by_author

  • Loading...
  • MonkderZweite,

    F-Droid replaces some proprietary bits and adds warnings and all.

    BearOfaTime, (edited )

    If you can’t get a Pixel, look for a phone on the DivestOS list (or the Lineage list, it can be way better than stock Android since it lacks Google anything).

    DivestOS is Lineage, with some more work done, kind of between Lineage and Graphene. I really like it, actually prefer it over Graphene for my use-case (it can run MicroG as a user app in a work profile, so kind of a stepping stone for getting away from Google).

    Fake4000,

    That’s amazing. Never knew about this phone.

    warmaster, in Plex Discover Together shares a bit too much. ...

    From the link:

    Plex is a hybrid streaming service/self-hosted media server.

    There’s the main problem. You’re partially in control. I encourage everyone to switch to Jellyfin, even if you don’t have anything to hide.

    BolexForSoup, (edited )
    @BolexForSoup@kbin.social avatar

    Jellyfin is such a PITA to set up for those that aren't more technically inclined.

    Contend6248, (edited )

    Huh? It’s far easier, throw in your server IP+Port or DNS and quick connect your clients with a short code.

    The bullshit claim solution by Plex makes me pull my hair out, especially on remote instances.

    Even when running, it managed to break the database 3 times, with no repair tool of working, interestingly there are plenty, community built and official ones, so that problem is common.

    Rebuilding takes a whole day with the intro-outro detection.

    What a nightmare to administrate.

    As someone who has bought a lifetime subscription a year ago i was enraged as my girlfriend told me that she got ads in Plex, turns out they just added their free streaming service in there without even asking, fuck them, Jellyfin evolved great!

    BolexForSoup, (edited )
    @BolexForSoup@kbin.social avatar

    Most people literally have no idea what you just wrote. I’m not saying jellyfish isn’t the superior option, I’m saying it’s less accessible.

    Sightline,

    Swim or sink.

    BolexForSoup, (edited )
    @BolexForSoup@kbin.social avatar

    This is terrible advice when you’re encouraging people to open up their network to the broader public without full understanding of what they’re doing.

    Contend6248, (edited )

    That is my advice to the people not having a clue what i’ve wrote. You don’t want to tell me that people not able to setup Jellyfin are full aware of anything they are doing with Plex?

    Not everyone should self-host, especially not people unable to watch a 10 minute setup tutorial of Jellyfin, or god forbid, reverse proxies.

    Dumbing down self-hosting below the bare minimum is dangerous, but to each their own.

    BolexForSoup, (edited )
    @BolexForSoup@kbin.social avatar

    deleted_by_author

  • Loading...
  • Contend6248,

    You’re free to have your own opinion

    BolexForSoup, (edited )
    @BolexForSoup@kbin.social avatar

    sadfasfsad

    frozen,
    @frozen@lemmy.frozeninferno.xyz avatar

    Plex is definitely easier to set up. I’ve done it multiple times over several servers. I’ve literally never heard of the database breaking, and I’ve deleted media that was actively being watched. Meanwhile, Jellyfin fails basic metadata matching on the exact same media set and also lacks built-in SSO. One of the biggest niceties of Plex is inviting people to join and they can just immediately login with Google.

    I’m not saying Plex is better, and I’m not defending their recent enshittification. It’s gotten worse, for sure. And I’m sure Jellyfin is great, but I haven’t had time to put the effort in to fix the metadata issues or create accounts so my users can switch over.

    Atemu, in Signal leaked random contacts to me!
    @Atemu@lemmy.ml avatar

    Could it be that these are spam numbers that tried to reach you at some point but were blocked before they could?

    Steve, in Privacy Concerns on Lemmy: A Call for More User Control

    The very nature of Lemmy and most social media, is that what you put out there is public. If you don’t want everyone in the world to read something you wrote, then social media may not be your kind of thing.

    LWD, (edited )

    deleted_by_author

  • Loading...
  • SnotFlickerman, (edited )
    @SnotFlickerman@lemmy.blahaj.zone avatar

    And I believe privacy defeatism is unhealthy.

    Is there such a thing as “perfect privacy?”

    Because it seems that, to exist in society, is to give up some form of privacy by dint of existing in it.

    You cannot stop yourself from being observed by other people, if they can see you. That’s just basic reality.

    To be completely private, you would have to live in the woods and not interact with anyone or speak with anyone.

    Is it defeatist to be realistic about the limitations of the idea of privacy?

    As someone who has spent a lot of time seeking internet privacy, I’ve learned that more often than not I’m making myself more conspicuous. That doesn’t mean I’m going to give up on privacy, but it does mean that I’m going to consider its limitations.

    EDIT: I’m reminded of an interview with Mark Hossler from Negativland. The interview is long gone from the internet (it was on an obscure website pre-youtube) but the center of it always stuck with me.

    “If you really want full control of your art, don’t show it to anybody, keep it in your home.” His argument was Richard Dawkins’ argument for memes. The human mind functions by copying and mimicking. When someone else has viewed your artwork, they’ve already created an internal image of it in their memory. That memory is inconsistent with reality, but if they have a good memory, they can recreate it relatively easily (if they have similar artistic skills). You can’t really stop that kind of copying from happening, so the only way to fight it and keep “complete control” is to not share it at all.

    Similarly, the only way to have complete control over your privacy is by not interacting with anyone at all.

    mnglw, (edited ) in New Advertisement and Internet connection permissions for Simple SMS Messenger on Google Play Store...

    It has begun

    (ps install the fork versions of the simple mobile tools suite, its called fossify)

    Sheeple, in Dark Patterns
    @Sheeple@lemmy.world avatar

    Discord. The “Gift nitro” button is placed where in a previous version the “upload file” button was

    Additionally the window once opened, can’t be closed with the ESC key unlike other windows.

    Finally you had to decline twice before that was changed to only be once.

    Overall a very disgusting move on what was supposed to be a user friendly program

    rar,

    It had enough eye candies for the casual market, but that was it. I still mourn for the death of IRC outside the tech-dev circles.

    zanyllama52,
    @zanyllama52@infosec.pub avatar

    I tried discord once years ago. Didn’t care for it as a product, nor did I care for the privacy policy.

    ad_on_is, in Pornhub pulls out of Montana, NC as age-verification battle rages on
    @ad_on_is@lemmy.world avatar

    “PornHub pulls out” 🙊

    bionicjoey, in I don't have anything to hide, so I don't care

    “Okay, then hand me your phone unlocked and give me as much time as I want to poke around your browser history, files, and photos.”

  • All
  • Subscribed
  • Moderated
  • Favorites
  • privacy@lemmy.ml
  • localhost
  • All magazines
  • Loading…
    Loading the web debug toolbar…
    Attempt #