Notices by Mayel - sunny side punk (mayel@sunbeam.city)

Mayel (mayel@pub.mayel.space)'s status on Thursday, 17-Oct-2019 11:26:57 EDT Mayel
- Baldur Bjarnason
@baldur can you link the Web components article?

In conversation Thursday, 17-Oct-2019 11:26:57 EDT from pub.mayel.space permalink Repeated by mayel
The Tor Project (torproject@mastodon.social)'s status on Thursday, 17-Oct-2019 10:04:20 EDT The Tor Project

Fewer than 24 hours remain to be entered to win one of our unpopulated SAO badge boards and a branded lanyard.
We'll randomly choose 10 donors who give $20 or more through Friday 13:00 UTC (9am ET).
https://donate.torproject.org

In conversation Thursday, 17-Oct-2019 10:04:20 EDT from mastodon.social permalink Repeated by mayel
Will Murphy 🌹 (datatitian@social.coop)'s status on Wednesday, 16-Oct-2019 20:56:53 EDT Will Murphy 🌹

"Happy #NationalBossDay to the 10 million workers in nearly 7,000 employee-owned businesses"

In conversation Wednesday, 16-Oct-2019 20:56:53 EDT from social.coop permalink Repeated by mayel
Mayel (mayel@pub.mayel.space)'s status on Wednesday, 16-Oct-2019 23:00:23 EDT Mayel

@wizard we need federated code forges, stay! Fortunately ForgeFed is working on it

In conversation Wednesday, 16-Oct-2019 23:00:23 EDT from pub.mayel.space permalink Repeated by mayel
Furry Throw Pillow (pillowcat@sleeping.town)'s status on Tuesday, 15-Oct-2019 10:57:02 EDT Furry Throw Pillow

Capitalism: Anarchists just want to set the world on fire and sow chaos.
Also Capitalism: *literally sets the world on fire, like, literally literally; oh god, the poor Amazon*

In conversation Tuesday, 15-Oct-2019 10:57:02 EDT from sleeping.town permalink Repeated by mayel
Ian Forrester (cubicgarden@mastodon.cloud)'s status on Wednesday, 16-Oct-2019 05:40:05 EDT Ian Forrester

Core human values from @bbcrd@twitter.com.
The start of a framework based around human values not attention.
Critical research I think you will agree? #teamhuman #mydata https://cubicgarden.com/2019/10/16/core-human-values-not-eyeballs/

In conversation Wednesday, 16-Oct-2019 05:40:05 EDT from mastodon.cloud permalink Repeated by mayel
IzzyOnDroid ✅ (izzyondroid@mastodon.technology)'s status on Monday, 14-Oct-2019 17:27:50 EDT IzzyOnDroid ✅
- F-Droid
Calling out to the Mastodon community again: famous @fdroidorg Repomaker is looking for a new maintainer (and contributors). Should be familiar with F-Droid, Python, Django.
Please help keeping it alive!
Volunteers go to https://gitlab.com/fdroid/repomaker/issues/234 – others please boost, as usual 😉 Thanks!
#helpWanted #callingOut
In conversation Monday, 14-Oct-2019 17:27:50 EDT from mastodon.technology permalink Repeated by mayel
Attachments
1. Looking for new maintainers of Repomaker (#234) · Issues · F-Droid / repomaker
  
  from GitLab
  
  This issue is for anyone interested in taking over maintenance of Repomaker. To get a first look at what's Repomaker, take a look at [its page on F-Droid's site](https://f-droid.org/repomaker/). To...
Mayel (mayel@pub.mayel.space)'s status on Tuesday, 15-Oct-2019 16:19:00 EDT Mayel
- Râu Cao
- Mayel
@raucao @spider nevermind, this post hadn't federated to my instance: https://z.macgirvin.com/display/b64.aHR0cHM6Ly96Lm1hY2dpcnZpbi5jb20vaXRlbS8wZDlkYTY4Zi0xZTUyLTQ2NjYtYTcwNy1lZWMxYzg4ZTJhNDc

In conversation Tuesday, 15-Oct-2019 16:19:00 EDT from pub.mayel.space permalink Repeated by mayel
Mayel (mayel@pub.mayel.space)'s status on Tuesday, 15-Oct-2019 16:15:57 EDT Mayel
- Râu Cao
@raucao what are you referring to?

@spider

In conversation Tuesday, 15-Oct-2019 16:15:57 EDT from pub.mayel.space permalink Repeated by mayel
Parade du Grotesque 💀 (paradegrotesque@mastodon.sdf.org)'s status on Tuesday, 08-Oct-2019 15:33:42 EDT Parade du Grotesque 💀

$ git pull
Agreeing to the Xcode/iOS license requires admin privileges, please run “sudo xcodebuild -license” and then retry this command.
(sigh)
That's not how open source works, Apple, that is simply NOT how it works.

In conversation Tuesday, 08-Oct-2019 15:33:42 EDT from mastodon.sdf.org permalink Repeated by mayel
Marie-Cécile Godwin Paccard (mcpaccard@mastodon.design)'s status on Tuesday, 15-Oct-2019 05:36:10 EDT Marie-Cécile Godwin Paccard

MOBILIZON (beta) IS OUT! Free, open source, decentralized, (soon) federated, privacy by design software to allow us to organize freely. So proud to be part of it!
EN https://framablog.org/2019/10/15/mobilizon-lifting-the-veil-on-the-beta-release/
FR https://framablog.org/2019/10/15/mobilizon-on-leve-le-voile-sur-la-beta/
#FOSS #Mobilizon #MobilizonBeta #events
In conversation Tuesday, 15-Oct-2019 05:36:10 EDT from mastodon.design permalink Repeated by mayel
Attachments
1. Frama.site : testons la contribution
  
  By framasoft from Framablog
  
  Frama.site : testons la contribution
Soh Kam Yung (sohkamyung@mstdn.io)'s status on Sunday, 13-Oct-2019 20:58:04 EDT Soh Kam Yung

Cryptographer Matthew Green on a change Apple made in iOS13: "Apple is sharing some portion of your web browsing history with the Chinese conglomerate Tencent. This is being done as part of Apple’s “Fraudulent Website Warning”, which uses the Google-developed Safe Browsing technology as the back end."
#Privacy #Security #Encryption #Google #Apple #Tencent #Malware #WebBrowsers
https://blog.cryptographyengineering.com/2019/10/13/dear-apple-safe-browsing-might-not-be-that-safe/
In conversation Sunday, 13-Oct-2019 20:58:04 EDT from mstdn.io permalink Repeated by mayel
Attachments
1. How safe is Apple’s Safe Browsing?
  
  By Matthew Green from A Few Thoughts on Cryptographic Engineering
  This morning brings new and exciting news from the land of Apple. It appears that, at least on iOS 13, Apple is sharing some portion of your web browsing history with the Chinese conglomerate Tencent. This is being done as part of Apple’s “Fraudulent Website Warning”, which uses the Google-developed Safe Browsing technology as the back end. This feature appears to be “on” by default in iOS Safari, meaning that millions of users could potentially be affected.
  
  (image source)
  
  As is the standard for this sort of news, Apple hasn’t provided much — well, any — detail on whose browsing history this will affect, or what sort of privacy mechanisms are in place to protect its users. The changes probably affect only Chinese-localized users (see Github commits, courtesy Eric Romang), although it’s difficult to know for certain. However, it’s notable that Apple’s warning appears on U.S.-registered iPhones.
  
  Regardless of which users are affected, Apple hasn’t said much about the privacy implications of shifting Safe Browsing to use Tencent’s servers. Since we lack concrete information, the best we can do is talk a bit about the technology and its implications. That’s what I’m going to do below.
  
  What is “Safe Browsing”, and is it actually safe?
  
  Several years ago Google noticed that web users tended to blunder into malicious sites as they browsed the web. This included phishing pages, as well as sites that attempted to push malware at users. Google also realized that, due to its unique vantage point, it had the most comprehensive list of those sites. Surely this could be deployed to protect users.
  
  The result was Google’s “safe browsing”. In the earliest version, this was simply an API at Google that would allow your browser to ask Google about the safety of any URL you visited. Since Google’s servers received the full URL, as well as your IP address (and possibly a tracking cookie to prevent denial of service), this first API was kind of a privacy nightmare. (This API still exists, and is supported today as the “Lookup API“.)
  
  To address these concerns, Google quickly came up with a safer approach to, um, “safe browsing”. The new approach was called the “Update API”, and it works like this:
  
  Google first computes the SHA256 hash of each unsafe URL in its database, and truncates each hash down to a 32-bit prefix to save space.
  
  Google sends the database of truncated hashes down to your browser.
  
  Each time you visit a URL, your browser hashes it and checks if its 32-bit prefix is contained in your local database.
  
  If the prefix is found in the browser’s local copy, your browser now sends the prefix to Google’s servers, which ship back a list of all full 256-bit hashes of the matching URLs, so your browser can check for an exact match.
  
  At each of these requests, Google’s servers see your IP address, as well as other identifying information such as database state. It’s also possible that Google may drop a cookie into your browser during some of these requests. The Safe Browsing API doesn’t say much about this today, but Ashkan Soltani noted this was happening back in 2012.
  
  It goes without saying that Lookup API is a privacy disaster. The “Update API” is much more private: in principle, Google should only learn the 32-bit hashes of some browsing requests. Moreover, those truncated 32-bit hashes won’t precisely reveal the identity of the URL you’re accessing, since there are likely to be many collisions in such a short identifier. This provides a form of k-anonymity.
  
  The weakness in this approach is that it only provides some privacy. The typical user won’t just visit a single URL, they’ll browse thousands of URLs over time. This means a malicious provider will have many “bites at the apple” (no pun intended) in order to de-anonymize that user. A user who browses many related websites — say, these websites — will gradually leak details about their browsing history to the provider, assuming the provider is malicious and can link the requests. (Updated to add: There has been some academic research on such threats.)
  
  And this is why it’s so important to know who your provider actually is.
  
  What does this mean for Apple and Tencent?
  
  That’s ultimately the question we should all be asking.
  
  The problem is that Safe Browsing “update API” has never been exactly “safe”. Its purpose was never to provide total privacy to users, but rather to degrade the quality of browsing data that providers collect. Within the threat model of Google, we (as a privacy-focused community) largely concluded that protecting users from malicious sites was worth the risk. That’s because, while Google certainly has the brainpower to extract a signal from the noisy Safe Browsing results, it seemed unlikely that they would bother. (Or at least, we hoped that someone would blow the whistle if they tried.)
  
  But Tencent isn’t Google. While they may be just as trustworthy, we deserve to be informed about this kind of change and to make choices about it. At very least, users should learn about these changes before Apple pushes the feature into production, and thus asks millions of their customers to trust them.
  
  We shouldn’t have to read the fine print
  
  When Apple wants to advertise a major privacy feature, they’re damned good at it. As an example: this past summer the company announced the release of the privacy-preserving “Find My” feature at WWDC, to widespread acclaim. They’ve also been happy to claim credit for their work on encryption, including technology such as iCloud Keychain.
  
  But lately there’s been a troubling silence out of Cupertino, mostly related to the company’s interactions with China. Two years ago, the company moved much of iCloud server infrastructure into mainland China, for default use by Chinese users. It seems that Apple had no choice in this, since the move was mandated by Chinese law. But their silence was deafening. Did the move involve transferring key servers for end-to-end encryption? Would non-Chinese users be affected? Reporters had to drag the answers out of the company, and we still don’t know many of them.
  
  In the Safe Browsing change we have another example of Apple making significant modifications to its privacy infrastructure, largely without publicity or announcement. We have learn about this stuff from the fine print. This approach to privacy issues does users around the world a disservice.
  
  It increasingly feels like Apple is two different companies: one that puts the freedom of its users first, and another that treats its users very differently. Maybe Apple feels it can navigate this split personality disorder and still maintain its integrity.
  
  I very much doubt it will work.
Björn Schießle 🌍 🇪🇺 (bjoern@mastodon.social)'s status on Saturday, 12-Oct-2019 03:00:02 EDT Björn Schießle 🌍 🇪🇺

Account migration "easier than ever, and with 3.0 comes the ability to bring your followers with you like magic!" Thanks a lot! I think that's one of the most important feature for a decentralized network! https://blog.joinmastodon.org/2019/10/mastodon-3.0/ #Mastodon
In conversation Saturday, 12-Oct-2019 03:00:02 EDT from mastodon.social permalink Repeated by mayel
Attachments
1. File without filename could not get a thumbnail source.
  
  Mastodon 3.0
  
  from Official Mastodon Blog
  
  In this exciting new release: Moving accounts, trending hashtags, private servers and more!
Mayel (mayel@pub.mayel.space)'s status on Saturday, 12-Oct-2019 03:28:09 EDT Mayel
- Edurne
- emsenn of Teraum
@emsenn nice initiative! you'd probably find the list of organizations in this study by @Gin helpful: http://emo.world/2018/09/27/no-profit-no-hierarchy-a-comparative-study-of-the-lower-left/
In conversation Saturday, 12-Oct-2019 03:28:09 EDT from pub.mayel.space permalink Repeated by mayel
Attachments
1. File without filename could not get a thumbnail source.
  
  No profit, no hierarchy: A comparative study of the ‘lower left’
  
  By Edurne from Dr. Edurne Scott Loinaz
  
  No profit, no hierarchy: A comparative study of the ‘lower left’
emsenn of Teraum (emsenn@tenforward.social)'s status on Saturday, 12-Oct-2019 00:41:44 EDT emsenn of Teraum

I've started collecting a list on my website of contemporary autonomous collectives. I plan on adding their rough population, so I can ultimately have a count of there are X people living in anarchy today.
@ me with more, please. (I literally just started it so it doesn't have the Zapatistas or the International Commune of Rojava, even though I've talked about like, both of those today.) But @ me with any, please!
https://emsenn.net/collections/autonomous-collectives/

In conversation Saturday, 12-Oct-2019 00:41:44 EDT from tenforward.social permalink Repeated by mayel
HAL.exe (aleks@cybre.space)'s status on Friday, 11-Oct-2019 12:40:01 EDT HAL.exe
- ❤ Bram ❤
- Mike
@mike @bram Yes, the question of being able to build commons in a capitalist economy is crucial.
To me the battle of free software became irrelevant considered that nowadays:
- capitalism ate free software and rebranded it as opensource, which really is just "free software with free as in free market"
- there's free software everywhere, used to build centralized proprietary services
- everything happens in the cloud, so there are many questions like "how do you effectively trust sysadmins with your data"

In conversation Friday, 11-Oct-2019 12:40:01 EDT from cybre.space permalink Repeated by mayel
Mayel (mayel@pub.mayel.space)'s status on Friday, 11-Oct-2019 12:12:37 EDT Mayel
- Yet Another AP Server
Google pulls Hong Kong protestor game from app store
https://www.bbc.com/news/business-50009763?

cc @yaaps
In conversation Friday, 11-Oct-2019 12:12:37 EDT from pub.mayel.space permalink Repeated by mayel
Attachments
1. Google pulls Hong Kong protestor game from store
  
  from BBC News
  
  Another company faces a boycott for banning an esports player who supported the protestors.
Mayel (mayel@pub.mayel.space)'s status on Friday, 11-Oct-2019 11:05:10 EDT Mayel
- ❤ Bram ❤
Most FOSS are tool kits or building blocks (akin to box of tools you find in a garage, or lego blocks) and not products. Capitalism influences some creators and maintenors to brand and present them as products though, which may be part of the confusion.
@bram

In conversation Friday, 11-Oct-2019 11:05:10 EDT from pub.mayel.space permalink Repeated by mayel
❤ Bram ❤ (bram@social.wxcafe.net)'s status on Friday, 11-Oct-2019 10:34:06 EDT ❤ Bram ❤

Something that would really change my life as a FOSS dev is that people stop seeing FOSS as a finished product but instead as a best effort collective work by people that are [in position off] contributing for free on their free personal time on it and gave it to you for free [when this situation apply].
Like stop saying that "this is total shit" because you had bugs or because it wasn't top 100% perfect like you want for your super edge case that it wasn't designed for -_-

In conversation Friday, 11-Oct-2019 10:34:06 EDT from social.wxcafe.net permalink Repeated by mayel
MoodleNet (moodlenet@mastodon.social)'s status on Friday, 11-Oct-2019 08:11:03 EDT MoodleNet

Getting feedback on resource uploading in #MoodleNet
https://blog.moodle.net/2019/resource-uploading/

In conversation Friday, 11-Oct-2019 08:11:03 EDT from mastodon.social permalink Repeated by mayel

Before

Public

Notices by Mayel - sunny side punk (mayel@sunbeam.city)