_jomo

I made https://fahrplan.cc where you can filter the [not] recorded sessions, categories, and titles.

I've mostly made it for myself to skip the recorded sessions when on-site and to see what's coming up at the current time of day. It therefore tries to include all the self organized sessions, workshops, meetups, music programs, etc. I've been running it for a few years and people use it for all kinds of use cases, including sitting at home and watching the streams.

This seems to affect users from the EU, but not from the US.

reproducible build available at F-Droid

It's not available at F-Droid. They have an F-Droid compatible repository that you can manually add to your F-Droid client where they ship binaries.

I also can't find any mention of reproducible builds on their website, and their builts seem to include proprietary binaries.

The issue [0] to publish the app on F-Droid is still open.

0: https://github.com/oxen-io/session-android/issues/73

Any service that claims to be "free" and doesn't have a very obvious business model gets me very suspicious. I usually start reading the service's privacy policy.

This website's "Privacy Policy" states:

We collect [personal information] by fair and lawful means, with your knowledge and consent. We also let you know why we’re collecting it and how it will be used.

Yet personal data is collected through Google Analytics without being mentioned anywhere and without my consent. The policy is also the linked privacy policy for the Android and iOS app. It doesn't let the reader know why personal information is collected and how it's used, as it claims. Is that different in the actual apps? Also, what data does the website and the app collect?

This is a "feature", not a bug. Twitter keeps asking for phone numbers all the time and then suggests you also allow others to discover your account via phone number.

So this guy merely enumerated a lot of phone numbers and found accounts of users who agreed to have their phone number publicly match their account.

I'd like to point out that GDPR compliant sites don't need to ask permission for strictly necessary cookies.

I also recommend using Cookie AutoDelete for Chrome [0] or Firefox [1]. You can define a whitelist of websites where you actually need Cookies (because you want to stay logged in), and the rest will be forgotten when you close the tab. It even allows different rules in Firefox Containers.

0: https://chrome.google.com/webstore/detail/cookie-autodelete/...

1: https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...

Also, in my experience address locations on Google Maps are often very inaccurate, so it's not even a good source.

I keep wondering why people who seemingly care about their privacy continue to use Google products/services, doing all their online activity while logged in to their Google account.

Useful website, but years out of date and unmaintained.

The actively maintained community fork can be found at https://justdeleteme.xyz.

Repo: https://github.com/jdm-contrib/jdm

Please don't rely on the Referer being present (ever). It's an optional header to send in a request and you can configure your browser — at least Firefox — to not send it for privacy reasons.

Logout (or anything else that triggers changes of any kind) shouldn't be a GET request.

Comcast has even published an informational RFC describing how to inject crap into HTTP requests:

https://tools.ietf.org/html/rfc6108

I think most VPNs use NAT, so many users share the same IP address. Otherwise the VPN would be mostly pointless.

You seem to ignore that this constrains abusers as much as it does legitimate users. Collective punishment in order to mitigate abuse by a few is the wrong way to go.

They have been doing this for any account registered from a VPN or Tor. However, you can simply appeal the block and tell them you haven't tweeted and not broken any rules.

They will send you an automated mail, offering to validate your phone number, or reply to the mail if your problem is not solved. Just reply to the mail.

Unfortunately, processing the request takes anywhere between 10 minutes and 2 weeks; usually a couple days at least. I assume this is on purpose to make it cumbersome for spammers.

They always reply with the same boilerplate, but the account will be unlocked:

  Your account is now unlocked, and we’re sorry for the inconvenience.
   
  Twitter has automated systems that find and remove automated spam accounts and it looks like your account got caught up in one of these spam groups by mistake. This sometimes happens when an account exhibits automated behavior in violation of the Twitter Rules (https://twitter.com/rules).

  Again, we apologize for the inconvenience. Please do not respond to this email as replies will not be monitored.

You can get most of this by analyzing server logs with IP addresses. No cookies required. You might need some JavaScript tracking for more detailed analytics, but there is absolutely no need for external tracking by Google or the likes.

Examples for self-hosted analytics include GoAccess (server log analyzer) [0] or Matomo (JavaScript tracking, formerly Piwik) , although I think it uses tracking cookies by default [1]

0: https://github.com/allinurl/goaccess

1: https://matomo.org

I rarely type in duckduckgo.com. I just enter the search keyword into the URL bar and it takes me to DDG.

Containers are a feature built into Firefox. There are extensions that let you use them more generally with any given website. It's also quite useful to log into websites with multiple accounts at the same time.

However, to prevent tracking I mostly use CookieAutoDelete [0] which only stores Cookies for sites that I have whitelisted after the tab is closed. It's really just a handful of sites I visit frequently and don't want to log in every time. Cookies aren't required for anything else.

Also, not having a Google account comes in handy to prevent tracking by Google. My default search engine is DuckDuckGo.

0: https://addons.mozilla.org/de/firefox/addon/cookie-autodelet...

Interesting, but the commit that introduced the malicious changes wouldn't be signed by the alleged author's key.

Also I'd trust anyone who denies adding a backdoor like this. Why would anyone do this with their name attached to the change?

What you'd actually do is change the author to "Anonymous Coward <nobody@android.com>" ;)

https://android.googlesource.com/platform/packages/apps/Glob...

From RFC8483 [0] "Yeti DNS Testbed", which was published a few hours ago:

Yeti DNS is an experimental, non-production root server testbed that provides an environment where technical and operational experiments can safely be performed without risk to production root server infrastructure.

In section 5 they publish experience with their IPv6-Only operation.

For example:

There are reports of a notable packet drop rate due to the mistreatment of middleboxes on IPv6 fragments. One APNIC study reported that 37% of endpoints using IPv6-capable DNS resolvers cannot receive a fragmented IPv6 response over UDP.

Or:

It was observed that Yeti-Root servers running Knot 2.0 would compress the zero-length label (the root domain, often represented as ".") using a pointer to an earlier example. Although legal, this encoding increases the encoded size of the root label from one octet to two; it was also found to break some client software -- in particular, the Go DNS library. Bug reports were filed against both Knot and the Go DNS library, and both were resolved in subsequent releases.

0: https://tools.ietf.org/html/rfc8483

I don't think Firefox on Android supports this. On Desktop it's quite useful for when you want to search a site you don't have a shortcut for. Guessing the shortcut has usually worked for me.

Also, when your search didn't give you what you were looking for, you can just prepend e.g. !g to search on Google, which for me is slightly faster than to copy the query, go to the address bar, enter "g" and then paste.

I don't know why buying something and then leasing it to someone else would be an illegal thing to do. I guess they made sure it's not illegal in Nevis, at least.

Who would shut them down? Is this something the ICANN prohibits? Is ICANN even involved here, as Njalla is (to my knowledge) not an ICANN-accredited registrar? They simply buy the domains from an actual registrar and let you use them.

I wonder why nobody has mentioned Njalla [0] yet.

We want to keep things simple and we're not trying to compete on price but security. We will never be the cheapest domain name registration service but we'll always be the most privacy centered one

You sign up with email or XMPP+OTR, they send mails PGP signed + encrypted (using info from key server or the key you uploaded), they have app based (TOTP) 2FA and they accept various cryptocurrencies.

There's no bullshit and so far the support has been quite good.

Their DNS (currently) supports: A, AAAA, CAA, CNAME, MX, NS, PTR, SRV, SSHFP, TXT (also "Dynamic" and "Redirect")

It's run by some of the Pirate Bay founders and they're still making fun of legal threats. ;)

0: https://njal.la

Twitter (and their API) is horribly broken and inconsistent.

There is twint [0], which bypasses the API and just scrapes their website to circumvent API limitations.

The wrong number of favorites could be cached and it will go a way after a day or two, or it might be favorites on Tweets you can't see (because you're blocked, or the account is private, or the Tweet/account has been deleted).

As __bee said in another comment, you can request your Tweet archive and get the Tweet IDs from the CSV (I've seen a handful of Tweets of mine that were not in the CSV, but those are very rare). At least for deleting Tweets, there is no rate limit. Twitter also won't show your own Retweets when the original Tweet is no longer visible to you (although they might be included in the CSV) and made it impossible to interact with those. It used to be possible to delete Retweets if you somehow got its ID, but I think this has been disabled as well.

If you want to play around with the API but don't want to register your phone number and an application at Twitter, you can use tools such as the "t" cli [1] or the "twython" library [2] with any of these publicly known API keys [3].

0: https://github.com/haccer/twint

1: https://github.com/sferik/t/

2: https://github.com/ryanmcgrath/twython

3: https://gist.github.com/sokcuri/42fba0b455a7b7b8ab772ba34426...

When it can be done without breaking too many users' day-to-day browsing.

I've had 3rd party cookies disabled for years. I can count the number of times this has caused trouble on one hand.

As pi is infinite, it also stores any imaginable information. Someone actually went ahead and implemented a file system based on this idea:

https://github.com/philipl/pifs

Both WhatsApp and Telegram promote themselves as ultra secure because all their data is encrypted from start to finish.

Sigh. I wish they had added that Telegram is not "encrypted from start to finish"

He mentions the Facebook court hearing where Facebook was suspected of doing this. Zuckerberg denied they're doing this and I wonder if this happened to Google users but they falsely accused Facebook.

The guy in the video is probably using an Android phone with that "OK Google" feature turned on. He's using Google Chrome and is signed in to a Google account. As scary as it is, there are simple ways to prevent this.

SDV stuck inside a circle

Off topic: I never understood why this video was discussed that much, especially in order to blame SDVs. It's an example of pointless road markings and a perfectly behaving vehicle. It's like driving into a one way street that turns out to have no exit. The driver can't be blamed.

While this has long been known, I was never able to actually reproduce this and I'm not sure how it's technically even supposed to work.

Assuming we're using IPv4, the default gateway is a VPN and the machine is behind a NAT: Any outside service (e.g. STUN server) would see the VPN's IP address. How would the browser even technically be able to know the public (i.e. the NAT's) IP address?

However, the WebExtensions API allows tweaking this via the webRTCIPHandlingPolicy to only reveal the public "interface" IP address.

FWIW, I'm always connected to a VPN and I have configured my macOS [0] and Android [1] firewalls to drop any connection other than the VPN's.

0: Wrote it down here: https://jomo.tv/security/pf-prevent-traffic-bypassing-vpn

1: Quite self-explaining: https://f-droid.org/packages/dev.ukanth.ufirewall/