• 4 Posts
  • 26 Comments
Joined 1 year ago
cake
Cake day: July 7th, 2023

help-circle




  • Again you ignore words like “often”. There certainly are projects that are doing extremely well, and I am happy for them, i am one of those donating.

    Yet you ignore the funding problem that exists in open source. You can’t make it go away by naming a few that have done well for themselves. Even those that are doing well enough, what could they achieve, if they had comparable funding to bigger players that are advertising? I am not saying that it’s the option that everybody should go for, but if one chooses to, i would like it to be privacy respecting, and thats where hopefully mozilla will come in. And outside of opensource, on a “normal” persons phone, how many apps are funded via ads? Wouldn’t it be great if those were privacy preserving instead? It’s a step in the right direction.

    I will stop replying to you, as you don’t seem mature enough to hold a respectful discussion, without trying to frame my opinions as trying to be manipulative.



  • Thats why i said “seems“ to be and „on a bigger scale“ to allow for other options. But those other options like through donations(=paying them) are often not enough. Apparently you don’t see opensource developers struggling and choose to just ignore the reality. You also fail to point out other options that scale as well as advertising does. As you seem to have the solution that many people struggle to find, feel free to actually tell us about it. I only expressed my opinion not „misinformation“. Your comment on the other hand failed to provide any arguments to further the discussion. So yeah “knock it off“


  • While there are a lot of critics of this, ask yourself: for how many services and apps you use (e.g. messenger, cloud storage, email, operating system, web browser…) are you willing to pay recurrently? If that answer is not for every single one of them, then this move is the answer.

    The internet desperately needs a way to fund things and advertising seems to be the only viable solution on a bigger scale. And I don’t think that there is anyone better suited than mozilla for the job of pushing a privacy respecting way of doing so. Sure this needs to be done the right way, but they should be given the benefit of the doubt.

    And this doesn’t mean that everything needs to be cluttered with ads. You could still pay a bit to remove them.

    Even if the answer to the question above was yes, consider the masses. Other people might not care enough/have the same awareness about privacy to pay, but they could gain a lot with this. Consider people in less fortunate circumstances monetary wise. Don’t they deserve privacy if they can’t afford to pay for services?







  • Tldr: This is a traffic analysis attack, it exposes metadata without help or access to data from whatsapp. Other messengers are vulnerable too. It requires vast resources and access only governments have. It is not a threat model that todays messengers defend against.

    The interesting part of the article ist the last one.

    According to the internal assessment, the stakes are high: “Inspection and analysis of network traffic is completely invisible to us, yet it reveals the connections between our users: who is in a group together, who is messaging who, and (hardest to hide) who is calling who.”

    The analysis notes that a government can easily tell when a person is using WhatsApp, in part because the data must pass through Meta’s readily identifiable corporate servers. A government agency can then unmask specific WhatsApp users by tracing their IP address, a unique number assigned to every connected device, to their internet or cellular service provider account.

    WhatsApp’s internal security team has identified several examples of how clever observation of encrypted data can thwart the app’s privacy protections, a technique known as a correlation attack, according to this assessment. In one, a WhatsApp user sends a message to a group, resulting in a burst of data of the exact same size being transmitted to the device of everyone in that group. Another correlation attack involves measuring the time delay between when WhatsApp messages are sent and received between two parties — enough data, the company believes, “to infer the distance to and possibly the location of each recipient.”

    Today’s messenger services weren’t designed to hide this metadata from an adversary who can see all sides of the connection,” Green, the cryptography professor, told The Intercept.





  • The response by the debian maintainer responsible for this change to the keepassxc developer is an actual disgrace

    Request to revert change:

    @julian-klode this needs to be reverted asap. This is now our fourth bug report because of the decision to neuter the base KeePassXC package in Debian. Put the base package back where it was and create a keepassxc-minimal.

    Response by debian maintainer:

    julian-klode commented 9 hours ago: I’m afraid that’s not going to happen. It was a mistake to ship with all plugins built by default. This will be painful for a year as users annoyingly do not read the NEWS files they should be reading but there’s little that can be done about that. It is our responsibility to our users to provide them the most secure option possible as the default. All of these features are superfluous and do not really belong in a local password database manager, these developments are all utterly misguided. Users who need this crap can install the crappy version but obviously this increases the risk of drive-by contributor attacks.

    The whole github issue is worth a read, as it actually explains the issue with the change.

    Edit: as i gave the debian maintainers view visibility i wanted to give a quick summary of the keepassxc point of view as well:

    • julian-klode specifically mentions attacks by contributors of keepassxc. If you don’t trust the developers, why would you trust the minimal package which is developed by the same people?

    • If the Debian packagers have good reason to believe the keepassxc-full version presents a broader attack surface, then they ought to present what they’ve seen that makes them feel that way, not promote baseless innuendo.

    • the features are disabled by default. If you do not opt in, the code never gets executed.

    • the safest version of keepassxc is the one thats tested, meaning full featured

    • removing all those features doesn’t make it more secure, it dumbs it down to an encrypted spreadsheet and makes it less secure. Users should be automatically notified when one of their accounts has been breached and their password for that account has been found floating in a db dump. Users should rely on their password manager to handle logins for them, so they’re less likely to get tricked into a phishing page.

    • if you disagree with features in someones app you fork it. You do not change it and distribute it under the same name. A -minimal version would have been ok

    • Debians own policy is to communicate with upstream beforehand before introducing changes. This was not the case, nor was there a chance to collaborate on an effective solution for both parties.

    • Debian could have chosen to give users an informed choice between -full and -minimal. Instead they broke existing users installs.

    • People saying it was released in Debian sid, which is meant for changes. It is also meant for Feedback, which julian-klode refuses to listen to.




  • Unskilled5117@feddit.detoLinux@lemmy.mlKDE Plasma needs stability
    link
    fedilink
    arrow-up
    21
    arrow-down
    3
    ·
    edit-2
    6 months ago

    Well there’s a simple thing you are overlooking. You could just not theme Kde with third party themes and extentions and stuff like kvantum themes. It wouldn’t break, just like gnome. Still if you do decide to change stuff its going to be fine most of the time. The beauty of Kde is that there is the option to change stuff, but you aren’t required to.

    KDEs default layout is really beautiful and well put together, just like gnome is.

    Oh and don’t forget to take backups of your /home. Thats good practice for every desktop environment.