AmbitiousProcess (they/them)

iOS also has Brave, which apparently created the adblock engine Mozilla borrowed (and weakened)

Afaik that’s a currently non-used library in Firefox desktop. For iOS, The Verge claims it’s just Apple’s WebKit Content Blocker + EasyList.

https://www.theverge.com/news/987247/mozilla-firefox-ad-blocker-ios-launch

all android devices have been using file based disk encryption since several Android versions now.

All Android devices are supposed to support it, but not all do. (or at least, not all do effectively without compromising the cryptographic root of trust by not implementing proper hardware security chips)

I’ll grant it to you on the scopes, PIN changes, etc, but realistically I just don’t think anyone can justify GrapheneOS being something that should be supported on Fairphone given how absolutely desolate the phone looks with regard to any attempt at all to hardware security.

It really depends on what security level you want out of a phone

It does, but that’s exactly my point. GrapheneOS will provide you essentially no more security than any other alternative Android operating system, should it have to operate on a Fairphone with all those features not supported by a Fairphone stripped away.

Unless Fairphone adds more hardware security features that are standard on most other phones, and highly supported on Pixels, installing a heavily crippled GrapheneOS on a Fairphone would get you essentially none of the benefits of GrapheneOS in the first place.

Entirely lacking disk encryption for typical users due to not having a secure element is a pretty major flaw.

It’s also missing hardware accelerated virtualization which is necessary for much of GrapheneOS’s sandboxing, has weak security for other keys in the OS keystore, is missing hardware memory tagging which makes it much easier for apps to use overflow attacks, doesn’t have proper verified boot support once a custom alternative OS is flashed, and leaves exposed debugging APIs even when the phone is locked.

This breaks:

• Secure app spawning
• Memory corruption protection
• Integer overflow protection
• Most of Graphene’s kernel hardening
• Much of Graphene’s attack surface reduction abilities
• Hardware-based attestation and security monitoring
• Quick tile protection pre-unlock
• Debugging access prevention
• Verified Boot
• The security of your PIN against any automated attack

At that point, GrapheneOS can’t physically provide you essentially any security anymore.

It wasn’t just the update cycle either, it’s that they don’t have the physical hardware chips to support Graphene’s minimum requirements for security, which would severely weaken any benefits you actually get from GrapheneOS.

Especially given it has a similar effect to how spam emails are often deliberately bad so they just don’t waste their time with people that waste some of their time before wising up. If you only get the most easily duped people in the first place, that’s a lot less time wasted.

With LLMs, you’re explicitly targeting people that are less likely to strongly ideologically object to things (like LLMs, or genocide funding) on moral grounds, you’re getting the people that are willing to just get a quick answer without having to look into it deeply, and you’re getting the people who’s sole goal it is to flood the web with any SEO-optimized slop they can with the least effort possible.

LLMs self select for people not willing to put in cognitive effort, that are easily influenced and less careful about fact-checking things.

Yep. If you want to record everything going on from your POV, strap a GoPro to your head and see if people’s moods change about it. If they clearly don’t want that, they don’t want the “convenient” hidden cameras either. Simple as that.

As far as I’m aware, Redlib gets around blocks in two ways. The partially implemented client-side blocks I presume are by just stripping the code (e.g. seeing the post but it’s greyed out and has a popup saying “sign in” in front of it, or when your whole screen is a login page but all the actual content was already loaded in the background, deleting that code means you can read the post just fine)

And the rest is just tricking Reddit by mimicking the request format & behavior of the Android Reddit app, which tricks Reddit into believing the user is supposed to be allowed access or shouldn’t be rate limited, because obviously anybody using the app is a real signed-in user… I guess? (this information is from their GitHub page’s README but I’m not sure exactly how all this works under the hood)

Fun fact, safereddit.com still works perfectly fine as a frontend in my experience! (not the only one out there, just an instance of redlib If you need to bypass the login requirement just add “safe” before “reddit” in the URL and it should let you in :)

I’ve found https://megalodon.jp/ to work similarly. Japanese site, and has some quirks with how large of a page it will archive before only saving a screenshot, but it works.

Sorry, but do you have a source for this at all?

As far as I can tell, they have added some Play Integrity checks (with root detection being part of that), but the reason was cited as spam prevention, and I can’t find anything claiming they had any sort of agreement with Apple to do so.

They kept pushing for Apple to implement it, but I don’t know of any cases of them making any promises about what they’d do on their own platform in order to convince Apple or anything like that.

In what way does this have anything to do with RCS or Apple lmao

The petition is only one part of the puzzle.

Keep Android Open also says to contact your regulators and fill out Google’s developer verification survey, both of which either directly affect Google by influencing internal processes, or put regulatory pressure on them to back off.

The Change.org petition is moreso just a way to count overall total supporters, and add one more lever of pressure that can be leveled against them. (e.g. instead of “we’ve had a lot of people contact regulators” it’s “218,000 people are actively taking the time to tell you they don’t like this”, can be cited by lawmakers, advocacy groups, etc)

That said though, I do agree that a change.org petition on its own is… generally ineffective most of the time.

Isn’t that no different than the millions of open source projects that have few authors, little interest and are abandoned for the next shiny thing?

The end result isn’t inherently different, but the basis is.

Someone who programs a FOSS project with their own programming skill is, by definition, more invested, and more willing to spend time making that project exist. Someone who is mostly just willing to tell the LLM to do it for them is, by definition, less invested in the project.

It is more likely that someone less invested in a project will abandon it.

At least in my mind with the current state of LLMs, if there is an open source project that you want to update for yourself, you should be able to do that pretty easily.

Sure, that’s possible, but the main concern is that most people either don’t have access to more capable models (which will otherwise require them spending money for their software to keep getting things like security patches, vs projects that have maintainers that are more invested in them that aren’t abandoned in the first place which are effectively free unless you choose to donate), and you get forks in development path. It might fit one user’s goals, but now you have, say, 100 people who all tried reviving abandonware with their own LLMs, all with different features, security, import/export mechanisms, etc.

That’s not to say it’s bad that people can use LLMs to “revive” abandonware, but I don’t think we should be encouraging people to create and publish software that’s highly likely to be abandoned in the first place.

This is the main reason why vibe coding, even if it produces good code, is still a major problem. It encourages people with the goal of making software, but without the actual will and motivation to keep supporting that software to pump out software and publish it.

It’s like all the faceless AI-automated YouTube channels we have now. It’s not that these people had no way of doing it before, it’s just that it’s easy and might make them some money, or make them feel like they accomplished something until they get bored and move on.

There’s something to be said for convenient and easy to use things, but they’re a double edged sword, because they also directly target people with the least emotional investment to use them, as a side effect of that convenience.

Very cool! I definitely need something like this, personally. I forget to talk to people way too often.

link that doesn’t appear to be dead: https://www.news5cleveland.com/news/local-news/we-follow-through/flock-cameras-are-still-on-in-cleveland-even-though-the-contract-expired

Same here, the cost is just way more worth it if you already pay for other Proton services.

Does seem like IVPN is closer to Mullvad in how it works though for people who just want to pay for a VPN separately. No email needed for an account, similar price, open-source clients. Also debubks misinformation used by VPN peddlers to convince people to buy VPNs who don’t need one.

Kinda. Mostly used as an interface for piracy torrent trackers like realdebrid or torbox rather than people hooking it up to regular streaming platforms though.

It’s not really a “you need to bypass TCP” and more of a “TCP traffic could be censored”… just like UDP, DNS, or really any other kind of networked traffic.

Reticulum isn’t necessarily immune to this, it just supports a variety of protocols as a mesh network, so TCP isn’t something who’s failure would make the network impossible to use (but good luck accessing any traditional website without TCP).

For example, you might be able to communicate from your Android phone running a Reticulum-compatible app to a separate nearby device over Bluetooth, then that device broadcasts a signal over LoRa, which hits someone else’s LoRa-compatible radio, which then connects over a USB-C cable to their laptop, which is plugged into their router, which can then send the traffic over TCP, where it’s picked up by someone elsewhere using the internet. If TCP traffic is blocked, say, by their local government, maybe their LoRa radio just broadcasts to another LoRa radio, and another, and another, etc, until enough of them chained together is able to reach the recipient. Hence, TCP wouldn’t strictly be required, thus preventing censorship of Reticulum through blocking TCP connections. (though this would still reduce how many ways you could theoretically get to people, as if that person ONLY has access to TCP as the start of their connection to the mesh, they’d be cut off)

Of course, the government could also try jamming radio signals, then making LoRa useless, but if they do that and don’t block TCP traffic, then you still have options.

Unfortunately, I wouldn’t call Reticulum an internet replacement, nor do I think it could ever be without still relying on the kind of large-scale, high-throughput infrastructure we have for the internet today. It just doesn’t have enough bandwidth, and it’s difficult to run anything requiring low latency if every connection requires hopping through a thousand peers to get to someone on the other side of the planet who, say, wants to play the same online game as you.