Self-host? Or use VPN to connect.

TLDR in text please. Not going to spend 16 minutes watching that.

Been using Nebula for a while now. Going to miss some YouTube creators, but I’ll expect to get over it.

Ah, well. Maybe that saves a click and 10 minutes of someones life.

I notice you quoted the sentence from the description - did you watch the video itself?

No, I’m afraid I didn’t.

Every time I talk about privacy online, the pessimists always come out. "It’s impossible to have any online privacy.

My experience is actually completely opposite. While mainstream “normies” don’t seem to care, most of them are using readily available privacy tools in their communication daily. Things like WhatsApp, Signal and iMessage. Most websites these days are HTTPS enabled. Governments are so concerned about this loss of monitoring capability, they’re trying to craft laws which allow them to backdoor devices before encryption happens. And they’re meeting resistance, despite all the lobbying (see Chat Control2.0). We’ve never had as widely adopted privacy tools as we have today.

Big tech and advertising are two problems that still create trouble. A lot of this stems from completely different, non-privacy related reasons (the lax US policies concerning anti-consumer and monopoly laws) but even here policies around the world are slowly catching up. GDPR gives Europeans quite a bit of control over our data and while this is still just one baby step - it’s much better than it used to be. There’s a lot of global inequality here though. Facebook/Meta is synonymous to Internet in the developing world, because they’ve used their monopoly money to exploit the situation. Digital imperialism is still strong.

I’m not going to harp too much on SMTP privacy, Proton has a bunch of nice services. If that’s where your MX happens to point at is, then great, but we do also need to slowly move away from these old protocols that offer no privacy choice (yeah I know, SMTP is here to stay).

What I’d like to see more, is talk about threat modeling in this space. Because that’s where it all starts and threat models are quite personal. There’s no “one size fits all” privacy, because our needs vary. Political dissident living in exile from hostile government has completely different needs for privacy compared to a person who doesn’t like YouTube ads. We should try to foster easily digestible discussion around personal threat modeling - right now we (the privacy crowd) come across as loonies since lot of the advice we give starts from the wrong end of the model.

I don’t see digital privacy as a pessimistic space. But what do I know, I’m not a content creator.

This is the moment in Scooby-Doo where the gang unmasks the person they’ve just caught and underneath is just the Microsoft Bing logo

Well, that was extremely long winded way to say “depends on your threat model”. Which it does.

So nothing new under the sun.

I also don’t get much value out of the statement that “every” OS except Android is vulnerable. Do they really mean all other OSes, or just what would come to mind for most people, i.e. Windows, macOS, Linux, iOS? What about the various BSDs for example?

It’s a DHCP manipulation attack, so every RFC 3442 compliant DHCP implementation implementing option 121 would be “vulnerable” (it’s not vulnerability though). Android apparently doesn’t implement it, so it’s technically impossible to pull off against Android device. There might be others, but I’d guess most serious server/desktop OS’es implement it.

The title isn’t misleading at all, even though the “neutering their entire purpose” is a bit of a click-bait. This doesn’t affect ingress VPN at all.

It’s an attack that uses DHCP features (according to RFC).

It’s a clever way to uncloak egress VPN users, therefore it does have privacy impact since most of us use VPN for purposes of hiding out traffic from the local network and provider and there’s no “easy” fix since it’s just a clever use of existing RFC.

I’m a consultant so whenever I’m applying for a new gig I need to provide a consultant profile, which is very similar to resume.

Over the years I’ve learned that most customers are not very interested in the “personal stuff” sections - they just want to know you have the skills required, so try to minimize the amount of personal data and concentrate on skills and past gigs (anonymizing customers/companies) etc.

But - unfortunately you have to tell something about yourself and your ability to work together with others, there’s really no way around it. It’s also more and more customary that (for some reason) they want your photo. Stuff like education, certifications need to be there, but keep it very short. Think about “social media profile page”.

Provide stuff like contact info, address, phone, date of birth (if required) and references separately - don’t put them into your resume. You can add something like “Personal information and references provided separately by request” in there, that way, even if the document is shared, all they get is something resembling a LinkedIn profile.

You can also try to add “confidential” to the document header, but I’ve noticed it’s not respected very often.

Yeah… ok. Have a good day buddy

Your Internet traffic being encrypted is totally up to the site receiving your traffic or to the app on your phone sending it. And you still leave your metadata at your ISP, along with DNS.
Sure you can always set up your own DNSSEC but the effort compared to just clicking “connect” in that VPN app is not even compareable.

I can be private and anonymous without VPN - but a normal user? Just use VPN dude.

I see. Sure. There’s a risk of course.
But VPN companies are not legally obligated to collect and save your Internet usage data like your ISP is.
So select a provider that doesn’t, like Mullvad.

And thus begins the enshittification of Discord

SELinux has been GPL for 24 years.

It’s part of what was called Rainbow Books, but is known more widely these days as the Common Criteria.
https://en.wikipedia.org/wiki/Common_Criteria

It’s the “Government setting standards” sort of scenario.

Which was a response to this

Oh boy. Some of you people watch too many movies.

Let’s get some basic stuff established:

• This thread is about commercial platforms selling your direct message data. That’s the threat model.
• I don’t live in a country where the police SWAT teams throw flashbangs without court orders
• If the authorities want to get to me (which, again, is not the threat model of this thread). They can. Easily. They know where I live. They just have to knock on the door. It’s not even locked.
• I did, to my best knowledge, not reply to you in anywhere this thread. I’m not sure why you are replying to me.

But sure. I’ll give you this: If your threat model is dodging SWAT team flashbangs, I doubt using Signal is much use to you at that point. That just wasn’t what this thread was talking about.

Catching this now is pretty huge, because it mainly targets distro build systems. Had this gone undetected, we’d be in shiznit creek couple of years down the line.

Something something Privacy vs. Anonymity. But I invite you to try. Good luck getting into my phone!

If you want private messaging - use Signal.
If you use any kind of messaging on commercial platforms, expect immediate loss of privacy. They call them “direct” messages for a reason.

It doesn’t mean anything at all. Swedish SIGINT agency has been working with 5-eyes for ages.

So hear me out. What if we took $6.9M out of the CEO bonus and dropped the Mozilla AI project?
Maybe that would be enough to hire a maintainer or two for Firefox iOS port?
Maybe that could work?
I don’t know, just an idea. Crazy.

When I was last working in the automotive industry about two decades ago, a lot of effort was being put into protecting BIOS on diagnostic laptops, so that only “authentic” manufacturer diagnostic tools could be used to service the vehicles.

Pretty sure that development has continued.

Yeah, that’ll most likely disable the car / limit it. They often have anti-tamper detection in critical ECUs as well.

LibreOffice will do just fine reading and writing the format as long as you don’t care too much about small formatting/layout differences.

It will also struggle if you’ve embedded other office components into your documents (like excel embedded in word).