Cry about it and reflect on it, bitch.

What a piss poor brain you have.

🤷 sometimes people grumble quietly until a final straw is added to the stack. Not surprising.

I see a lot of good discussion here. I’ve been on proton for years now, using my own domain. While true that Andy is one of 5 board members, and it’s a nonprofit etc, these statements are raising hairs on my neck, personally.

Does anyone have a good guide on problems associated with self-hosting email?

Damn, that’s critical for my needs.

So I’ve heard and read. Fwiw, I was reading into the state of the art many years ago when fingerprinting was more nascent, I expect it’s matured and gotten yet more advanced in the time since (unfortunately).

Guess I gotta pause working on interesting, net-positive work for a little bit to see where things are, and how to properly combat it, lest I give out poor advice again.

There are online tests for it to determine whether you become more or less unique. The defaults in the extension are carefully set to minimize uniqueness, based on my research and per the docs. You’ll note it ones or fakes more than just the canvas API.

I was using this before ff added it’s own noise system or of necessity.

https://addons.mozilla.org/en-US/firefox/addon/canvasblocker/

You can take a look at calyxOS, it’s what I use. Android but with all Google telemetry ripped out. It’s not as resistant as graphene against a govt adversary, but for privacy, better battery (bc google stuff isn’t constantly running) and still being able to use everything, it works great.

I’m a microG guy, so I use Calyx. I wish graphene supported microG.

First I’d ever heard of OMEMO, thanks dude

Ah yeah, I’d forgotten about that.

I’m certain the engineering team considered it, but I wonder why they didn’t pursue having accounts that haven’t signed in for a while issue a notice to the sender, or even have the account deactivate itself.

Make an opt-out default, you could disable that behaviour if your threat model needed to account for that 🤷

I’m not convinced it ever should’ve. Make it obvious sms mode is in use, etc etc. But it was great to have everything in one place. One blocklist, great photo editing etc

Yeah, I’m one of em. I’m well aware it’s not secure, but as a frontend, signal certainly was more customizable and pleasant to use even for just the few people I had to sms till I could convince to use signal.

I haven’t run graphene, so I can’t speak for it. But on any other android variant, microG is a system-app, so that it can spoof Google’s services properly. That means patching the system.

Functional apps is the important bit, use of microG allows apps to provide push messaging etc without knowing Google services aren’t installed. There’s still some communication with Google as a result, but it’s fully sanitized.

I invite you to try installing common apps like Strava or Pokemon go without any Google services at all.

There’s also CalyxOS if you don’t want to run anything Google on your phone at all, but still have functional apps and such.

I’m on CalyxOS, it works great. Locked bootloader, ability to block connection of devices when screen is locked (defeating cellebrite’s method of choice), work profiles and firewalls etc.

If you drive a Toyota and the infotainment system has a “DCM” icon in the corner, your driving habits and location are being recorded to their servers.

E: this is happening via their own cellular modem built into the vehicle, with its own separate SIM or eSIM. Getting at the module seems to require access behind the dash, almost purposely making it difficult. Pulling the fuse will kill the front passenger-side speaker, though there are YouTube vids on how to reactivate the speaker while keeping the DCM module dead.

Sorry, “google blobs”? A lot of work went into MicroG, and I think it’s a shame that you’d minimize so much good work to reimplement the lynchpin of Google’s control on your devices.

At this point I’ll presume you’re just misinformed, as no proprietary google code operates within microG unless you decide to run with device attestation, and there it’s running as a sandboxed service. At any other time, you are able to run open source code which spoofs your device details to Google, and spoofs google to all these other closed source apps in a reliable and readable, much smaller codebase.

Honestly, the irony of running blobs, when one is completely closed source vs the other which is fully open. Hahaha.

All your points are true, yet still depend on Google in sandboxed form. That negates everything else for me, who wants a reasonably secure device that works out of the box and also respects my privacy.

If a nation-state wants into my phone, it’s delusional to believe even graphene can hold them off, you need real opsec for that, and unfortunately all I’ve seen thus far from graphene guys is cosplaying that the NSA wants your porn selfies.

Graphene and micro g? Cool. Sandboxed Google? Nope.

Agreed, it shouldn’t be their problem. But, I am using applications just fine that are sensitive to root, even device attestation, but I don’t recommend attestation just out of principle.

Even pokemon go seem to run ok with just micro g and aurora.

There’s also CalyxOS, low drama and very reliable. Https://www.calyxos.org

I’ll mention that a pixel with CalyxOS works great as well, no google code code other than AOSP which helps battery life a lot.

Some things like voice controlled companion or android auto are being implemented, but I never really gave a fuck about that stuff, being on bicycle or motorcycle only.

I don’t care how nice the sports car is, if it’s not going where I want it to, I’m not getting in.

Same, I’ve been team calyx for several years now, the dev rocks and I’m very happy to donate to them for keeping my pixel 3 running.

They sort of tried at my last job… There’s portable, non admin installs of Firefox available. The tricky part was ssl inspection certificates, but even that is easier than it used to be.

Same here, even my newly issued work PC always gets the Firefox treatment. Annoyingly, some sites that I need for work (almost, but not quite, zero) just do not work with Firefox, but do with chrome.

I need the ROMs to play with hardware in ways manufacturers and Google don’t intend. I don’t ask the manufacturer for permission, nor do I need to as source code and bootloaders are available.

I’m not willing to be a data point for profit, I don’t give a fuck whether it’s the shithead ccp or fuckbox google, my data stays on my phone unless I decide otherwise.

Can’t do that? Again, proud of your weakest element. How strange. Enjoy your inferior phone.

Get replacement parts, get access to bootloaders, get control of your data. You can’t? Lower quality, and you admit it proudly.

I think I’ve seen you around here before, shilling these lower quality, closed source devices from China.

Some of us wouldn’t proudly admit to doing nothing with their time, but here we are.

I’ve got important stuff on my personal machine, and it’s the principal of the thing, besides. Good luck to you, I suppose.

Fascinating. I work with FPGAs and previously with openCV on a Pi-based platform. The DMA hacks are a technical tour de force.

Yup, so you don’t care. Lmao you literally gave away the key to your house for an uninteresting video game. Pitiful.

Airvpn all the way.

Seriously, y’all should try organic maps, particularly if you like to hike in places without reception.