• 17 Posts
  • 99 Comments
Joined 4Y ago
cake
Cake day: Nov 03, 2021

help-circle
rss

Not specific to grapheneos, and also battery friendly on LOS is localsend, and on gnu+linux I use instead localsend-go since it offers a CLI (what I use) and a rudimentary TUI which is missing some functionality but good enough (I prefer using it as CLI). But localsend also includes a windows app BTW. On gnu+linux some prefer kdeconnect, but I find it more battery intensive than localsend on the phone, and the extra functionality is not what I expected, like I originally guessed I could write sms from a gnu+linux box, or read past one, and that’s not what sms control means.

Don’t these alternatives work on grapheneos for some reason?


Hmm, youtube-dl? I believe it’s no longer the one to use, it’s yt-dlp, and mpv has support yt-dlp for quite some time, but it could be any player as long as it supports yt-dlp. What I’ve noticed is that nothing gets as fast to fix these YT issues than yt-dlp. It’s working fine for me on Artix for quite some time. And unless wanting ton use a browser, that’s what freetube has been documenting every time receiving related bugs. See for example:

https://github.com/FreeTubeApp/FreeTube/issues/8083#issuecomment-3326565693


Just so you know, if you like freetube, you can configure the external player to mpv, which underneath uses yt-dlp when streaming, and use the button to load the external player. Of course one can also launch smplayer, which underneath is using mpv, which underneath…

But the thing is content creators don’t move out of YT cause they’re there to monetize in the first place. So this thing seems never ending no matter alternatives like peertube exist.


Besides outertune there’s harmonymusic as well

None protect your IP if not using a non self hosted frontend like invidio or piped, cause if self hosted then you’re providing your IP any ways. So now a days actually private is kind of hard. But these applications for sure help a lot.


2025.09.26 can still do it without deno. Besides, when the change happens, node and bun (never heard about bun before) will be supported as well, not just deno, but they will require extra arguments passed to yt-dlp. If using yt-dlp directly, and already having node or bun installed, no need for deno then.



I’m wondering about LOS re-locking on particular devices. DivestOS used to allow that, not sure if only on pixels, but if divestOS which was based on LOS could, I don’t see how that code can not be ported over upstream LOS. Have anyone seen an effort similar to divestOS in this regard?


The battle is still there, and the GrapheneOS guy always bark at microG, like he really hates the whole concept of microG. What I have gotten from the discussion is that GrapheneOS is more secure, but although it sandboxes GPS denying some permissions, and some of those might be needed to be given away for some services any ways, it doesn’t try to fake anything, which microG does. In that sense my preference has been microG, and I don’t regret it.

That said, what you mentioned is true, both still access google app store, and still have to give some minimal information to google.

There’s a 3rd option the OP didn’t mentioned. If they are mainly interested in app store, and not the google services in general, there are a couple of somehow recognized 3rd party app store mirrors, which keep the same original signatures of the packages hosted by google app store, and they offer packages from other sources not provided by the google app store, in case interested on those packages: apkmirror and apkpure. From the two apkpure still allows to install and upgrade packages through FLOSS 3rd party apps like apkupdater, so that might be an option. For some months apkpure packages weren’t able to be installed through apkupdater, but it seems that got corrected already.

But in general, the OP would benefit from always looking for FLOSS packages on the F-Droid repo, then other non official F-Droid repos which can be used through the F-Droid app, then see if they can be installed from their web site and updated without intevention of any installer, and then if there’s no option but using proprietary software maybe looking for them on the apkpure/apkmirror sites or on apkpure through apkupdater or similar, and then aurora store, or if using grapheneOS finally google play if anything else fails, :)

I do understand the need for proprietary software, like bank OTP apps. It’s sad banks, governments, medical services and so on never look for FLOSS software, they always require users to get proprietary software. I don’t live in the EU, but I hope current hate/banning tendency ends up doing user a favor by starting to require banks, and the like to start using FLOSS apks, though doesn’t really helps me, I hope in the end it helps people in the EU.


Jami on desktop, not on phones yet:

https://jami.net/eleutheria

Available only for desktop users for now, the new Push-to-talk feature offers a new effortless way to communicate: simply press a button for hands-free, instant, and convenient audio messaging. It’s like in the olden days of gaming when gamers would key bind the Push to talk feature to be able to talk when necessary.

So jami all the way, 🙂



Yeah, Librewolf by default doesn’t use DoT neither DoH, and so your IP is still exposed, but Librewolf had made it fairly easy to change through preferences or the librewolf overrides, whatever more convenient, as stated on its DoH enabling documentation.



Librewolf is a privacy oriented fork of Firefox, it grabs some setting from arkenfox. Betterbird is not a privacy oriented fork of Thunderbird as far as I remember. When I tried it the only thing I was attracted to was its tray support, but as I use non DE compositors, so far wayfire, labwc and sway (tabbed layout), and as there’s currently a Firefox bug, I didn’t see any reason to keep trying it, and now on sway with tabbed layout I see no reason for a tray any ways…

kixik


Well there’s already a browser on the works, verso, and it also attempts to make servo “embeddable”:

We aim to explore embedding solutions for Servo

Hopefully both project reach 1.0 sooner rather than later. Meanwhile there’s Librewolf at least, and there was Mull, but instead currently there’s IronFox and also FrozenFennec on the works as well, all forks of Firefox oriented to privacy.



do you mean you use a more privacy oriented fork like Librewolf, or instead some chrome/chromium derivative or fork?


I don’t agree with what is written in that blog BTW, 1st I like that there’s a repo that at least tries as best as it can to protect the free software aspect of the apps, which many disregard but are pretty important to me, that’s one of the main values from f-droid for me. Proprietary binary components can include many invasive “features” one is not aware of. As requirement the source code and building from it is required. If you build from source, removing proprietary dependencies for example you’ll get a different binary, and that requires a new signature on the final package. F-droid has improved a lot on reproducible builds. And I’ve read in several places magnifying the issue of apks from official f-droid being moths later compared to original developer release, my own experience is different, and when I’ve written, I immediately get a reaction from someone which doesn’t agree with me (I never reply back). I’ve read about the single entity signature, but that alone should not be an issue, otherwise we would be distrusting packages from debian, arch, and so on, which use a set of signatures to sign all of their packages, particularly when the build and signing process is automated, in some distros most packages come signed by the same bot. The issue about using a VM with a LTS distro about to expire or already expired is a valid one, but can you blame them when migrating breaks their flows and they don’t have enough hands, and that got overcome any ways. Now a days things are working fine AFAIK. That the clients support multiple repos violate an android policy, oh well, I don’t care much about android policies, and google for that matter, which collects a ton of data from users and people forgets about what that means, but what a bad practice not to follow those policies.

I believe some people really dislike free software, which is not the same as open source, one really need to value the four basic freedoms it procures, and if one doesn’t give a dumb for whatever reason then one doesn’t really appreciate free software, perhaps all one wants is not paid software, which is not the same. Free has two meanings and people often gets confused, and f-droid is about free software. It’s true they can’t guarantee every single bit of their content, but they trying through their policies and a few scripts has value to me, and taking a look at what free software meaning and the basic freedoms it looks to preserve is important to be understood before complaining about an organization trying to offer free software. It would be more appropriate if the terminology changes to use the spanish “libre” word instead, but it is what it is, that why sometimes FOSS is instead referred as FLOS (free/libre or free and libre). And true, as a result developers who want to provide apks through f-droid and also through non free software app stores or repos (whatever makes more sense) need to have in place something to account for the differences, and that’s not optimal, but there’s a good reason for it, but some developers just don’t want to do it and even less not depending on android proprietary stuff or other proprietary stuff for that matter, which is their prerogative any ways.

A little rant of mine, not we all have to agree over the same arguments I guess.


Well, it is available on the IzzyOnDroid separate f-droid repo, so if using the f-droid client, you can still grab freetubeAndroid with it.

Never tried it though, and not sure how bloated for a phone, but it’s easy to install/update with any f-droid client.


ohh, as I set sponsorblock for it some time back, I thought it also did it, but it does not.



Well, to me xmpp is the way to go, but I guess it’s not a matter of opinion, but rather understanding the motivation.

Why is your dad looking for telegram? What caused your dad to look into it? Perhaps digging into those, one can make a case with alternative more private options. For sure one can always argue in general the already mentioned alternatives, and the ones to come are better privacy wide, but it boils down to why is him looking to use telegram. If it’s about having friends or co-workers, or a high school set of friends there, I would think there’s no way to change his mind, :( But more technology arguments like stickers, better voice/video conferences, whatever, then that’s more something that can be argued I would think, the same way if he’s just looking for something more private of course.


I second xmpp + omemo, and would caution that as far as I can remember matrix leaks significant metadata when syncing between instances/services.

As a personal decision I got away from signal (molly in fact) more than a year ago.

I’m also keep jami working with my family, particularly for things not requiring immediate response. It’s a different beast, since it’s p2p, but there’s no server associated to it, no matter if decentralized or not. It’s easy as well, just not as responsive, in particular if looking for immediate responses… I like and keep both, hoping jami improves.


Phoenix is not a browser, is it? AFAIK it’s a similar user.js to Arkenfox… They claim to be better, and have their on comparison, but I don’t know:

https://codeberg.org/celenity/Phoenix/wiki/Comparison

Arkenfox has been like the default user.js for privacy… Perhaps phoenix already is better…


Regarding omemo, dino is getting there, see its closed issue 1609. Not sure why it has taken them too long for a new release, but they have the stuff already merged.


I’m interested on what changed that make it differ from Mull in a non recommended way. Are you referring to their 1st MR? where they outline:

  • Replaced Arkenfox & Brace preferences with ones from Phoenix 2025.01.06.1…
  • Added support for Google Safe Browsing (Safe Browsing is disabled by default and can be enabled by setting the following preferences to true in about:config)

I understand Mull was using arkenfox which is sort of the go-to reference, and now ironfox move to phoenix. The safe browsing is the same approach Librewolf follows, though I don’t like their comment on a proxy. I don’t like their choice of the brave search engine, but I always replace that with searxng tweaked a bit.

The MR doc doesn’t look too terrible, but don’t know about the changes themselves.


As mentione SMS is by no means secure, and although silence hadn’t gotten any update, still works as a champ on Android 15.



Ohh, so it changed for being webkit, to be a FF based browser. At any rate Librewolf keep being like the closest, FF but with better defaults, and without the need to configure the arkenfox stuff.


It’s a webkit engine based browser, actually it uses webkitgtk. Now webkit is the engine on which safari (apple) is based as well, and it’s been there for some time. blink, which is what chromium based browsers use, is a fork from webkit with its own extras.

So it all depends, chromium based browsers are all blink engine based browsers, which are pretty related to webkit engine based browsers (midori is not the only one BTW). As well as there are a ton of blink based utilities such the electron ones (chromium in disguise), there are still quite a bit based on webkit, specially gtk applications.

gecko as opposed to the other major web engines never had some sort of toolkit that would make it easier for other applications than the mozilla ones to be based on it, and it seems there will never be such toolkit, even less with the dominance of blink based browsers and applications, and in a lesser way but still high use webkit applications and browsers.

If looking for actual alternatives to what dominates the market, I believe gecko is the option at the moment, and if the FF defaults are unsane, I’d strongly suggest using Librewolf, which is essence is FF with much better defaults, it partially uses arkenfox configs, but it’s independent and has its own decisions, and also removes very few blobs like pocket at build time.

Eventually servo might become the web engine to look for, and perhaps verso the web browser based on servo. But they are still in early stages as to be considered for day to day regular use. I’m not sure if servo is both a web engine and also offers itself as a toolkit so other applications besides a web browser can be based on it, similar to webkit or blink, but I believe that’s not the case, at least not yet, though I wouldn’t put my hands on fire for this, :).

Bottom line, you might want to take a look at Librewolf.

Unfortunately divestOS is retiring, and Mull, something like Librewolf but for AOSP based devices, has ceased development. I’m really hoping someone capable of forking it does it…


Totally unrelated, mull is pretty cool in the sense that it brings arkenfox configs for the user, and it strips some binary blobs. To me the AOSP privacy browser with no actual alternative. Some say it’s like librewolf for AOSP.

Bottom line, no, totally different things.



DivestOS ends development
This is so so sad, :( I've been using Mull for quite some time and recently Hypatia. I guess time to move to [fennec](https://f-droid.org/en/packages/org.mozilla.fennec_fdroid) since I doubt there's a fork in the horizon, :(
fedilink

They don’t, I mean registering your username/basename is not a requirement, they chose the registration as the default to make it easier to be found. But you can get away with not registering your username/basename and instead exchange with your contacts you ID number, and with that besides able to choose whatever username/basename, there’s no central directory to find you, which is good depending on your use case, but the Jami guys are right to say that makes it virtually impossible for others to find you and establish a conversation unless you exchanged somehow your ID numbers, but that’s not actually finding, :)

That option is a one time choosing, when creating the account though.


It is open source, which is good, but ultimately it depends on the service provider as usual, what it logs and for how long. The good thing, is that by design there’s not much which can be collected.

But for a mechanism that is supposed p2p distributed, unified push, their proxy stuff (which also helps reduce battery usage), make the app not such p2p, but the gain in battery life might be your priority. DHT is as well a point of gathering several connections, and also to collect metadata, but to be honest, DHT is so good for this purpose, that I don’t complain.

The thing is that on the phone by default you don’t get a pure p2p experience, which is BTW really hard, as requiring both ends being present if pure p2p, and it’s really hard to actually contact the other end at any time. Although if wanted, jami can be configured as such, except by the DHT part I believe.


wow:

We use specifically crafted messages that trigger delivery receipts allowing any user to be pinged without their knowledge or consent

That makes think that 1st, perhaps it would be a good idea to avoid “return receipts” on any messenger, though that breaks ability to know if the destination has actually received, and if the destination has actually read the message.

Perhaps another thing, even though your messenger doesn’t identify users with phone numbers at all, still block the messenger to have access to your contact list. Not sure if this affects, for example if a xmpp client has access to a broader contact list, if it can only relate to xmpp addresses it wouldn’t pay attention to phone numbers, but I can’t really tell.

And of course, don’t use any messenger which tights users with phone numbers, no matter if to share among contacts now usernames are used instead of the phone number, when the phone number is still the way to identify the user.


True, but not entirely, signature spoofing needs OS support, and LOS and divestOS don’t, whereas murenaOS (/e/OS) and lineageOS for microG do. Other than that microG’s own f-droid repo makes it easy to keep microG’s component up to date.

That’s why I mentioned it would be nice to upstream divestOS bootloader lock/unlock at will solution, so that not just LOS, but derivative ROMs can inherit that solution. As some people don’t like the tight integration from murena (/e/) with all of its rebranding, LOS for microG is a very appealing option, if wanting full microG’s support. Actually LOS for microG was there quite before /e/ was created.


That’s great if not having to use any proprietary apps depending on google services, including push notifications, since part of divestos unsupported stuff includes:

Google Apps or microG or Sandboxed Play Services are NOT supported.

Which is fine, if you don’t need to use such apps. An alternative to /e/os, which now a days is actually murenaOS, is lineageOS for micro G, which does sort of monthly releases based on whatever is available as nightly releases on lineageOS. It does provide you with microG and also with F-Droid with privileged extensions installed and already set for you. This might be more suitable than divestos if in need for some such apps.


Yup, divestOS allows for booloader lock though unfortunately they don’t support microG. I hope they somehow help upstream their relock solution to LOS. I use LOS for microG instead, since I need stupid bank apps and also for the office some stupid proprietary multi factor authentication apps… If only LOS for microG could lock the bootloader at will (it needs to be unlocked for major upgrades, like on regular LOS), that’d be great.

There’s as well CalyxOS, which uses microG and also locks the bootloader, however I do prefer LOS since the strategy from CalyxOS and GrapheneOS trying to deGoogle pure Android in my mind sound like having some limitations, as opposed to LOS approach to be based on AOSP instead. Though that’s just in my mind, I’m sure those guys in Calyx and Graphene are the best at security and privacy.


Just so you know you can get push notifications on Jami. Jami has been supporting unified push notification for a while now, but it’s opt-in, some might not opt for it considering reducing privacy a bit, as some actually disable the proxy and some phone specific feature intending to prevent battery exhausting too fast.

For unified push support you can take a look at jami’s article about its unified push support. I use ntfy BTW.


Perhaps a misinterpretation from mojeek’s wiki:

Mojeek also displays significantly more individual entries in its search results than Google or Bing


Are you sure the phone it doesn’t work on is older than android 7? According to its f-droid jami URL its latest version as well as two more also documented there, they all work on android 7 or later.

I use LOS4uG, and I’m currently on android 14, so no need to build jami myself. Can you enable “unstable updates” on f-droid’s “expert mode”? Perhaps then you get latest app, and that one works better. Otherwise you can report an issue to the android client, and perhaps you get guidance from them. You can also use their forum to ask questions. I have filed issues only so far.


anonymous blog preserving author identifier digital signature or similar
Hello ! I'm wondering if there's some blogging mechanism which would allow some sort of unique digital signature (PGP perhaps) to prevent personification, but which allows non traceable and fully anonymous author. Not looking for blockchain like stuff (apart from the layer Monero adds, blockchains are totally transparent, traceable and non anonymous). Not looking for bigotry, attacking people or anything like that. The idea is to be able to share ideas, even corporate related, without being afraid of retaliations whether at work, corporations or governments. Expressing something at pubic might bring unexpected consequences, particularly if not aligned by the corporation one works on if that's the case, or might provoke AI, bots, or paid/unpaid people looking around, to include anyone in a particular list, without even warning the writer about it. So I was looking if such thing is possible, and if it exists. Social networks of course wouldn't be an option, they're not anonymous, and at contrary can be used to cross-reference and trace people. If such solution doesn't exist, I'm wondering if something based on gnuNet might get close, although gnuNet is not meant to make users anonymous. Or perhaps something based on i2p. Of course the digital signature should be used exclusively for the blog posting, and can't be associated to any real email, host, or whatever... Feedback on the blog posts should also be allowed to anonymous people with their own unique digital signatures. But this is harder, since depending on the technology, not sure if moderation would be allowed, or even if it would make sense, in which case, no blog feedback should be allowed, though no feedback is really a down side for blog posts. Maybe allowing just the original post to remove feedback. Some other down side, but that's unavoidable, is the lack of non on thread feedback, meaning giving feedback through email or any other medium, since if that was available would make the writer non anonymous... If such thing is not available, and eventually based on something like gnuNet or i2p, most probably clients would be needed to write blogs but another one that would offer some sort of RSS/atom functionality for the blog to be accessible from current RSS/atom readers.
fedilink

xmpp android app with omemo and unified push notifications support
cross-posted from: https://lemmy.ml/post/12692350 > Anyone aware of a conversations fork with support for unified push notifications? Or a similar xmpp android app with omemo (just the same as conversations' support) and unified push notifications support, available through the official f-droid repor or a f-droid repo if not available from the official ones? > > BTW, I noticed [!xmpp@lemmy.ml](https://lemmy.ml/c/xmpp) community was locked. Any particular reason for that? Also, Converstions requests to set unrestricted use of battery, to use battery under background without restrictions. So it seems unified push notifications would help, though this [github issue](https://github.com/iNPUTmice/Conversations/issues/4014#issuecomment-783151358) sort of indicates unified push notifications wouldn't help, so it just tells me there's no intention to include support for it on Conversations, but not that it wouldn't help save battery.
fedilink

Are libreddit frontends for reddit already non functional?
I started some time ago using a teddit frontend with local subscriptions, and at some point it was hard for the one I picked to keep up, then I moved to libreddit, at that time libredd.it, then it stopped working and moved to libreddit.spike.codes, but it seems it stopped working as well, and finally I moved to libreddit .mha.fi, but some time back there was too much rate limiting, making it unusable, and since yesterday it seems totally down, giving the error "502 Bad Gateway". I also have the libRedirect extension on Librewolf configure to choose among several libreddit instances (so when searching for something any is picked), and most of them seem out of service, or being rate limited as well. So, are frontends for reddit finally coming to an end? Edit: Indeed, it seems at least non self-hosted front-end instances are way rate limited or down
fedilink

comments on [r/privacy](https://libreddit.mha.fi/r/privacy/comments/15mk8kl/zoom_wont_use_your_calls_to_train_ai_without)
fedilink

also on [r/privacy](https://libreddit.mha.fi/r/privacy/comments/158xbsc/googles_nightmare_web_integrity_api_wants_a_drm)
fedilink

[r/privacy](https://libreddit.mha.fi/r/privacy/comments/14e3vbf/google_making_it_difficult_for_custom_rom_by/)
fedilink


cross-posted from: https://midwest.social/post/651490 also on [r/privacy](https://libreddit.mha.fi/r/privacy/comments/1494tjp/an_antiporn_app_put_him_in_jail_and_his_family) > A court used an app called Covenant Eyes to surveil the family of an Indiana man released on bond. Now he’s back in jail, and tech misuse may be to blame. The app flagged one of the family's devices as having accessed Pornhub even though it didn't, and this was the only evidence used to throw the man back in jail. They didn't even try to prove he was the one who caused the app to flag Pornhub as visited, they just assumed it was him. The article contains multiple levels of "oh my god our system is messed up."
fedilink

on [r/privacy](https://libreddit.mha.fi/r/privacy/comments/140kj7i/to_save_the_news_we_must_ban_surveillance)
fedilink

[r/privacy](https://libreddit.mha.fi/r/privacy/comments/13ut832/private_spies_hired_by_the_fbi_and_corporate)
fedilink

is searx having problems (no matter the instance)?
I've been having errors like: ``` Error! Engines cannot retrieve results. qwant (unexpected crash) Please, try again later or find another searx instance. (Public instances) ``` Or: ``` Error! Engines cannot retrieve results. brave (HTTP error) Please, try again later or find another searx instance. (Public instances) ``` On both: https://searx.sp-codes.de/search https://searx.info/search Not sure if it's google blocking searx, or similar... Edit: https://searx.sp-codes.de working right now, as well as some other instances... Thanks !
fedilink

All SMS will now be Intercepted, Screened in Malaysia
[r/privacy](https://libreddit.mha.fi/r/privacy/comments/135lg3r/all_sms_will_now_be_intercepted_screened_in)
fedilink

[r/PrivacyGuides](https://libreddit.mha.fi/r/PrivacyGuides/comments/12yozlh/microsoft_edge_is_leaking_the_sites_you_visit_to)
fedilink

cross-posted from: https://lemmy.ml/post/963701 > Not sure how that will affect libreddit or teddit. That'd would prevent me to get some news on specific channels, which when interesting enough, I brought to lemmy, :) > > [Reddit Wants to Get Paid for Helping to Teach Big A.I. Systems](https://web.archive.org/web/20230418182954/https://nytimes.com/2023/04/18/technology/reddit-ai-openai-google.html) > > [r/technology](https://libreddit.mha.fi/r/technology/comments/12r1lh1/reddit_will_begin_charging_for_access_to_its_api) > > [r/programming](https://libreddit.mha.fi/r/programming/comments/12r0xyz/reddit_will_begin_charging_for_access_to_its_api/) > > [r/privacy](https://libreddit.mha.fi/r/privacy/comments/12r1tjk/reddit_to_start_charging_for_api_access_so_ai)
fedilink

According to [libreddit](https://github.com/libreddit/libreddit): > Official instance (libreddit.spike.codes) > > The official instance is hosted at https://libreddit.spike.codes. And it's also still listed on [libreddit-instances](https://github.com/libreddit/libreddit-instances/blob/master/instances.md) But Today it hadn't worked for me at all.
fedilink

cross-posted from: https://lemmy.ml/post/823051 > [r/Futurology](https://libreddit.spike.codes/r/Futurology/comments/11kywcq/a_group_of_researchers_has_achieved_a)
fedilink