mastodon - Link to source

Signal is a secure messenger, but there are interesting alternatives, such as @matrix , @session , @delta , @simplex or XMPP …

➡️ matrix.org

➡️ getsession.org

➡️ delta.chat

➡️ simplex.chat

➡️ xmpp.org

If you’d like to learn more about these options, have a look at the responses to this toot.

#matrix #session #signal #XMPP #messenger #decentralized #tech #technology #OpenSource #FOSS #WhatsApp #security #InfoSec #data #safety


Session | Send Messages, Not Metadata. | Private Messenger

Session is a private messenger that aims to remove any chance of metadata collection by routing all messages through an onion routing network.
Session
#xmpp #foss #matrix #opensource #infosec #signal #whatsapp #technology #security #messenger #decentralized #tech #data #session #Safety @The Matrix.org Foundation @Delta Chat (39c3) @Session @SimpleX Chat
This entry was edited (11 months ago)

mastodon - Link to source

Lest we forget the lessons of the XZ Utils backdoor, which was nearly a year ago now, I'll repost @ariadne's post about what we can learn from it: ariadne.space/2024/04/02/the-x…

I was thinking about this today because I happened to look at the transitive dependencies of a program that uses libxml2, and noticed that Debian's build of libxml2 depends on liblzma (the library in XZ Utils where the backdoor was inserted).

The XZ Utils backdoor is a symptom of a larger problem

On March 29th, Andres Freund dropped a bombshell on the oss-security mailing list: recent XZ Utils source code tarball releases made by Jia Tan were released with a backdoor.
ariadne.space
@Ariadne Conill 🐰
in reply to Matt Campbell

mastodon - Link to source

Matt Campbell

Then again, if a library is built with all unnecessary features and transitive dependencies eliminated, then depending on the library and the transitive dependencies, perhaps a lot of security updates become irrelevant.

Thinking about all this as I consider whether to build ffmpeg from source with minimal features. Perhaps ffmpeg is one of the worst offenders when it comes to "junk drawer" libraries as discussed in the article.

in reply to Josh Simmons

mastodon - Link to source

Matt Campbell

@dotstdy True. Still, the fact that a typical distro build of ffmpeg has lots of dependencies linked as shared libraries, even though one typically uses very few of them, means that someone could repeat an XZ-style attack via any one of them. If we don't at least modify our processes to avoid a repeat of the same kind of attack, then we've learned nothing.
@Josh Simmons
in reply to Matt Campbell

mastodon - Link to source

Glyph

@dotstdy I think ffmpeg lives in a different part of the ecosystem than openssh; specifically, the part where the code is big and complicated enough that you ought to be leaning hard into sandboxing and privilege reduction to limit its blast radius rather than trying to reduce its binary footprint (because even in the best possible case, the binary footprint is going to be huge, as josh points out)
@Josh Simmons
in reply to Matt Campbell

mastodon - Link to source

Josh Simmons

"one typically uses very few of them" isn't really true though, you'll use different codecs for different media, and fundamentally that requires a wide range of support libraries. furthermore, the xz backdoor was interesting due to *which* process it injected into - the openssh daemon. unless you start linking ffmpeg into openssh you don't have anything close to the same threat model.
in reply to Matt Campbell

mastodon - Link to source

Ariadne Conill 🐰

if that is your takeaway i think you missed the point.

the point is that application authors shouldn’t pull in junk drawer libraries for a few convenience functions, not that we should build multiple copies of the same library to support different apps.

or more directly to the point, the person who originated the patch all the linux distributions were using to integrate systemd’s readiness notifications and openssh should have just included a reimplementation of sd_notify(), which is a fairly trivial function to write.

in reply to Matt Campbell

mastodon - Link to source

equi

(self-plug:) here's how removing a junk drawer libraries looks like: github.com/FRRouting/frr/pull/…

I also think we should maybe move the "modularize and use dlopen() a bit more" slider a bit further out; and maybe there's room there for DX improvement as well (dlopen/dlsym are… clunky…). If the decision to include features can be made by installing packages, Debian doesn't _need_ to do "just the features required", it's the end user doing that with more and smaller packages.


remove libsystemd-dev external dependency & --enable-systemd switch by eqvinox · Pull Request #8508 · FRRouting/frr

Turns out the amount of code from libsystemd that is relevant to us is... almost nonexisting. To the point of it being simpler to just open-code our own notification function & looking at env...
GitHub
in reply to Matt Campbell

mastodon - Link to source

TheConstructor (he/him)

I like Gentoo for the fact, that you can decide if you want certain features, and can there by decide against certain dependencies. It's not perfect or complete, but it can remove the burden of updating everything by hand, and minimises the number of library copies. Not sure this will help you right now, but if you want to try something later, it may be interesting

mastodon - Link to source
Arrow Lake's had three months of Windows and BIOS updates to fix its performance, and my testing shows in some games, it's worse
pcgamer.com/hardware/processor…

Arrow Lake's had three months of Windows and BIOS updates to fix its performance, and my testing shows in some games, it's worse

I thought fixes were supposed to improve things.
Nick Evanson (PC Gamer)
This entry was edited (11 months ago)

mastodon - Link to source

In a community assembly, the Indigenous Ayuujk residents of Mogoñe Viejo, Oaxaca, decided to rebuild a resistance encampment on the path of the neoliberal Interoceanic Corridor megaproject in the northern part of the Isthmus of Tehuantepec.

avispa.org/pueblos-indigenas-d…

#Mexico #Oaxaca #Indigenous


Pueblos indígenas deciden retomar campamento contra Corredor Interoceánico; autoridades intensifican persecución - Avispa Midia

Existen procesos penales contra 24 personas defensoras del territorio quienes denuncian afectaciones por las obras del Corredor Interoceánico
Aldo Santiago (Avispa Midia)
#indigenous #méxico #oaxaca

pixelfed - Link to source

On Wednesday night I managed to capture Comet 2024 G3 ATLAS again

jamesbarfoote.co.nz/blog/captu…

#comet #space #g3atlas #g3comet #astronomy #landscape #newzealand #nz #aotearoa #newzealandphotography #wellingtonnz #wellington #astrophotography

Capturing a Comet

I set out to capture an image of the 2024 G3 ATLAS comet. It was an amazing experience seeing it with my own eyes. Capturing a Comet is not something that I've done before so I wanted to share my experience and what I learned along the way
James Barfoote
#astronomy #space #astrophotography #landscape #newzealand #nz #aotearoa #comet #wellington #wellingtonnz #newzealandphotography #g3atlas #g3comet

mastodon - Link to source

Happy 7th anniversary of becoming an official W3C standard, ActivityPub!

w3.org/news/2018/activitypub-i…

We're creating something truly special here with the fediverse, and I am so thankful for everyone who contributes to it, whether with your time, money, or just by sharing your thoughts, your creations, your silly little jokes. Keep it up!

#fediverse #activitypub #standards #OpenWeb #anniversary


ActivityPub is now a W3C Recommendation

The World Wide Web Consortium (W3C) is an international community where Member organizations, a full-time staff, and the public work together to develop Web standards.
W3C
#activitypub #fediverse #standards #openweb #anniversary

mastodon - Link to source
The Proliferation of Frivolous ADA Website Compliance Lawsuits: A Defense Perspective
lexology.com/library/detail.as…

The Proliferation of Frivolous ADA Website Compliance Lawsuits: A Defense Perspective

In recent years, an alarming trend has emerged in the legal landscape: the filing of mass lawsuits alleging violations of the Americans with…
Katie Fillmore (Michael Best & Friedrich LLP)

mastodon - Link to source
Report: Microsoft to Launch Smaller Surface Pro and Laptop Models With Snapdragon Chips this Spring thurrott.com/mobile/316214/rep…

Report: Microsoft to Launch Smaller Surface Pro and Laptop Models With Snapdragon Chips this Spring

Microsoft may be getting ready to launch smaller Qualcomm-powered versions of its most popular Surface devices, the Surface Pro and Surface Laptop.
Laurent Giret (Thurrott.com)

mastodon - Link to source

Najväčšou hrozbou pre #Slovensko je Robert #Fico

V jeho príbehu je logická diera. Nedokáže vysvetliť, v čom sú demonštrácie proti nášmu ústavnému zriadeniu, keď na nich ľudia žiadajú, aby sme neodchádzali z Európskej únie a NATO, aby sme nepodporovali vojnových zločincov.

Premiér, prezident aj vedenie parlamentu hovoria, že na Slovensku je ohrozená demokracia a republike hrozí prevrat. Snažia sa vyvolať zdanie, že je to vážne a že majú dôkazy. Akurát ich nechcú ukázať.

dennikn.sk/4425058/najvacsou-h…


Najväčšou hrozbou pre Slovensko je Robert Fico

Matúš Kostolný (Denník N)
#slovensko #fico
in reply to Peter Hanecak

mastodon - Link to source

Ľuboš Moščovič

Tieto ich dnešné výpoty stačí interpretovať oveľa jednoduchšie. Pripusťme, že majú úplnú pravdu. Ale ak by ju mali, tak sa dá veľmi ľahko a logicky predpokladať, že práve teraz OČTK a kľudne aj NAKA (či ako to teraz premenovali) vykopáva dvere súbežne na viacerých miestach, robí prehliadky a zatýkačky.
Pretože to by v prípade, že nekecajú, muselo nastať, ináč by tie ich včerajšie a dnešné tančeky značne komplikovali, ba až ohrozovali prácu zodpovedných orgánov.

No a keďže zatiaľ takú správu nikde nevidím, tak jediný logický uzáver je, že sú to iba politické blúznenia a priznanie sa k zneužívaniu SIS na politické manipulácie.

mastodon - Link to source

🇬🇧 After running #IzzyOnDroid on my own for over 10 years, we became a small team over a year ago. All done in our spare time, no grants.

That finally changed this week.

We're excited that we're one of seven projects being accepted for the NGI #Mobifree grant! 🥳

Finally we will be able to focus on some more things on our wish list that we've wanted to do for the community for a long time. Stay tuned, we'll update you with details later!

nlnet.nl/project/IzzyOnDroid/

NLnet; IzzyOnDroid

nlnet.nl
#izzyondroid #mobifree

hometown - Link to source

A hacker developed an "infinite maze" to trap web-crawlers/scrapers from AI companies

basically, if the server code detects that a web crawler from an AI firm is trying to scrape the site ...

... the code begins spinning up an infinite, nesting warren of new sham pages, filled with random text

so the crawler gets stuck crawling and scraping endless and meaningless pages

404media.co/email/7a39d947-4a4…


Developer Creates Infinite Maze That Traps AI Training Bots

"Nepenthes generates random links that always point back to itself - the crawler downloads those new links. Nepenthes happily just returns more and more lists of links pointing back to itself."
Jason Koebler (404 Media)

mastodon - Link to source

We're hiring a Senior Software Engineer on the @securedrop team at @freedomofpress.

SecureDrop is open source whistleblowing software. The project is at a critical inflection point as we get ready to build the next-gen version based on a modern cryptographic protocol.

100% remote, full-time, $110-$120K base salary with comprehensive benefits for US-based employees. (If you're not in the US, we can discuss consultancy models.)

Hmu for questions.

grnh.se/813b998c5us

#GetFediHired


Job Description

Defending press freedom for the next generation
Freedom of the Press
#getfedihired @Freedom of the Press @SecureDrop

mastodon - Link to source
We are looking for speakers interested in talking about gaming, cell phone app, a better design experience for apps, and advances in apps. #LAS2025 Call for Proposals is now open! Submit your talk proposal by February 15 at linuxappsummit.org/cfp/ and inspire the Linux app community.
Linux App Summit

Call for proposals

The Linux App Summit (LAS) is designed to accelerate the growth of the Linux application ecosystem by bringing together everyone involved in creating a great Linux application user experience.
linuxappsummit.org
#las2025
This entry was edited (11 months ago)

mastodon - Link to source
Love this piece from @teenvogue.bsky.social on how gender has varied around the world, across time. LOADS of cultures recognize more than two genders. teenvogue.com/story/gender-var…

Gender Variance Around the World Over Time

Learn more about how gender variance has existed among people in different communities around the world throughout history.
Lucy Diavolo (Teen Vogue)

mastodon - Link to source

There may not be much good news around at the moment, so let's make sure we celebrate it when we see it.

Today is a great day for LGBT folk in Thailand. Really happy for all those who have finally been allowed to get married today.

bbc.co.uk/news/articles/cge7g9…

#Thailand #EqualMarriage #GoodNews


Thailand: Couples wed in a riot of colour as same-sex marriage becomes legal

LGBT couples now have the same rights as any other couple - the culmination of a decades-long campaign.
Jonathan Head, Thanyarat Doksone and Panisa Aemocha (BBC News)
#goodnews #Thailand #equalmarriage

mastodon - Link to source

@Tutanota es un servicio de correo, calendario y contactos con #seguridad postcuántica y de vanguardia en #privacidad para proteger tus comunicaciones en línea.

En este artículo conocerás por qué es la alternativa a Gmail que necesitas.

zcashesp.com/tuta-correo-calen…


Tuta: correo, calendario y contactos privados en tu bolsillo - Zcash en Español

Tuta es un servicio de correo, calendario y contactos privado y seguro en la era del capitalismo de vigilancia.
Yoditar (Zcash en Español)
#privacidad #seguridad @Tuta

mastodon - Link to source

Beyond the Rollback: Why Disability Inclusion Will Survive the End of DEI Programs | Aaron Di Blasi | AT-Newswire.com
at-newswire.com/how-disability…

Despite the rollback of DEI programs, disability inclusion remains essential. Discover how legal protections, market demand, and technological advancements will sustain accessibility in business and beyond.

A close-up photograph of multiple hands stacked together in a gesture of unity and teamwork. The hands belong to a diverse group of individuals, showcasing different skin tones, textures, and some adorned with tattoos. The background is blurred, with hints of casual and business attire visible, suggesting a professional or collaborative setting. The image conveys a strong sense of solidarity, cooperation, and mutual support.

Beyond the Rollback: Why Disability Inclusion Will Survive the End of DEI Programs - AT-Newswire

Aaron Di Blasi (AT-Newswire)

mastodon - Link to source
Google's blog post about TalkBack and the latest Android accessibility enhancements: First coming to Samsung Galaxy S25 series, the Braille HID standard will be supported. This will work on any phone or tablet using Android 15 in the near future. TalkBack will also provide more detailed image descriptions, powered by Gemini models, on Galaxy S25 devices in the coming weeks.
blog.google/feed/samsung-unpac…

Android is introducing a better hearing aid and screenreader experience.

Today we’re rolling out a handful of updates to make Android’s hearing aid and screenreader experiences even more accessible.
Angana Ghosh (Google)

Tamas G reshared this.

mastodon - Link to source
Spectrum Launches $15 a Month Internet Plan to Comply with New State Law cordcuttersnews.com/spectrum-l…

Spectrum Launches $15 a Month Internet Plan to Comply with New State Law | Cord Cutters News

Spectrum Cable has quietly introduced a $15 monthly internet service plan in New York State to meet the requirements of a new law aimed at providing lower-income residents with affordable broadband access.
Luke Bouma (Cord Cutters News)
⇧