mastodon - Link to source

Already so many great posts on this year's #HTMHell advent calendar... Discover Dialog by @sarajw
htmhell.dev/adventcalendar/202…

Words from the Accessibility Freedom Beaver @SteveFaulkner
htmhell.dev/adventcalendar/202…

Hell is Other People's Markup by @lloydi
htmhell.dev/adventcalendar/202…

The Wonderful World of Web Feeds by @maureenholland:
htmhell.dev/adventcalendar/202…


a11y freedom beaver - HTMHell

A collection of bad practices in HTML, copied from real websites.
a11y freedom beaver - HTMHell
#htmhell @Steve Faulkner @lloydi @Sara Joy @Maureen Holland

mastodon - Link to source

I watched Prime Video for the first time in a while (to watch Gen V, season 2) and... Fucking Prime now has commercials, not before before the show, as I was expecting, but in the middle of the shows!

Those streaming platforms are forgetting that we signed up for them because they're only slightly more convenient than pirating platforms... Well, if they play ads, that convenience is gone and so is my subscription.

#FuckAmazon #PrimeVideo #Streaming

#streaming #fuckamazon #primevideo

mastodon - Link to source
I've been playing with Orpheus TTS (not the old screen reader synthesizer, a new one that claims to be natural). It's not for real-time use, but rather, you give it a chunk of text and it gives you a .wav file. It runs locally. It sounds okay, but Tara, the default voice, has what almost sounds like room noise. It's very odd. If you try it, remove wave>=0.0.2 from requirements.txt or you might get installation errors. github.com/isaiahbjork/orpheus…

GitHub - isaiahbjork/orpheus-tts-local: Run Orpheus 3B Locally With LM Studio

Run Orpheus 3B Locally With LM Studio. Contribute to isaiahbjork/orpheus-tts-local development by creating an account on GitHub.
GitHub

mastodon - Link to source

Our @panoramax -server is back online!

In other word, looking at our images and uploading new images is possible again.

Did you try to upload an image yesterday? Open the MapComplete website or app again, MapComplete will try to upload again without losing your image.

You can also see the 'image upload queue' in the menu; in case you'd want to abort uploading an image.

A big thanks to @thibaultmol for hosting our server and to the @panoramax for the assistance!

@Thibaultmol 🌈 @Panoramax

Pietervdvn reshared this.

lemmy - Link to source

GrapheneOS version 2025121200 released

Tags:

  • 2025121200 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)

Changes since the 2025121000 release:

  • disable notification summaries and organizer features due to AOSP and GrapheneOS lacking the AI models used to implement these features
  • add workaround for notification background appearance regression in Android 16 QPR2
  • Vanadium: update to version 143.0.7499.109.0
  • GmsCompatConfig: update to version 167

All of the Android 16 security patches from the current January 2026, February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2025121201 security preview release. List of additional fixed CVEs:

  • High: CVE-2025-32348, CVE-2025-48641, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018

2025121201 provides at least the full 2026-01-01 Android and Pixel security patch level but will remain marked as providing 2025-12-05.

For detailed information on security preview releases, see our post about it.


GrapheneOS security preview releases - GrapheneOS Discussion Forum

GrapheneOS discussion forum
GrapheneOS Discussion Forum
#grapheneos

lemmy - Link to source

Second New IPv4 /24 Subnet Received

We've received a 2nd IPv4 /24 subnet from ARIN for our 2nd anycast DNS network. Both our /24 subnets were obtained quickly under the NRPM 4.10 policy for IPv6 deployment for our dual stack DNS use case. 2nd was obtained without waiting 6 months due to being a discrete network.

We host our own authoritative DNS servers to provide DNS resolution for our services. Authoritative DNS are the servers queried by DNS resolvers run by your ISP, VPN or an explicitly user chosen one such as Cloudflare or Quad9 DNS. We now have our own AS and IP space for this.

Our ns1 has 11 locations on Vultr: New York City, Miami, Los Angeles, Seattle, London, Frankfurt, Singapore, Mumbai, Tokyo, Sao Paulo and Sydney.

Our ns2 has 4 locations on BuyVM: New York City, Miami, Las Vegas and Bern. We'll be adding a 2nd server provider for more locations.

DNS resolvers quickly fall back to the other network if traffic is dropped. Having two discrete networks with separate hosting companies and transit providers provides very high reliability. Individual servers which go down also stop having traffic routed to them due to BGP.

We have tiny website/network servers and also powerful update mirrors around the world. Our DNS servers use a combination of a GeoIP database and their own location to route users to the closest server that's up. Frequent health checks and low expiry time handle server downtime.

GrapheneOS (@GrapheneOS@grapheneos.social)

GrapheneOS (GrapheneOS Mastodon)
#grapheneos

lemmy - Link to source

GmsCompatConfig version 167 released

Changes in version 167:

  • add stub for BluetoothA2dp.setConnectionPolicy() to fix a crash with a new version of Android Auto

A full list of changes from the previous release (version 166) is available through the Git commit log between the releases (only changes to the gmscompat_config text file and config-holder/ directory are part of GmsCompatConfig).

GmsCompatConfig is the text-based configuration for the GrapheneOS sandboxed Google Play compatibility layer. It provides a large portion of the compatibility shims.

This update is available to GrapheneOS users via our app repository and will also be bundled into the next OS release.


Comparing config-166...config-167 · GrapheneOS/platform_packages_apps_GmsCompat

Contribute to GrapheneOS/platform_packages_apps_GmsCompat development by creating an account on GitHub.
GitHub
#grapheneos

lemmy - Link to source

Vanadium version 143.0.7499.109.0 released

Changes in version 143.0.7499.109.0:

  • update to Chromium 143.0.7499.109

A full list of changes from the previous release (version 143.0.7499.52.0) is available through the Git commit log between the releases.

This update is available to GrapheneOS users via our app repository and will also be bundled into the next OS release. Vanadium isn't yet officially available for users outside GrapheneOS, although we plan to do that eventually. It won't be able to provide the WebView outside GrapheneOS and will have missing hardening and other features.


Comparing 143.0.7499.52.0...143.0.7499.109.0 · GrapheneOS/Vanadium

Privacy and security enhanced releases of Chromium for GrapheneOS. Vanadium provides the WebView and standard user-facing browser on GrapheneOS. It depends on hardening in other GrapheneOS reposito...
GitHub
#grapheneos

lemmy - Link to source

GrapheneOS Foundation Responds To Jolla

Jolla has spent years disparaging projects based on the Android Open Source Project (AOSP) for marketing. SailfishOS has a largely closed source user interface and application layer with no equivalent to the open source AOSP. It's far less private and secure than AOSP or iOS too.

Jolla recently launched a new product so their supporters are understandably trying to promote it. As part of that, they've been posting about it in replies to posts about GrapheneOS. We've replied to some of it with our perspective within threads originally about GrapheneOS.

Since we dared to post accurate information in threads about GrapheneOS where they mentioned us in replies to promote it, their forum is being used as a place to attack GrapheneOS including libelous attacks towards our team referencing harassment content:

forum.sailfishos.org/t/sailfis…

Several of their supporters are taking the usual approach of calling us crazy and delusional while referencing harassment content at the same time as calling the factual info we posted aggressive. They're brigading discussions about GrapheneOS with attacks so we made this thread.

Brigading threads about an open source project and attacking the team with libelous claims is toxic. Defending ourselves from it with factual statements is not toxic. Repeating dishonest attacks on our team based on similar attacks over and over doesn't make it any less untrue.


Sailfish OS: Clarifying claims about open/closed source, security and privacy

Actually Jolla say that “Sailfish OS is partially open source, but not fully open source in the sense of “every part of the OS is free/open-source.
Sailfish OS Forum
#grapheneos
in reply to Václav Pašek

mastodon - Link to source

Archos

Mně se povedlo dostat skoro celou rodinu na MXChat (Matrix) a WhatsApp mám už jen kvůli práci – máme ho přemostěný do Matrixu, takže mi všechny zprávy chodí tam.

Volání přes most nejde, ale aspoň mi přijde notifikace, že někdo volal → pak buď otevřu WhatsApp a zavolám zpět, nebo zavolám normálně.

Jediná nevýhoda: WhatsApp stejně musí být v telefonu. Most totiž používá webové rozhraní (WhatsApp Web / linked device), takže telefon musí být připojený k internetu, aby to fungovalo. WhatsApp appka nemusí být pořád otevřená – stačí ji jen občas spustit.

sharkey - Link to source

Extrem rechte Akteure und Organisationen verdrehen und missbrauchen #christliche #Narrative und versuchen ihren Einfluss auf die konfessionelle #Christenheit auszuweiten.

Eine wichtige #Doku von #Monitor:

wdrvod-rwrtr.akamaized.net/i/,…
#ZurFeierDesSonntags #FediKirche #ChristUndPolitik #Kirche

#monitor #fedikirche #doku #kirche #zurfeierdessonntags #christliche #narrative #christenheit #christundpolitik

mastodon - Link to source

I can’t even…

#RFKJr Blames Pills — Not #Guns — for #SchoolShootings

There is NO credible evidence that #antidepressants cause violence, but Kennedy now vows a “massive” effort to prove the failed theory.

#policy #law #Trump #ConspiracyTheories #disinformation #ChildEndangerment #PublicHealth #GunControl #GunLaws #Health #MentalHealth #science #medicine #USpol #SchoolShooting #MassShooting #GunViolence #EnoughIsEnough
motherjones.com/politics/2025/…


RFK Jr. blames pills—not guns—for school shootings

There is no credible evidence that antidepressants cause violence, but the health secretary now vows a “massive” effort to prove the failed theory.
Mother Jones
#Trump #law #disinformation #health #science #uspol #MentalHealth #policy #publichealth #guns #medicine #conspiracytheories #enoughisenough #rfkjr #schoolshootings #antidepressants #childendangerment #guncontrol #gunlaws #schoolshooting #massshooting #gunviolence
in reply to miki

mastodon - Link to source

miki

With that said, guns are a *necessary first step* that makes mass shootings possible, but there's more to them than just access to guns.

Whatever the trend is, even Europe isn't fully immune from it either, see e.g. the attacks in Berlin a few years ago where a person drove a truck into a large crowd of pedestrians. The tool is different, the effect is similar.

mastodon - Link to source

Does anyone have these things that they love and would recommend:

- Bluetooth speaker (portable)
Not smart. I don't need to ask it anything. Just something I can connect to that will make good music sounds in my house.

- CD player
Something modern that connects to the computer so again I can throw it out to speakers. Or something that connects direct to speakers?
But being able to rip CDs like the olden days would also be good.

Ta!
#recommendations #music #cd #speaker #elextronics #gadgets

#music #cd #gadgets #speaker #recommendations #elextronics
This entry was edited (1 week ago)

lemmy - Link to source

GrapheneOS version 2025121000 released

This is our first non-experimental release based on Android 16 QPR2 after our initial experimental 2025120800 release.

The change to the style of notification backgrounds is an upstream regression rather than an intentional change to a more minimal style. It will be fixed in a subsequent release since we decided it isn't important enough to delay this.

Tags:

  • 2025121000 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)

Changes since the 2025120400 release:

  • full 2025-12-05 security patch level
  • rebased onto BP4A.251205.006 Android Open Source Project release (Android 16 QPR2)
  • disable promotion of identity check feature not currently present in GrapheneOS due to depending on privileged Google Mobile Services integration
  • GmsCompatConfig: update to version 166

All of the Android 16 security patches from the current January 2026, February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2025121001 security preview release. List of additional fixed CVEs:

  • High: CVE-2025-32348, CVE-2025-48641, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018

2025121001 provides at least the full 2026-01-01 Android and Pixel security patch level but will remain marked as providing 2025-12-05.

For detailed information on security preview releases, see our post about it.


GrapheneOS security preview releases - GrapheneOS Discussion Forum

GrapheneOS discussion forum
GrapheneOS Discussion Forum
#grapheneos

mastodon - Link to source

Vojtux - Accessible Linux distro which is almost pure Fedora

Vojtěch Polášek has put together a technical preview of a version of Fedora that should work well for blind or visually impaired users. While his goal is explicitly to see these improvements and changes become part of Fedora itself, for now you can use this implementation based on the Fedora MATE spin. :)

➡️ freelists.org/post/orca/Announ…

#Vojtux #Fedora #Accessibility #a11y #Linux #OpenSource

[orca] Announcing Vojtux - Accessible Linux distro which is almost pure Fedora - orca - FreeLists

[orca] Announcing Vojtux - Accessible Linux distro which is almost pure Fedora, orca at FreeLists
www.freelists.org
#a11y #Accessibility #linux #opensource #fedora #vojtux

reshared this

mastodon - Link to source

RE: fosstodon.org/@arcanechat/1157…

There’s a vulnerability in Signal. You are developing an alternative. Do you:

  • A: skim read the report, see it contains the phrase ‘phone number’, and shitpost about Signal, or
  • B: Analyse the attack and see if it could be adapted to your protocol, then post about how you either were already protected or have deployed a mitigation?

If you chose option A, please don’t expect to be able to convince me that you are serious about security.

ArcaneChat

2025-12-14 09:39:00

mastodon - Link to source

"Tool allows stealthy tracking of #Signal and #WhatsApp users through delivery receipts"

cyberinsider.com/tool-allows-s…

Another privacy vulnerability caused by the dependency on phone numbers.

In #ArcaneChat (and other #chatmail clients like #DeltaChat) you don't need a phone number (or any private data at all!) to register, so such attacks are simply impossible, keep your family safe, join arcanechat.me



Tool allows stealthy tracking of Signal and WhatsApp users through delivery receipts

A new tool named Device Activity Tracker exposes a privacy flaw in WhatsApp and Signal that lets attackers covertly monitor user activity.
Alex Lekander (CyberInsider)

in reply to David Chisnall (*Now with 50% more sarcasm!*)

mastodon - Link to source

ArcaneChat

replied here fosstodon.org/@arcanechat/1157…

ArcaneChat

2025-12-14 10:17:43

mastodon - Link to source

@david_chisnall by saying "requires phone numbers" I was implying that you can discover people by phone numbers since that is the case in 99% if not 100% of all apps that offer phone number registration, that you can disable this feature is meaningless if it is opt-out and most people will leave it like that, by saying ArcaneChat is immune to this I meant because you can't discover people like that, people must get in contact directly via QR or invite link

Unknown parent

mastodon - Link to source

Zahox

Firstly the logo design of the Tuta Fanshop when you search in Google, it looks not like Tuta. I wish instead the logo from Tuta at the moment could be used for that and that the site name get's changed to something like: tutanotashop.com - because tuta is mail and tutanota is the shop. good to remember and better seperating. And only tutanotashop.com should stay, so it's not irritating to have .com and .de

And tuta.com is also the mail. So both would match better. Look my next post.

This entry was edited (1 week ago)
in reply to Zahox

mastodon - Link to source

Zahox

I found out about the Shop from your reddit post from 6 years ago about "Tutanota Fan Shop" - for me the Fan Shop here was irritating. I thought it's someone other doing it. So it would be better to take the "Fan" out of it. And I would find it helpful if we could find the Shop on tuta.com in the section below of "Blog" - more people would be interested and word of Tuta would be spread without need of recommeding.

I will tell some Feedback for the website and products in the next post

mastodon - Link to source

"Tool allows stealthy tracking of #Signal and #WhatsApp users through delivery receipts"

cyberinsider.com/tool-allows-s…

Another privacy vulnerability caused by the dependency on phone numbers.

In #ArcaneChat (and other #chatmail clients like #DeltaChat) you don't need a phone number (or any private data at all!) to register, so such attacks are simply impossible, keep your family safe, join arcanechat.me


Tool allows stealthy tracking of Signal and WhatsApp users through delivery receipts

A new tool named Device Activity Tracker exposes a privacy flaw in WhatsApp and Signal that lets attackers covertly monitor user activity.
Alex Lekander (CyberInsider)
#signal #whatsapp #deltachat #chatmail #arcanechat
in reply to ArcaneChat

mastodon - Link to source

David Chisnall (*Now with 50% more sarcasm!*)

When you post something about a vulnerability in another messenger and completely misrepresent it, in a way that implies that you don’t understand the cause of it at all, it gives me no confidence in your system.

The root cause is nothing to do with phone numbers. It depends on two things:

  • Being able to send messages to someone from some public identifier. Any messenger that doesn’t require an interactive flow for pairing devices (as some military systems do) has this feature.
  • Receiving read receipts from messages. Signal allows you to turn off read receipts if you are concerned about information leaks from them.

If you actually wanted to convince people your system was better you would:

  • Show that you don’t issue read receipts (which will put some people off because they are useful).
  • Show how you mitigate this kind of attack, by rate limiting this kind of message, adding jitter to responses, and so on.

Email-based flows tend to not be vulnerable to this kind of attack because they do most of the processing on the server, so you’d only be able to probe the server. But you wouldn’t bother because email has so little metadata protection that you don’t need to bother with an attack like this. From what I know of DeltaChat’s group chat protocol, I suspect there is a way of triggering a similar attack by sending broadcast invalid messages and timing the error response. If you really wanted to convince people that your system is better, you’d show a security analysis that explains why I’m wrong, rather than just say ‘I don’t understand this attacks but the researchers who published it didn’t bother trying to attack the protocol I use and so I’m sure it is secure!’ That is exactly the attitude to security that makes me distrust DeltaChat.

Oh and before anyone jumps in with anything about XMPP: this attack is completely trivial on XMPP. Send an invalid iq stanza to the client’s bare JID and time the response. And this is impossible to fix without redesigning the protocol because unknown iq stanzas must be forwarded to the client to enable future extension and clients must respond with errors.

in reply to David Chisnall (*Now with 50% more sarcasm!*)

mastodon - Link to source

ArcaneChat

@david_chisnall by saying "requires phone numbers" I was implying that you can discover people by phone numbers since that is the case in 99% if not 100% of all apps that offer phone number registration, that you can disable this feature is meaningless if it is opt-out and most people will leave it like that, by saying ArcaneChat is immune to this I meant because you can't discover people like that, people must get in contact directly via QR or invite link
@David Chisnall (*Now with 50% more sarcasm!*)
in reply to David Chisnall (*Now with 50% more sarcasm!*)

mastodon - Link to source

ArcaneChat

#DeltaChat is for private chatting, so you normally don't put your link anywhere publicly, you could create a dedicated profile for public interactions tho, which, unlike in signal, it is super easy to do and you can have as many as you want,

and notice the use case I am talking here is family chat, not business and public interactions, that is why I said "keep your family safe" I am talking about family chat solution here

#deltachat
This entry was edited (1 week ago)
in reply to ArcaneChat

mastodon - Link to source

David Chisnall (*Now with 50% more sarcasm!*)

#DeltaChat is for private chatting, so you normally don't put your link anywhere publicly, you could create a dedicated profile for public interactions tho, which, unlike in signal, it is super easy to do and you can have as many as you want,


Okay, so your use case for 'private chatting' excludes journalists publishing contact information for whistleblowers? It excludes union organisation? It excludes protest organisation?

I guess that's fine, but maybe don't claim to be operating in the same space as Signal then.

and notice the use case I am talking here is family chat, not business and public interactions, that is why I said "keep your family safe" I am talking about family chat solution here


Then you need to learn about the concept of an anonymity set. If you have one mechanism for talking to your family and another different one for talking to your union rep, it's really easy for a passive adversary to track when you suddenly start using a different mechanism for high-value conversations.

#deltachat
in reply to David Chisnall (*Now with 50% more sarcasm!*)

mastodon - Link to source

Delta Chat (39c3)

@david_chisnall
what kind of passive adversary are you talking about here? server, provider, global?

Identifying whether you are using this or that chat profile is not necessarily trivial, especially since the 2.33 releases which introduced multi-relay profiles. A single chat profile can jump between using different relays/hosts.

FWIW we share the recommendation of @arcanechat to split between a public profile (invite link published etc.) and private ones (no publishing).

@David Chisnall (*Now with 50% more sarcasm!*)
in reply to David Chisnall (*Now with 50% more sarcasm!*)

mastodon - Link to source

ArcaneChat

> Okay, so your use case for 'private chatting' excludes journalists publishing contact information for whistleblowers? It excludes union organisation? It excludes protest organisation?

> I guess that's fine, but maybe don't claim to be operating in the same space as Signal then.

the ArcaneChat slogan is "private chats for the family" I don't get why you jump angry into my thread to attack, I never said anything about "whistleblowers" whatsoever, please, calm down 😅

This entry was edited (1 week ago)
in reply to David Chisnall (*Now with 50% more sarcasm!*)

akkoma - Link to source

lizzie

@david_chisnall
Sorry for jumping in as a random person here, but I think I have some relevant points.
First of all, you admittedly both missed the mark about the cause of the security issue Arcane posted. Delivery receipts are separate from read receipts, and turning off read receipts in signal does not mitigate this issue.

Now as per Delta Chat's FAQ: delta.chat/en/help#what-do-the…
It should have the same issue. Delta Chat claims to send "delivery" receipts, but as far as I can tell, there is no UI indication for the sender when a client receives the message (I tested both mobile and desktop). So unless there is an email sent that doesn't result in any UI indicator for the sender, I think Delta Chat is safe from this particular privacy issue. If it is the case that Delta Chat identified this bad decision and fixed it, please also update your FAQ to match!

The rest of y'all's argument seems to hinge on aspects of how delta chat and arcane chat are marketed/presented, rather than the technical details, so I'm not interested. But what I *do* find really interesting is the idea that "private" and "secure" chat programs would ever send automatic responses without user action. To me, it seems painfully obvious that "features" like this just create an attack surface for probing. Look... I use Signal (as well as Delta Chat), and I like it, and I'm not going to stop using either anytime soon. But it was disappointing to learn about this anti-feature. It *is* a legitimate criticism of Signal that needs to be addressed.

Also, while this issue had nothing to do with phone numbers, I think the fact that Delta Chat does not require phone numbers, and allows the creation of more identities than one might even *have* phone numbers, is an enormous advantage compared to Signal for people who want to protect the privacy of their identity and not just the contents of their messages.


Delta Chat: FAQ

What is Delta Chat? Delta Chat is a reliable, decentralized and secure instant messaging app, available for mobile and desktop platforms. Instant creation of private chat profiles with secure and i...
delta.chat
@David Chisnall (*Now with 50% more sarcasm!*)
in reply to lizzie

mastodon - Link to source

ArcaneChat

@capitalthree ArcaneChat/DeltaChat doesn't have delivery receipts, only read receipts, the only automatic responses the app does in your behalf is to handle invite links, for that you first have to share invite link with the malicious contact, as side effect they also expose when they are online so if you go to your contact list and see them at the top with a green dot while not chatting with them often you can detect this, in thr future this might change

@david_chisnall

@David Chisnall (*Now with 50% more sarcasm!*) @lizzie
in reply to David Chisnall (*Now with 50% more sarcasm!*)

pleroma - Link to source

feld

@david_chisnall there is a clever scheme that I know one person does, which is that your public point of contact is an address that starts a conversation with a bot and the bot hands the user a private identity of yours to contact. Then you can have one public facing point of contact but you still gain private 1:1 identities. It's not very feasible for non-technical users but it could be improved
@David Chisnall (*Now with 50% more sarcasm!*)
in reply to David Chisnall (*Now with 50% more sarcasm!*)

mastodon - Link to source

ArcaneChat

@david_chisnall

> rather than just say ‘I don’t understand this attacks but the researchers who published it didn’t bother trying to attack the protocol I use and so I’m sure it is secure!’ That is exactly the attitude to security that makes me distrust DeltaChat.

I don't understand why do you seem so upset, #DeltaChat has received several REAL PROFESSIONAL INDEPENDENT security audits, all listed here: delta.chat/en/help#security-au…
can you provide a similar list of REAL sec. audits for Signal?


Delta Chat: FAQ

What is Delta Chat? Delta Chat is a reliable, decentralized and secure instant messaging app, available for mobile and desktop platforms. Instant creation of private chat profiles with secure and i...
delta.chat
#deltachat @David Chisnall (*Now with 50% more sarcasm!*)
in reply to ArcaneChat

mastodon - Link to source

David Chisnall (*Now with 50% more sarcasm!*)

I don't understand why do you seem so upset,


Because you're spreading misinformation to score marketing points and spreading misinformation about secure messengers gets people killed.

I don't understand why do you seem so upset, #DeltaChat has received several REAL PROFESSIONAL INDEPENDENT security audits, all listed here: delta.chat/en/help#security-au


So, none after this particular class of attack was discovered and therefore none that include this in the threat model?


Delta Chat: FAQ

What is Delta Chat? Delta Chat is a reliable, decentralized and secure instant messaging app, available for mobile and desktop platforms. Instant creation of private chat profiles with secure and i...
delta.chat
#deltachat
in reply to David Chisnall (*Now with 50% more sarcasm!*)

mastodon - Link to source

Delta Chat (39c3)

@david_chisnall being careful of claiming that something is "secure" is good advise/critique. Users are easily misled other ways. As to delivery receipts, it's unlikely there is a big problem with #chatmail clients (of which delta chat and arcanechat are two) because you can not cause a delivery receipt from a peer. But there are likely online-leakage issues with the invite protocols securejoin.readthedocs.io like github.com/chatmail/core/issue… that require work and independent audits.

Prevent silent probing of device online status

SecureJoin has two types of tokens: invite tokens and auth tokens. Currently SecureJoin invite token can be used to silently probe device online status. Auth token when successfully used results in...
link2xt (GitHub)
#chatmail @David Chisnall (*Now with 50% more sarcasm!*)
in reply to Delta Chat (39c3)

mastodon - Link to source

Mikalai

@delta @david_chisnall
Delta(s). Your design -- separation of chatting logic from transport -- is what will allow to overcome this observation and correlation constructions.
You can swap to different transport, like ASMail from 3NWeb set, it is web-style federation, reducing metadata on servers, and correlations between servers.
And then clients and servers may sit on mixnet, like Nym (say hi to them at 39c3).
@Delta Chat (39c3) @David Chisnall (*Now with 50% more sarcasm!*)
⇧