I hope to hear from @Tutanota very soon. Lack of key verification is a major flaw in the technical design of the platform, allowing a malicious Tuta server to read end-to-end encrypted exchanges (both emails and shared calendars).
github.com/tutao/tutanota/issu…
The issue has been opened 6 years ago.
#Security #Privacy #Crypto #Cryptography #Email #FOSS
![Message posted on the GitHub issue titled "Manual key verification":
"This issue has been opened for more than 6 years now, with no clear roadmap or even real consideration from the Tuta team. I have to say, I am disappointed.
You keep saying that "[...] Tuta [is] the most secure email service on the market.", but without key verification, a malicious Tuta server can read the end-to-end encrypted emails and shared calendars exchanged on the platform as there is no way to verify the recipients' public key. As explained by @llebout, "all users of Tutanota must trust Tutanota to not provide forged keys and perform an MITM attack". This is a significant flaw in the technical design of the platform, and it does not seem to bother you.
In #198, it can be read that:
> We are aware of the issues with verification, new protocol will support verification, the work is underway
However, your post-quantum implementation has now landed but still no word on the key verification issue.
Could you please stand by what you have said from day 1, that you prioritise security and privacy, and establish a clear roadmap of the work already undertaken or to be done to fix the situation?
Thank you"](https://fedi.ml/photo/preview/640/595249 "Message posted on the GitHub issue titled \"Manual key verification\":
\"This issue has been opened for more than 6 years now, with no clear roadmap or even real consideration from the Tuta team. I have to say, I am disappointed.
You keep saying that \"[...] Tuta [is] the most secure email service on the market.\", but without key verification, a malicious Tuta server can read the end-to-end encrypted emails and shared calendars exchanged on the platform as there is no way to verify the recipients' public key. As explained by @llebout, \"all users of Tutanota must trust Tutanota to not provide forged keys and perform an MITM attack\". This is a significant flaw in the technical design of the platform, and it does not seem to bother you.
In #198, it can be read that:
> We are aware of the issues with verification, new protocol will support verification, the work is underway
However, your post-quantum implementation has now landed but still no word on the key verification issue.
Could you please stand by what you have said from day 1, that you prioritise security and privacy, and establish a clear roadmap of the work already undertaken or to be done to fix the situation?
Thank you\"")
Finished!
The original is spoken for, but prints are available here:
#FediGiftShop #MastoArt #ArtPrints #HandDrawn #Ink
I also didn’t mention the huge CSA (child sexual abuse) material problem on the Fediverse in our server-shutdown blogpost. Mostly because my exposure to that stuff happened in the early days of me doing moderator work here and after we had blocked most of the frequent offender servers it faded pretty quickly. But I’ve seen some messed up things that I’d rather forget.
But yeah, it’s a huge problem and I don’t think there’s been much progress other than blocking users or entire instances, which inly hides this material from most people (which is still useful) but doesn’t reduce it at all.
Ultimately you can never fully prevent this kind of material being shared between people but the structure of the Fediverse and ActivityPub as a protocol make it particularly easy to create ever new nodes in the network that spread this stuff around.
I tried to sign up for a covid vaccine on ClicSante to see what would happen and got a message saying:
La campagne de vaccination contre la COVID-19 et la grippe est en cours. Les personnes faisant partie des groupes plus à risque et celles qui les côtoient sont invitées à prendre rendez-vous dès maintenant afin de recevoir le(s) vaccin(s) rapidement.La prise de rendez-vous pour la population générale débutera le 16 octobre 2024.
@Foodiekenobi@mstdn.ca I think you were the one trying to figure out when they would start offering it here. It turns out the answer is October 16.
what we do is we go to the vaccination center close to us and walk-in.... as they do walk-in
(Square Decarie for the location)
1. You can now press the Context Menu key (or Shift+F10) on a post. ALT+Windows+F10 is still available but this makes it easier for users.
2. If you enter a conversation by pressing Enter, you can now close it by pressing Escape.
3. Enhancements to pictures:
When focused on a post, it is still possible to press Control+Windows+I to scan an image, but the following is recommended:
A. Open up the post containing the image by pressing Enter.
B. Scan the image by pressing Control+Windows+I. This will now give you the more lengthy explanation using two AI services.
C. Press Escape so as to return to the post you have opened.
D. Press Escape again to return to the timeline.
If this procedure is followed, you will not lose your place in the timeline.
Re-reading "The McRib As Arbitrage" in light of the entire no work from home, return to office push, and I find myself genuinly wondering how much labor exists - how many _companies exist_, even - primarily to serve as a utility function for corporate real-estate arbitrage.
I cannot tell you how grotesque this is, the idea that this might be real utility of so many jobs, bullshit or otherwise.
But there are a lot of bullshit jobs out there.
And....
I think I'm going to double down on this.
Companies that are forcing return-to-office aren't doing that to better fulfill their corporate mission. By clinging to antiquated ideas of what management does and what leadership is these companies have allowed themselves to be co-opted into propping up failing corporate real estate arbitrage schemes. That's it, that's the whole story.
theguardian.com/commentisfree/…
w3.org/news/2024/consortium-me…
už.. akurát som písal edit
edit: toto nemôže písať normálny "nezainteresovaný" človek, aký starý je ten profil?
eidt1: prišlo mi z toho trochu zle môžem povedať úprimne.
Mark your calendars 🗓️ because on October 1st, one of our website pages will "turn blue".
Do you wonder what that's all about? Stay tuned!!! 🔥
#encryption #calendar #sneakpeek #teaser
forum post: "you can definitely do <thing>, check the docs here! <link>"
*clicks through*
the docs: "No docs for this topic yet"
Für FutureZwei der @tazgetroete habe ich über die Rolle von Plattformen beim Erstarken des globalen Rechtspopulismus geschrieben.
Und analysiert, was dagegen getan werden müsste:
Microsoft warns that some Windows 11 systems enter reboot loops or might freeze with blue screens after installing the September 2024 KB5043145 preview update.
#bildetBanden
Do you hope for better translation coverage in your projects?
Register your project for our #Translathon on October 12 + 13 and translate together with our community.
Find all the details here: codeberg.org/Codeberg/translat…
Find the event: codeberg.codeberg.page/Events/…
1/3 "Časť roka som strávil písaním knihy a rozprával som sa pritom s mnohými múdrymi ľuďmi. Jeden z nich povedal, že dobrá krajina nie je tá, v ktorej sa konkrétny politik postará konkrétne o vás, ale taká, v ktorej sa systém čo najlepšie postará o čo najviac ľudí."
~ #SamoMarec
New blog posts about my attendance to open source conferences in September. I've been a bit crazy and went to 5 of them 😅
carlschwan.eu/2024/09/29/confe…
#QtContributorSummit #Akademy2024 #MatrixConf #NextcloudConf24
1/4 "V lete prešla našimi médiami takmer bez povšimnutia správa, na ktorej ma prekvapili dve veci. Prvou bol samotný obsah správy, druhou bol jej minimálny ohlas vo verejnej debate, nehovoriac o debate politickej.
Tou správou bolo, že podľa oficiálnych údajov Eurostatu sú na Slovensku najnižšie čisté platy v celej Európskej únii…"
~ #IvanMikloš
Na @linuxdays už máme 587 potvrzených registrací a bohužel také 44777 pokusů o zneužití registračního formuláře k šíření spamu - přibývají zhruba tempem 4 za minutu.
Uvádět v potvrzovacím e-mailu uživatelem poskytnuté jméno byla chyba, spousta účastníků se teď snaží pojmenovat stylem: "Čeká na vás mnoho BTC. Vyberte je kliknutím…" a podobně.
Tuta
in reply to Skyper 💻🎧☕📖 • • •