mastodon - Link to source
Certainly helps to have a lot of money and be an incoming president! Judge sets date for Trump hush-money sentencing but rules out prison term - The Guardian apple.news/AuN9BmQtkR4ulOrcNBZ…

Judge sets date for Trump hush-money sentencing but rules out prison term — Guardian US

President-elect will be sentenced for his 34 felony convictions on 10 January, Judge Juan Merchan rules
apple.news

mastodon - Link to source
Google TTS Update: High-Quality Voices, Hidden Features, and Lingering Mysteries accessibleandroid.com/google-t…

Google TTS Update: High-Quality Voices, Hidden Features, and Lingering Mysteries - Accessible Android

On December 10, 2024, Google TTS, officially branded as Speech Recognition & Synthesis on the Play Store, rolled out its latest update:
Amir Soleimani (Accessible Android)

mastodon - Link to source
Google TTS Update: High-Quality Voices, Hidden Features, and Lingering Mysteries accessibleandroid.com/google-t…

Google TTS Update: High-Quality Voices, Hidden Features, and Lingering Mysteries - Accessible Android

On December 10, 2024, Google TTS, officially branded as Speech Recognition & Synthesis on the Play Store, rolled out its latest update:
Amir Soleimani (Accessible Android)

mastodon - Link to source

Remember how the orange pissant and his fascists claims drugs are flowing into the US from Canada.

Well, well, well it looks like the other way.

Coutts drug bust seized $2M in cocaine bound for Canada

calgary.ctvnews.ca/border-agen…


Border agents seize $2M worth of cocaine bound for Canada at Coutts

Authorities at the Coutts, Alta., border crossing seized 189 kilograms of cocaine, with an estimated value of about $2 million, that was being shipped into Canada.
Calgary

mastodon - Link to source

Following the example of GitLab and other VC-funded open source companies, @element goes 'open source almost everything' with "Synapse Pro";

"Synapse itself remains open source, and Element will continue to develop it proactively, just as it has for the last 10 years ... Available under a commercial license, Synapse Pro will help fund and accelerate the continued open source development of Synapse for the benefit of all of Matrix."

element.io/blog/synapse-pro-sl…

#matrix #Element #funding #VC


Synapse Pro slashes costs for running nation-scale Matrix deployments

Synapse Pro is Element’s best practice Matrix homeserver. It transforms the performance and economics of huge public sector deployments.
Steve Loynes (Element Blog)
#matrix #element #funding #vc @Element

mastodon - Link to source

🥳 Big news! While half of Europe is hanging out in Hamburg at 38c3, we got bored and accidentally our web frontend.

It comes with a bunch of new features, which we'll post about in the next couple hours and days, but the one which will probably be most obvious is that we now feature a built-in, automatic dark mode based on your browser / OS preferences 🌙 .

Check it out at search.jabber.network !

All channels - search.jabber.network

The top 25 public chat rooms on the Jabber network.
search.jabber.network
This entry was edited (11 months ago)
in reply to search.jabber.network

mastodon - Link to source

search.jabber.network

Another bit you may have noticed, especially if you visit the home page regularly, is that avatars now always load correctly.

The old website had a weird fun Python runtime type error which occurred sometimes when the browser had an avatar in the cache already.

Because we deleted the almost 10k lines of Python code and replaced it with Rust, that can't happen anymore \o/.

(Also, it's now faster and less memory use, which is nice.)

in reply to search.jabber.network

mastodon - Link to source

search.jabber.network

You can now add hashtags to your #xmpp / #jabber channels on search.jabber.network! Just add a series of hashtags to the end of your channel's description.

Note that we maintain an allowlist of tags here: search.jabber.network/tags/ Tags which are not on that list are ignored.

Suggest new tags we should add/allow in the replies to this thread!

Channel tag index - search.jabber.network

search.jabber.network
#xmpp #Jabber

mastodon - Link to source

New Year, new release ✨

In Movim 0.29 you'll discover two important changes, Stories and Briefs 😯 !

Yes Movim is the very first XMPP client that introduces fully standard Stories (xmpp.org/extensions/xep-0501.h…). Share your day with your friends, from any device, in a few easy steps ❤️

Briefs allows you to publish short content on your profile and complete the existing more complete articles publications 📝

Checkout the complete release note to know everything about those exciting new features: mov.im/community/pubsub.movim.…

#movim #xmpp #release

The Movim stories

Explore • Movim 0.29 Rankin, time to share your Story! ✨

New year, new #release ! This time with plenty of new exciting features, let's have a look at…
mov.im
#xmpp #release #movim
This entry was edited (11 months ago)

mastodon - Link to source

#AndroidAppRain at apt.izzysoft.de/fdroid today with 16 updated and 2 added apps:

* Git Sync: git client for syncing a repository between remote and a local directory
* Sunup: UnifiedPush provider using Mozilla's push server 🛡️

RB status: 384 apps (31.2%)

Enjoy your #free #Android #apps with the #IzzyOnDroid repo :awesome:


IzzyOnDroid F-Droid Repository

This is a repository of apps to be used with your F-Droid client. Applications in this repository are official binaries built by the original application developers, taken from their resp. repositories (mostly Github, GitLab, Codeberg).
IzzyOnDroid App Repo
#android #free #apps #AndroidAppRain #izzyondroid

mastodon - Link to source

Introducing Refine, an app to tweak advanced and experimental settings in GNOME. It is an alternative to GNOME Tweaks, and is a pet project I'm currently working to experiment with PyGObject and dconf, while following the data-driven, object-oriented, and composition paradigms.

The entire codebase is made up of widgets that provide all the functionality needed to add an option. For example, instead of adding each option programmatically in Refine, the ultimate goal is to have it all done in the UI file.

For example, if we want to add an option to enable or disable middle click paste, all we need is the following code in the UI file:

$RefineSwitchRow {<br>  title: _('Middle Click Paste');<br>  schema-id: 'org.gnome.desktop.interface';<br>  key: 'gtk-enable-primary-paste';<br>}<br>

That's it. The RefineSwitchRow widget will do whatever it needs to do to ensure the option is available, grab the setting if it's available, and display it to the user. Many of these widgets provide extra functionality, such as a Reset button.

You can get Refine on Flathub: flathub.org/apps/page.tesk.Ref…

Everything else (source code, screenshot, etc.) is in the project website: tesk.page/refine/, as well as the Flathub link.

#GNOME #Flatpak #Flathub #FOSS #OpenSource #GTK #Libadwaita


Install Refine on Linux | Flathub

Tweak various aspects of GNOME
Flathub
#foss #opensource #gnome #gtk #Flatpak #libadwaita #flathub
This entry was edited (11 months ago)
Unknown parent

mastodon - Link to source

TheEvilSkeleton 🇮🇳 🏳️‍⚧️

Refine, an app to tweak advanced and experimental features in GNOME, has reached 100,000 downloads on Flathub!!

flathub.org/en/apps/page.tesk.…

Refine is an alternative (not replacement!) to GNOME Tweaks, designed to be data-driven and take advantage of the composition paradigm.

If you appreciate Refine and have the means to help a developer out, please consider donating to support my work: tesk.page/#donate

#GNOME #GTK #GTK4 #Libadwaita #FOSS #OpenSource #Flathub #Flatpak #Refine

#foss #opensource #gnome #gtk #Flatpak #libadwaita #flathub #GTK4 #refine
in reply to Seirdy

akkoma - Link to source

Seirdy

Fixed the typos. Regarding SPDX headers:

I think that the robots.txt file itself isn’t a significant enough creative work to warrant copyright protection regardless of the license I put on it, and to put a license on such a trivial work would instead communicate that it’s meant to be reused.

It’s not meant to be reused as-is anymore now that I have a longer article that actually explains how and why I block what I block, but it doesn’t make sense to enforce non-reuse either.

In other words: I’m not sure that the file can receive copyright protections, and to act as if it does by giving it e.g. a CC license would simply encourage people to re-use it when they should be thinking for themselves and applying the nuance I hoped to inspire in my article.

I would rather not use restrictive licenses on my site, especially on works that I don’t think do or should receive copyright protections. and i would rather not advertise that the robots.txt be copied. A bit of a tricky place to be.

mastodon - Link to source
NLS Lays Out Its New Digital Player | News October–December 2024 - National Library Service for the Blind and Print Disabled (NLS) | Library of Congress loc.gov/nls/about/news/news-oc…

News October–December 2024 - National Library Service for the Blind and Print Disabled (NLS) | Library of Congress

Introducing the new NLS audiobook players. NLS technology from 1934 to present. And one that stayed on the drawing board. FY24 highlights. Art that's made to be touched.
National Library Service for the Blind and Print Disabled (NLS) | Library of Congress

glitchsoc - Link to source

I accidentally found another security vulnerability in fdroidserver whilst working on something related to IzzyOnDroid.

We warned them months ago but were ignored *sigh*

"Another fdroidserver AllowedAPKSigningKeys certificate pinning bypass"

openwall.com/lists/oss-securit…

#IzzyOnDroid #Security

oss-security - Another fdroidserver AllowedAPKSigningKeys certificate pinning bypass

www.openwall.com
#security #izzyondroid
in reply to Fay 🏳️‍🌈

glitchsoc - Link to source

Fay 🏳️‍🌈

They are now claiming they can't use my patches as-is because of "code quality issues" (private apis). Which... applies to exactly one patch, the one they actually merged 8 months ago.

Because the only way to fix the vulnerability was to monkey patch androguard (and an updated version is still not available in Debian, nor has the Debian stable fdroidserver package received any patches, despite those packages being maintained by the F-Droid team, so that monkey patch is still needed).

They are also downplaying the impact by insisting this vulnerability is only a problem for third party repositories relying on fdroidserver; which even if true is showing a concerning disregard for the security of repositories of other projects relying on fdroidserver.

I have no words to describe how little remaining faith I now have in F-Droid's security and code review processes.

in reply to Fay 🏳️‍🌈

glitchsoc - Link to source

Fay 🏳️‍🌈

I wrote an overview of the situation (without technical details of the exploits themselves as that's covered by the README):

github.com/obfusk/fdroid-fakes…


fdroid-fakesigner-poc/OVERVIEW.md at master · obfusk/fdroid-fakesigner-poc

F-Droid Fake Signer PoC. Contribute to obfusk/fdroid-fakesigner-poc development by creating an account on GitHub.
GitHub

mastodon - Link to source

Should someone stumble upon the security vulnerability disclosure at openwall.com/lists/oss-securit… – be assured the patches have already been applied at #IzzyOnDroid (and also that androguard is already aware: github.com/androguard/androgua…)

Also see the toot by the original finder: tech.lgbt/@obfusk/113765201775…

#security


Invalid regexp for the certificate · Issue #1097 · androguard/androguard

See: https://www.openwall.com/lists/oss-security/2025/01/03/1 Seems a good idea to patch ;) The regex in question -- ^META-INF/..(DSA|EC|RSA)$ -- is supposed to match all filenames that start with ...
GitHub
#security #izzyondroid
in reply to IzzyOnDroid ✅

mastodon - Link to source

IzzyOnDroid ✅

@eighthave (2/2)

¹ I can follow it, but not create such on my own
² we would need time to set up a script for that; remember we're just a very small team with no grants; most work is still on my shoulders, next to a full-time $dayjob
³ we didn't use your implementation for fdroidserver back in spring but applied the patches provided by Fay, so signing key rotation is still supported at IzzyOnDroid

@Hans-Christoph Steiner
in reply to IzzyOnDroid ✅

mastodon - Link to source

IzzyOnDroid ✅

@eighthave (3/2)

"I'd need to see a v2-signed APK that is installable on Android that demonstrates the exploit it in order to consider this an actionable security vulnerability."

I'd rather not wait until an exploit is out-and-about. The patch is easy and not complex. Better safe than sorry. And one should fix (even potential) vulnerabilities *before* they become exploits.

@Hans-Christoph Steiner
in reply to IzzyOnDroid ✅

mastodon - Link to source

Hans-Christoph Steiner

I understand your concern. From what I know, the IzzySoft repo relies much more on AllowedAPKSigningKeys to provide a secure repo than f-droid.org or guardianproject.info (the repos I'm involved in running). Both had extra verification before AllowedAPKSigningKeys existed, so there, its just an extra layer of protection. The goal of AllowedAPKSigningKeys is to make it easy for non-technical people to manage binary APK repos securely. That is a work in progress, and your reports help
in reply to IzzyOnDroid ✅

mastodon - Link to source

Hans-Christoph Steiner

Good to hear you have more layers of verification. I'd like to read about what you're doing, since you've been handling the auto-download of APKs for a long time, so perhaps there is more we could add to `fdroid update`. Could you point me to them? There is a good foundation for us to build on: APK v2+ signatures are quite robust and APK signing keys tend to be quite stable over time. That makes it possible to automate checks so repo operators don't have to know all about signing.
in reply to Hans-Christoph Steiner

mastodon - Link to source

IzzyOnDroid ✅

@eighthave android.izzysoft.de/articles/n… outlines several of our layers. And you still have one of our scanners in your issuebot – though for some reason that seems not have to be run anymore for quite a long time (I never saw it in issuebot reports for about 2 years now).

You can find our scanning scripts at gitlab.com/IzzyOnDroid/repo (look at the Readme in the lib/ directory). We plan to make them available as Docker/Podman image, but no ETA yet.


Zusätzliche APK-Checks im IzzyOnDroid Repo

Nachdem der Library-Scanner nun seit mehreren Jahren im IzzyOnDroid Repo im Einsatz ist war es an der Zeit, einige zusätzliche APK-Prüfungen zu etablieren.
IzzyOnDroid
@Hans-Christoph Steiner
in reply to Hans-Christoph Steiner

mastodon - Link to source

IzzyOnDroid ✅

@eighthave It's not just about F-Droid and Guardian, Hans. You are promoting fdroidserver for all those decentralized repositories, it's your software. IzzyOnDroid has not a single grant (wouldn't your Mobifree grant cover that?), our team is much smaller than yours (~3 vs ~30) – and not a single one here at IoD is being paid vs. 2+ full-time at F-Droid (we're all doing all this in our spare time, I spend 4+ hours each day after my regular 9h $dayjob for example, not counting weekends. (1/5)
@Hans-Christoph Steiner
in reply to IzzyOnDroid ✅

mastodon - Link to source

IzzyOnDroid ✅

@eighthave (5/5) And looking at Mobifree, from nlnet.nl/mobifree/

> Our goal is to help mobile technology evolve to a more healthy state, provide people with concrete new tools and more reliable infrastructure, in order to provide better security and allow users more agency and choice.

"Better security". Should be the perfect fit for a security issue, no? 😉

NLnet; NGI Mobifree

nlnet.nl
@Hans-Christoph Steiner
in reply to Hans-Christoph Steiner

mastodon - Link to source

IzzyOnDroid ✅

@eighthave I was just wondering, as the corresponding issue carries the Mobifree label. And sorry, we have all hands full with work on IzzyOnDroid – so all we can contribute are those patches, we cannot help you rolling them out at F-Droid.org.

The patches work fine, we use them ourselves. Not sure though how they harmonize with your alternative implementation, which we didn't merge at our end (we use the patches we proposed back then). But we even provide a patch for that variant, please test.

@Hans-Christoph Steiner
in reply to IzzyOnDroid ✅

mastodon - Link to source

Hans-Christoph Steiner

Things with the Mobifree label are things that are being considered as part of that grant. It is definitely not a promise. It is quite likely we will work on AllowedAPKSigningKeys as part of Mobifree, I'd like to, but no guarantees. Currently, I'm thinking of making AllowedAPKSigningKeys only support v2+ signatures, since v1 signatures are deprecated, on their way out, and really overly complicated. I see no sense in trying to build security guarantees on top of them.
in reply to Hans-Christoph Steiner

mastodon - Link to source

IzzyOnDroid ✅

@eighthave Thanks Hans! But you are aware that you still have v1-only APKs in the repo, right? Not saying AllowedAPKSigningKeys is active for them. And yes, it's older apps (just random findings). A full scan could reveal them all (we need to do the same here at IoD as well, have that on our list, but we are even more "understaffed" than you and still without any grants).
@Hans-Christoph Steiner
in reply to Hans-Christoph Steiner

mastodon - Link to source

IzzyOnDroid ✅

@eighthave Isn't that what fdroidserver promises to provide to those using it to maintain a repository? We do not "invest a lot of effort into AllowedAPKSigningKeys" – we simply apply it consequently. Signature pinning is expected to be done by fdroidserver; we *accidentally* found flaws there, we even provided patches which were refused. We still have v1-only APKs as the F-Droid.org repo has them, yes. But we don't write/maintain fdroidserver. Are you saying it is unsafe for use by other repos?
@Hans-Christoph Steiner
in reply to IzzyOnDroid ✅

mastodon - Link to source

Hans-Christoph Steiner

I'm saying v1 signatures should not be something that anyone relies on any more. Our current thinking is to remove support for v1-only signatures from AllowedAPKSigningKeys because of the weakness of v1 signatures means we cannot provide good security, so it would only provide a false sense of security. For distributing v1-only signed APKs, I'd recommend verifying them via an alternate method other than certificate pinning.
in reply to IzzyOnDroid ✅

mastodon - Link to source

Hans-Christoph Steiner

fdroidserver is fully safe for the tasks it was built for. It has been independently audited as well (we have two more audits coming up). If you have a trusted collection of APKs, then fdroidserver provides the entry point to a trustworthy pipe to the F-Droid client. It cannot protect against malicious upstreams, upstreams losing their signing keys, etc. It cannot fix the deprecated v1 signatures. Require v2+ signatures, and AllowedAPKSigningKeys works with no known weaknesses.
in reply to Matija Nalis

mastodon - Link to source

IzzyOnDroid ✅

@mnalis Same as IzzyOnDroid most likely: older apps which have long-time seen no updates anymore. At IoD, we've just removed several of those (which were additionally using weak keys, or had other issues as well), leaving only those in that have strong enough keys etc. Some were left for further investigation, in one case (app still actively maintained) we reached out to the devs asking for additional v2 signing. @eighthave
@Hans-Christoph Steiner @Matija Nalis
in reply to IzzyOnDroid ✅

mastodon - Link to source

Matija Nalis

@eighthave Would it make sense (if those abandoned v1 apps are still useful so should not be archived/removed) to recompile and re-sign those abandoned apps with F-droid.org keys (I'm assuming they're not RB), so people who install them from F-droid these days won't be vulnerable to fake upgrades elsewhere on the net (as I'm understanding is the risk currently)?
Or maybe tag them with that "Vulnerable" flag that F-droid apps (esp. browsers) get occasionally?
@Hans-Christoph Steiner
in reply to Matija Nalis

mastodon - Link to source

IzzyOnDroid ✅

@mnalis I guess none of us have tried those old ones for RB – and with the projects dead and their devs no longer around, that would not help anyway (as with RB, both F-Droid & IoD would ship the upstream APK, which has that signing issue). Wile at IoD we build apps from source FOR RB, we don't sign ourselves. But (most of) the v1-only apps at F-Droid just needed to be re-signed (adding v2) as they are signed by F-Droid – right, @eighthave ?
@Hans-Christoph Steiner @Matija Nalis
in reply to daniel:// stenberg://

mastodon - Link to source

Teixi

@jimfl

Really not a #ChuckTingle book cover?

Can only recall few software tools keeping backwards compatibility many protocols versions, with forward versions implementations. Then such security new/old reports, unavoidable?

AFAIK still no VSC http3 plugin, and only few for http2 ...While anyone just can test http3 from win/mac/lin shell default curl installs:

HT Curl Team!

#chucktingle @Jim Flanagan

mastodon - Link to source

Every year, the Dutch government adjusts taxes on electricity, gas, water as well as other things.
They publish a table on the official website here:
belastingdienst.nl/wps/wcm/con…

On Jan 1, there was no data about 2025 at all. Yesterday, on Jan 2, data appeared, stating the electricity tax to be € 0,10512 per kWh. Today, this number changed to € 0,10154 without any notice of change on that website. 😐

Tabellen tarieven milieubelastingen

Bekijk de tarieven voor de verschillende milieubelastingen van 2017 tot en met 2024.
www.belastingdienst.nl

mastodon - Link to source

We're going to dive in with more depth on this, exploring why Bluesky's content tools are the second worst we've encountered in a long, rich history of internet censorship (just behind Meta, which are *awful).

The long and short of it is: language matters. masto.ai/@vagina_museum/113758…


Vagina Museum (@vagina_museum@masto.ai)

Attached: 1 image us: come and visit a small independent quirky museum in london bluesky moderation team: no that's porn
Mastodon
in reply to Vagina Museum

mastodon - Link to source

Vagina Museum

Now here's a fun fact: it's not only adults that have vaginas and vulvas. Most of you probably don't need to know this, but about 50% of children have this part of the anatomy, too. And most of these children came out of a vagina. Instagram/Meta is particularly egregious for flagging and shadow-banning anything that even so much as uses anatomically correct language, thus obscuring content which, frankly, young people probably *should* be able to access.

glitchsoc - Link to source
Link to USpol, net neutrality, potential for discrimination against trans people, porn bans

Sensitive content

This entry was edited (11 months ago)
⇧