I've asked it in a poll in 8/2021 at Mastodon.technology, now it's time for a refresher: To improve #security I finally consider to really drop support for #TLS 1.0/1.1 (see blog.qualys.com/product-tech/2… and e.g. ssllabs.com/ssltest/analyze.ht…). This basically would affect devices running Android < 4.4. As I do not want to lock anybody out, I'd like to see how many of you would this effect.

🇩🇪 Noch wer mit Android < 4.4 unterwegs und somit auf TLS 1.0/1.1 angewiesen (1. ja, 2. macht nix, 3. nein)?

So:

SSL Labs Grade Change for TLS 1.0 and TLS 1.1 Protocols | Qualys Security Blog

Update 1/31/2020: The grade change is now live on www.ssllabs.com. Servers that support TLS 1.0 or TLS 1.1 are capped to B grade. Update 1/16/2020: The grade change is now live on the development…

^{Qualys Security Blog}

• I still use such a device and need compatibility (1%, 4 votes)
• I still use such a device but wouldn't mind (6%, 21 votes)
• I don't care (92%, 320 votes)

Do you like security? Do you like privacy? Cryptography? Do you like working for a public benefit non-profit instead of an investor-beholden corporation?

Let's Encrypt is hiring for someone to join our SRE team and help run the largest Certificate Authority in the world! Come work with me and some of the most wonderful folks in tech, to make the web a better place.

abetterinternet.org/careers/le…

#jobs #sre #webPKI #security #privacy #cryptography

Let's Encrypt Software Engineer (SRE)

Posted: September 29, 2022 Start Date: January 2023 Position Status: Open Location: Remote within US Compensation: $140k USD, 100% 401k Match, Excellent Insurance We’re making HTTPS easier for developers to use, we’re doing it at scale, and we need y…

^{Internet Security Research Group}

What do you value the most in your devices?
Privacy, Security and/or Freedom?

At #CES2023, the biggest #tech event, we are asking people their thoughts about where they stand when it comes to #privacy, #security and #freedom when it comes to their #laptops, #phones, IoT devices

#ces

🔓 Like good neocolonizers, #humanitarian organizations & #nonprofits, like militaries, also collect vast amounts of #biometric & other private information about people with reckless disregard for basic #privacy and #security concepts.

✊🏽 We must hold them accountable for the risks and damages their actions cause: it's unacceptable to allow society to continue this way.

Thanks to #CCC for helping expose the dangerous truth.

#SurevillanceCapitalism #infosec

web.archive.org/web/2022122712…

For Sale on eBay: A Military Database of Fingerprints and Iris Scans

German security researchers studying biometric capture devices popular with the U.S. military got more than they expected for $68 on eBay.

^{Kashmir Hill (The New York Times)}

I recently wrote a post detailing the recent #LastPass breach from a #password cracker's perspective, and for the most part it was well-received and widely boosted. However, a good number of people questioned why I recommend ditching LastPass and expressed concern with me recommending people jump ship simply because they suffered a breach. Even more are questioning why I recommend #Bitwarden and #1Password, what advantages they hold over LastPass, and why would I dare recommend yet another cloud-based password manager (because obviously the problem is the entire #cloud, not a particular company.)

So, here are my responses to all of these concerns!

Let me start by saying I used to support LastPass. I recommended it for years and defended it publicly in the media. If you search Google for "jeremi gosney" + "lastpass" you'll find hundreds of articles where I've defended and/or pimped LastPass (including in Consumer Reports magazine). I defended it even in the face of vulnerabilities and breaches, because it had superior UX and still seemed like the best option for the masses despite its glaring flaws. And it still has a somewhat special place in my heart, being the password manager that actually turned me on to password managers. It set the bar for what I required from a password manager, and for a while it was unrivaled.

But things change, and in recent years I found myself unable to defend LastPass. I can't recall if there was a particular straw that broke the camel's back, but I do know that I stopped recommending it in 2017 and fully migrated away from it in 2019. Below is an unordered list of the reasons why I lost all faith in LastPass:

- LastPass's claim of "zero knowledge" is a bald-faced lie. They have about as much knowledge as a password manager can possibly get away with. Every time you login to a site, an event is generated and sent to LastPass for the sole purpose of tracking what sites you are logging into. You can disable telemetry, except disabling it doesn't do anything - it still phones home to LastPass every time you authenticate somewhere. Moreover, nearly everything in your LastPass vault is unencrypted. I think most people envision their vault as a sort of encrypted database where the entire file is protected, but no -- with LastPass, your vault is a plaintext file and only a few select fields are encrypted. The only thing that would be worse is if...

- LastPass uses shit #encryption (or "encraption", as @sc00bz calls it). Padding oracle vulnerabilities, use of ECB mode (leaks information about password length and which passwords in the vault are similar/the same. recently switched to unauthenticated CBC, which isn't much better, plus old entries will still be encrypted with ECB mode), vault key uses AES256 but key is derived from only 128 bits of entropy, encryption key leaked through webui, silent KDF downgrade, KDF hash leaked in log files, they even roll their own version of AES - they essentially commit every "crypto 101" sin. All of these are trivial to identify (and fix!) by anyone with even basic familiarity with cryptography, and it's frankly appalling that an alleged security company whose product hinges on cryptography would have such glaring errors. The only thing that would be worse is if...

- LastPass has terrible secrets management. Your vault encryption key always resident in memory and never wiped, and not only that, but the entire vault is decrypted once and stored entirely in memory. If that wasn't enough, the vault recovery key and dOTP are stored on each device in plain text and can be read without root/admin access, rendering the master password rather useless. The only thing that would be worse is if...

- LastPass's browser extensions are garbage. Just pure, unadulterated garbage. Tavis Ormandy went on a hunting spree a few years back and found just about every possible bug -- including credential theft and RCE -- present in LastPass's browser extensions. They also render your browser's sandbox mostly ineffective. Again, for an alleged security company, the sheer amount of high and critical severity bugs was beyond unconscionable. All easy to identify, all easy to fix. Their presence can only be explained by apathy and negligence. The only thing that would be worse is if...

- LastPass's API is also garbage. Server-can-attack-client vulns (server can request encryption key from the client, server can instruct client to inject any javascript it wants on every web page, including code to steal plaintext credentials), JWT issues, HTTP verb confusion, account recovery links can be easily forged, the list goes on. Most of these are possibly low-risk, except in the event that LastPass loses control of its servers. The only thing that would be worse is if...

- LastPass has suffered 7 major #security breaches (malicious actors active on the internal network) in the last 10 years. I don't know what the threshold of "number of major breaches users should tolerate before they lose all faith in the service" is, but surely it's less than 7. So all those "this is only an issue if LastPass loses control of its servers" vulns are actually pretty damn plausible. The only thing that would be worse is if...

- LastPass has a history of ignoring security researchers and vuln reports, and does not participate in the infosec community nor the password cracking community. Vuln reports go unacknowledged and unresolved for months, if not years, if not ever. For a while, they even had an incorrect contact listed for their security team. Bugcrowd fields vulns for them now, and most if not all vuln reports are handled directly by Bugcrowd and not by LastPass. If you try to report a vulnerability to LastPass support, they will pretend they do not understand and will not escalate your ticket to the security team. Now, Tavis Ormandy has praised LastPass for their rapid response to vuln reports, but I have a feeling this is simply because it's Tavis / Project Zero reporting them as this is not the experience that most researchers have had.

You see, I'm not simply recommending that users bail on LastPass because of this latest breach. I'm recommending you run as far way as possible from LastPass due to its long history of incompetence, apathy, and negligence. It's abundantly clear that they do not care about their own security, and much less about your security.

So, why do I recommend Bitwarden and 1Password? It's quite simple:

- I personally know the people who architect 1Password and I can attest that not only are they extremely competent and very talented, but they also actively engage with the password cracking community and have a deep, *deep* desire to do everything in the most correct manner possible. Do they still get some things wrong? Sure. But they strive for continuous improvement and sincerely care about security. Also, their secret key feature ensures that if anyone does obtain a copy of your vault, they simply cannot access it with the master password alone, making it uncrackable.

- Bitwarden is 100% open source. I have not done a thorough code review, but I have taken a fairly long glance at the code and I am mostly pleased with what I've seen. I'm less thrilled about it being written in a garbage collected language and there are some tradeoffs that are made there, but overall Bitwarden is a solid product. I also prefer Bitwarden's UX. I've also considered crowdfunding a formal audit of Bitwarden, much in the way the Open Crypto Audit Project raised the funds to properly audit TrueCrypt. The community would greatly benefit from this.

Is the cloud the problem? No. The vast majority of issues LastPass has had have nothing to do with the fact that it is a cloud-based solution. Further, consider the fact that the threat model for a cloud-based password management solution should *start* with the vault being compromised. In fact, if password management is done correctly, I should be able to host my vault anywhere, even openly downloadable (open S3 bucket, unauthenticated HTTPS, etc.) without concern. I wouldn't do that, of course, but the point is the vault should be just that -- a vault, not a lockbox.

I hope this clarifies things! As always, if you found this useful, please boost for reach and give me a follow for more password insights!

Wikimedia is looking for a Director of Security.

#infosec #wikipedia #security #hiring

boards.greenhouse.io/wikimedia…

Director of Product Security

Remote

^{boards.greenhouse.io}

Looks like there’s a new phish in town. Keep an eye out, folks

#phishing #github #security

New episode is out!

@dsearls and @katherined talk to @kyle about hardware supply chains, building the only USA-made mobile phone, trust, open standards, and much more. Full episode here: reality2cast.com/133

youtube.com/shorts/bCR-S0nWRZE

#opensource #security #trust #openstandards #vendorLockin #podcast #NewEpisode

Hardware Supply Chains, Trust Agility, and Avoiding Vendor Lock-in

Doc Searls and Katherine Druckman talk to Kyle Rankin about hardware supply chains, building the only USA-made mobile phone, trust, open standards, and much more.

^{Reality 2.0}

"Virenschutz: Rechteausweitung durch Schwachstelle in AVG und Avast"

[1]Nein? Doch! Ohh! 😉

Schmeißt dieses unnütze Schlangenöl endlich von euren Rechnern. Einzig den Microsoft Defender würde ich noch (mit leichten Schmerzen) eingeschaltet lassen. Mehr Infos unter [2].

#antivirus #security #snakeoil

[1] heise.de/news/Virenschutz-Rech…
[2] kuketz-blog.de/antiviren-scann…

Virenschutz: Rechteausweitung durch Schwachstelle in AVG und Avast

Die Virenscanner von AVG und Avast hätten Angreifern ermöglichen können, ihre Rechte im System auszuweiten. Updates zum Beheben des Fehlers sind verfügbar.

^{Dirk Knop (heise online)}

A Security & Privacy Focused Phone with a Secure Supply Chain🙌

Order your Librem 5 USA before Dec 5, 2022. We are shipping within 10 business days. Use code LIBREM5USA to get $100 off 🎉

puri.sm/products/librem-5-usa/

#security #privacy #phone #sale #promo

TSA Wants To Scan Your Face At The Airport. Here Are Your Rights.

#News #TSA #privacy #biometrics #security #HumanRights #SurveillanceCapitalism #HomelandSecurity #DHS #Airport
washingtonpost.com/technology/…

⚠️ WARNING: Do not use #Hive Social!

According to research conducted by @zerforschung, the #Twitter alternative Hive Social has got a number of dangerous #security vulnerabilies.

They allow attackers to completely access and even to partly edit anyone's data, including private posts, deleted direct messages, e-mail addresses and phone numbers signed up with etc.

Once again this demonstrates that you should not rely on closed-source software to guard sensitive data.

🔗 zerforschung.org/posts/hive-en

⚠️ Warning: do not use Hive Social 👉🐝👈

Dieser Artikel ist auch auf deutsch erschienen. Following the Twitter takeover, a number of services promising to be an alternative gained traction. One of those is “Hive Social”, which reached more than a million users in the last weeks.

^{zerforschung.org}

🎁 Score $100 off this holiday season on your order for Librem 5 USA. With the holiday season in full swing, this is a great gift for any one in your family concerned about secure supply chain or online privacy. Offer valid till 5 Dec 2022, so hurry!

Standard orders ship within 10 business days. 🚀

#librem5usa #librem #phone #purism #security #freedom #madeinUSA

puri.sm/posts/special-year-end…

WhatsApp data breach sees nearly 500 million user records up for sale

If you use WhatsApp, your details could well be up for sale

#news #tech #technology @WhatsApp #security #privacy #databreach

techradar.com/news/whatsapp-da…

WhatsApp data breach sees nearly 500 million user records up for sale

^{Craig Hale (TechRadar pro)}

Google publishes the source code for their TalkBack screen reader. GrapheneOS maintains a fork of it and includes it in GrapheneOS with the help of a blind GrapheneOS user who works on their own more elaborate fork. Eventually, we'd like to include more or all of their changes.

TalkBack depends on a text-to-speech (TTS) implementation installed/configured/activated. It needs to have Direct Boot support to function before the first unlock of a profile. Google's TTS implementation supports this and can be used on GrapheneOS, but it's not open source.

We requested Direct Boot support from both prominent open source implementations:

RHVoice: github.com/RHVoice/RHVoice/iss…
eSpeak NG: github.com/espeak-ng/espeak-ng…

eSpeak NG recently added it but it's not yet included in a stable release and their licensing (GPLv3) is too restrictive for us.

RHVoice itself has acceptable licensing for inclusion in GrapheneOS (LGPL v2.1), but has dependencies with restrictive licensing. Both these software projects also have non-free licensing issues for the voices. Neither provides close to a working out-of-the-box experience either.

Google's Speech Services app providing text-to-speech and speech-to-text works perfectly. Their proprietary accessibility services app with extended TalkBack and other services also works fine. However, many of our users don't want to use them and we need something we can bundle.

There aren't currently any usable open source speech-to-text apps. There are experimental open source speech-to-text implementations but they lack Android integration.

We also really need to make a brand new setup wizard with both accessibility and enterprise deployment support.

GrapheneOS still has too little funding and too few developers to take on these projects. These would be standalone projects able to be developed largely independently. There are similar standalone projects which we need to have developed in order to replace some existing apps.

AOSP provides a set of barebones sample apps with outdated user interfaces / features. These are intended to be replaced by OEMs, but we lack the resources of a typical OEM. We replaced AOSP Camera with our own app, but we still need to do the same with Gallery and other apps.

Google has started the process of updating the open source TalkBack, which only happens rarely. We've identified a major issue: a major component has no source code published.

github.com/google/talkback/pul…

Google has been very hostile towards feedback / contributions for TalkBack...

This is one example of something seemingly on the right track significantly regressing. Another example is the takeover of the Seedvault project initially developed for GrapheneOS. It has deviated substantially from the original plans and lacks usability, robustness and security.

In the case of Seedvault, GrapheneOS designed the concept for it and one of our community members created it. It was taken over by a group highly hostile towards us and run into the ground. It doesn't have the intended design/features and lacks usability, security and robustness.

All of these are important standalone app projects for making GrapheneOS highly usable and accessible. What we need is not being developed by others and therefore we need to the resources including funding and developers to make our own implementations meeting our requirements.

#grapheneos #privacy #security #android #mobile #accessibility #texttospeech #speechtotext #talkback #blind #backup

add Direct Boot support for Android so RHVoice can be used with TalkBack before the initial unlock · Issue #271 · RHVoice/RHVoice

More information: https://developer.android.com/training/articles/direct-boot https://github.com/GrapheneOS/platform_packages_apps_Updater is a trivial example of using this. You need to mark a sub...

^GitHub

NordVPN Black Friday deal: Up to 63% off a 27-month VPN subscription

bleepingcomputer.com/news/secu…

#Security

NordVPN Black Friday deal: Up to 63% off a 27-month VPN subscription

NordVPN's Black Friday deal is live with up to 63% off and 3 extra months for free on 1-year or 2-year subscriptions to the NordVPN VPN service.

^{Lawrence Abrams (BleepingComputer)}

See our good friend and frequent guest, @kyle, discuss supply chain security in this CNBC piece on manufacturing consumer electronics in the USA. We're excited to see @purism in the news!

youtu.be/YdbA7Z8Ae4w

#security #supplyChain #infosec #manufacturing #electronics #hardware #phones #teamKyle

Why The U.S. Fell Behind In Phone Manufacturing

Made in China. It’s a common phrase known by many. Cell phones, TV screens and game consoles are just some of the millions of electronics manufactured and im...

^YouTube

I was interviewed about supply chain security (around 15 min mark) in a longer CNBC feature about manufacturing phones in the USA. In short, it's less about trust concerns with any particular country/govt., and more about reducing the links in the supply chain to reduce the opportunities to tamper with hardware.

Our Made-in-USA-electronics Librem 5 USA phone also got a number of shout-outs. Pretty neat!

youtu.be/YdbA7Z8Ae4w #security #supplychain #infosec #manufacturing

Why The U.S. Fell Behind In Phone Manufacturing

Made in China. It’s a common phrase known by many. Cell phones, TV screens and game consoles are just some of the millions of electronics manufactured and im...

^YouTube

To learn more about #MLS and why this protocol exists in the first place when we already have Signal's, here is a great podcast on the topic: cryptography.fm/7.

#Privacy #Security #Crytology #Cryptography #InfoSec

Episode 7: Scaling Up Secure Messaging to Large Groups With MLS!

Raphael Robert from Wire talks about how MLS wants to scale secure messaging to groups with hundreds or even thousands of participants.

^{Cryptography FM}

The official Mastodon app seems to have a bug when posting an image. Sometimes it will let you compose the post but when you add the image, the Publish button is greyed out. There are other apps that are good, for example, Metatext and Toot! on iOS, and Tusky on Android.
-----------------------------------------------------
There is an Advanced web interface that looks like Tweetdeck. You can enable it in Settings, Appearance.
-----------------------------------------------------
Putting plain text into the 'Search or paste URL' box at the top left of the web interface shows results from your own posts or posts that you have boosted, favourited, or been mentioned in. You can also search for user names, display names, and hashtags located in the body of posts. Putting a hashtag into a Content Warning doesn't work. It won't be clickable and might not be searchable unless someone else has used it in the body of a post.
-----------------------------------------------------
If you find a post on another Mastodon instance and want to boost it on your own instance, click the … menu and then Copy Link. Go back to your own instance, paste the link into the Search box and press Enter. The post will appear below the Search box, and you can boost it from there.
-----------------------------------------------------
You can create Filters to block posts containing certain pieces of text from being displayed in your Home feed. If you want, the filter can hide the post behind a Content Warning so that you can decide whether to view it or not.
-----------------------------------------------------
In the Advanced web interface, you can search for a hashtag, click the result and it will appear in its own column. You can then click the column settings icon at the top right and Pin the column. You can add more tags to the same column, if you like.
-----------------------------------------------------
If you boost a post and the author edits it, you will get a notification so that you know that it has been edited.
-----------------------------------------------------
It's the custom on Mastodon that if you're posting about Mastodon itself, you put a context warning (CW) of "Meta" so that people's timelines aren't flooded with things they don't want or need to see. Likewise, posts about Twitter can be hidden behind a CW: Twitter (or birdsite, birbsite, hellsite, tw). "CW: meta, bird" should be an obvious one.
-----------------------------------------------------
When you're writing hashtags that are a combination of several words, please use "camel case" (#CamelCase) so that screenreaders used by people with impaired vision can pronounce them properly.
-----------------------------------------------------
Mastodon has its own thread unroller: mastodon.social/@threadunrolle…
-----------------------------------------------------
If you go into Settings in Mastodon's web interface and click on Other, you'll see a list of languages at the bottom which you can use to control which posts you'll see.
This works well if you select which language your own posts are in. If you make a post in a different language from your default, select that language using the button at the bottom of the edit box before you post. This way, it can be filtered out on other people's feeds if they choose not to see posts in that language.
-----------------------------------------------------
When posting images, please add Alt Text. This allows sight-impaired people using screenreaders to know what is in the pictures. Let's keep the Fediverse friendly to everyone.
-----------------------------------------------------
Please use a strong password to log in to your server. If you haven't already done so, make sure you have activated 2-Factor Authentication (2FA) in your Settings. This will keep you and everyone else safe. There are a number of good 2FA apps available in the Apple and Google app stores. In fact, iCloud Keychain on an Apple device can be used to generate 2FA keys. See this article for details: appleinsider.com/inside/icloud…
-----------------------------------------------------

#MetaText #Toot #iOS #Android #Tweetdeck #searching #hashtags, #ContentWarning #filters, #boost #notification #meta #CamelCase #ThreadUnroller #languages #AltText #security

How to set up two-factor authentication in iCloud Keychain

You can balance both account security with the convenience of autofill when you set up two-factor authentication in iCloud Keychain. Here's how to do it.

^{Darryl Boxberger (AppleInsider)}

Time for an #introduction. I've been involved in #FOSS and #Linux since the late `90s. My career started as a sysadmin, pivoting to security. I'm the President of @purism and work on hardware and software to protect #privacy, #security and freedom.

I've written a number of books (kylerank.in/writing.html) and was a long-time columnist for Linux Journal magazine.

I have many hobbies including #weaving, refurbishing mechanical #calculators, #3dprinting, #brewing, and many other things.

Linux really needs to remove the “privileged ports” security theater bullshit.

We’re no longer living in the mainframe era. The security properties of the Internet are different to mainframes. This is actually an anti-feature that either complicates life or actually compromises security (when folks run servers as root and forget to drop privileges , etc.).

If anyone has any sway within the kernel team, etc., please do your thing.

source.small-tech.org/site.js/…

#linux #security #theatre #networking

Disable privileged ports security theatre on Linux instead of using setcap (#169) · Issues · Site.js / app

Summary Currently, we’re using setcap to grant the CAP_NET_BIND_SERVICE privilege to allow Node.js (during development and testing) and the Site.js binary...

^GitLab

Heads up: looks like MailChimp was compromised. Watch out for phishing attempts and remember to enable two-factor authentication on your accounts.

digitalocean.com/blog/digitalo…

#security #MailChimp #email #DigitalOcean

Impact to DigitalOcean customers resulting from Mailchimp security incident

The security of DigitalOcean customers and their data is a responsibility we approach with utmost dedication. When our customers' security is threatened we respond swiftly, communicate with transpa...

^{www.digitalocean.com}

Software Sessions is a #podcast by Jeremy Jung for practical conversations of developing software. Jung is a technical lead in the #security industry where he integrates software systems and hardware devices in on-premise environments

On the Episode "Bringing #GeoCities Back with Kyle Drake" from January 15, 2020, you get to hear behind the scenes experiences of #Neocities' infrastructure (IPv4 addresses and CDN, etc), legal challenges (phishing, spam, false DMCA strikes), how much it costs to do the thing, and creating a place that reminds us that making websites still matter.

softwaresessions.com/episodes/…

Also check out Jeremy's blog post on how to record a podcast. jertype.com/how-to-record-a-po…

#nowPlaying

Bringing GeoCities Back with Kyle Drake

Kyle Drake discusses what GeoCities was, why it failed, the technical and legal challenges of creating its spiritual successor Neocities, and how he's working to preserve and curate sites from the old web.

^{Software Sessions}

Related:

Normalize using end-to-end #encrypted (and ideally, ephemeral) communications.

Normalize not telling #Google everything you think, do, and say.

Do it now.

#privacy #security #surveillance

nbcnews.com/tech/security/abor…

Looming abortion law changes prompt digital privacy worries for clinics

Abortion clinics and providers are rushing to strengthen their digital privacy and protect the data of their patients due to the potential overturn of Roe v. Wade.

^{Kevin Collier (NBC News)}

Last week for availing $100 off with promotion code "L14SUMMER" and the special link below and share the info with your friends too!
puri.sm/products/librem-14/?mt…

#laptop #tech #security #privacy #freedom

If a company actually cared about your privacy and wanted to advertise its products, could it do so ethically? We have been thinking about this issue heavily at Purism.

We value people’s privacy and want to protect it not just with our products, but with how we market our products. Let us know, we are counting on your feedback!

puri.sm/posts/is-ethical-adver…
#privacy #security #freedom

A Letter to #Discord for not Supporting the #Linux Desktop

theevilskeleton.gitlab.io/2022…

I rewrote the whole article because I sounded extremely rude before. It's not nice to be rude to developers, whether you like them or not; whether the application is open source or not. Hopefully this revision is respectful and doesn't sound like I am shaming them.

#gnu #security #electron

A Letter to Discord for not Supporting the Linux Desktop

Discord is popular among the Linux desktop community. Thanks to Electron, the framework that Discord uses, it was possible for Discord to port the client over to Linux very easily.

^{TheEvilSkeleton}

Case it point, the text in my image was revealed by @janale about fifteen minutes after my original post.

toki.social/@janale/1083740420…

#GNOME #Obfuscate #security

jan ale (@janale@toki.social)

Content warning: Contents of blur

^toki.social

Warning: There’s an app for blurring out sensitive information in images called Obfuscate being featured on #GNOME Software right now.

Please be careful.

The default blur setting can easily be reversed.

The default should be to replace the areas with a solid colour or a pattern not derived from the underlying information.

This really should not be a featured app in its current state.

#security #linux #apps #obfuscate

Glad to see npm has a security holding package for save-dev (it’s what you end up installing if you forget the dashes before the --save-dev flag) :)

(And here’s hoping, despite what it says on the site, that they never give that package to anyone.)

npmjs.com/package/save-dev

#npm #security #nodejs

save-dev

security holding package. Latest version: 0.0.1-security, last published: 3 years ago. Start using save-dev in your project by running `npm i save-dev`. There are 98 other projects in the npm registry using save-dev.

^npm

Response to "#Flatpak Is Not the Future"

theevilskeleton.gitlab.io/2022…

#gnu #linux #foss #fedora #opensource #security

Response to “Flatpak Is Not the Future”

Late last year, this interesting article “[Flatpak Is Not the Future]” was published to the public, and very quickly grabbed the Linux community’s attention.

^{TheEvilSkeleton}