Which torsocks version? Yours is probably newer than mine. It seems to be a problem with torsocks 2.3.0 and only with dig. And indeed there is nothing wrong at the network level because I was able to do an MX lookup over tor using a different method than torsocks. I'm also able to use other apps with torsocks, just not dig all of the sudden.
To do an MX lookup over Tor, this command has worked for me for years:
$ torsocks dig @"$dns_server" -t mx -q "$email_domain" +noclass +nocomments +nostats +short +tcp +nosearch
In the past week or so it just hangs. My first thought was the DNS server I chose (8.8.8.8) started blocking tor. But in fact it does not matter what DNS server is queried. The whole Tor network is apparently blocking tor users from doing MX lookups.
Also notable that dig hangs forever. It does not timeout despite a default timeout interval of 5 seconds (according to the man page).
Dutch DPA imposes a fine of 290 million euro on Uber because of transfers of drivers' data to the US.
The link is Cloudflare-free, popup-free and reachable to Tor users.
(edit) Some interesting factors--
from the article: > For a period of over 2 years, Uber transferred those data to Uber's headquarters in the US, without using transfer tools. Because of this, the protection of personal data was not sufficient. The Court of Justice of the EU invalidated the EU-US Privacy Shield in 2020.
Yes but strangely & sadly the US benefits from an adequacy decision, which IIRC happened after 2020. This means the US is officially construed as having privacy protections on par with Europe. As perverse as that sounds, no doubt Uber’s lawyers will argue that point.
> The Dutch DPA started the investigation on Uber after more than 170 French drivers complained to the French human rights interest group the Ligue des droits de l’Homme (LDH), which subsequently submitted a complaint to the French DPA.
Wow! I wonder what triggered so many drivers to consult a human rights group. I mean, consider that Uber users and drivers are all happy to run a closed-source Google-gated app.. this is not a demographic who cares about privacy. So what triggered 170 complaints? I wonder if the Dutch DPA would have taken any action had there not been 170 cross-border complainants.
The French DPA gives some interesting insight. Info to attempt to satisfy access requests were in English, not French, which breaks the accessibility rule. The French article gives more a feeling of not 170 proactive complaints, but maybe the human rights org complained on behalf of 170 drivers. I am quite curious from an activist point of view if 170 drivers proactively initiated a complaint.
The fourth breach is interesting: > by not explicitly mentioning the right to data portability in their privacy statement.
Is data portability even useful for Uber drivers in France? I’ve never used Uber (fuck Google), but I imagine drivers have feedback about how well they perform and maybe they want to port that data to an Uber competitor.. but there is no Uber competitor in France, is there? Is Lyft in France?
I normally grab a #youtube video via #invidious onion instances this way:
yt-dlp --proxy http://127.0.0.1:8118 -f 18 http://ng27owmagn5amdm7l5s3rsqxwscl5ynppnis5dqcasogkyxcfqn7psid.onion/watch?v="$videoID"
Now it leads to:
> ERROR: [youtube] $videoID: Sign in to confirm you’re not a bot. This helps protect our community. Learn more
There used to be a huge number of Invidious instances. Now the official list is down to like ½ dozen.
This email provider gives onion email addresses:
pflujznptk5lmuf6xwadfqy6nffykdvahfbljh7liljailjbxrgvhfid.onion
Take care when creating the username to pull down the domain list and choose the onion domain. That address you get can then be used to receive messages. Unlike other onion email providers, this is possibly the only provider who offers addresses with no clearnet variations. So if a recipient figures out the clearnet domain it apparently cannot be used to reach you. This forces Google and MS out of the loop.
It’s narrowly useful for some situations where you are forced to provide an email address against your will (which is increasingly a problem with European governments). Though of course there are situations where it will not work, such as if it’s a part of a procedure that requires confirmation codes.
Warning: be wary of the fact that this ESP’s clearnet site is on Cloudflare. Just don’t use the clearnet site and keep CF out of the loop.
Self hosting would mean I could control account creation and make many burner accounts. But there are issues with that:
- If there are several burner accounts then the admin would have to make it easy for others to create burner accounts or else it would be evident that all the burner accounts are just the admin’s, which does not solve the aggregation problem. It introduces complexities because the DNS provider and ISP would have the identity of the self-hoster. One could onion host but that greatly narrows the audience.
- It does not solve the problem for others. Everyone who has the same need would then be needlessly forced to independently solve all these same problems.
- I do not have high-speed unlimited internet, so I would have to spend more on subscription costs.
I think it complicates the problem and then each author has to deal with the same. If it’s solved at the fedi API level, then the existing infrastructure is ready to work.
(edit) I recall hearing about a fedi client application that operates in a serverless way. I don’t recall the name of it and know little about how it works, but it is claimed to not depend on account creation on a server and it somehow has some immunity to federation politics. Maybe that thing could work but I would have to find it again. It’s never talked about and I wonder why that is.. maybe it does not work as advertised.
Those do not obviate the use cases I have in mind. Secure drops are useful tools for specific whistle blowing scenarios. But they are not a one-size-fits-all tool.
I routinely use framadrop and then transmit the links to regulators or whoever I am targeting to act on a report. But what if the target audience is not a specific journalist or regulator but rather the entire general public? The general public does not have access to reports submitted to the Guardian’s dropbox or NYTimes’ dropbox. Those are exclusive channels of communication just for their own journalists. The report then only gets acted on or exposed if the story can compete with the sensationalisation level of other stories they are handling. If I’m exposing privacy abuses, the general public does not give a shit about privacy for the most part. So only highly scandelous privacy offenses can meet the profitable publication standards of Guardian and nytimes. The reports also cannot be so intense as to be on par with Wikileaks. There is a limited intensity range.
The fedi offers some unique reach to special interest groups like this one without the intensity range limitation.
NYtimes is also a paywall. So even if the story gets published it still ends up a place of reduced access.
They are great tools for some specific jobs but cannot wholly replace direct anonymous publication. Though I must admit I often overlook going to journalists. I should use those drop boxes more often.
(edit) from the guardian page:
Once you launch the Tor browser, copy and paste the URL xp44cagis447k3lpb4wwhcqukix6cgqokbuys24vmxmbzmaq2gjvc2yd.onion or theguardian.securedrop.tor.onion into the Tor address bar.
That theguardian.securedrop.tor.onion URL caught my attention. I did not know about onion names until now. Shame it’s only for secure drops.
I have lots of whistles to blow. Things where if I expose them then the report itself will be instantly attributable to me by insiders who can correlate details. That’s often worth the risks if the corporate baddy who can ID the whistle blower is in a GDPR region (they have to keep it to themselves.. cannot doxx in the EU, Brazil, or California, IIUC).
But risk heightens when many such reports are attributable under the same handle. Defensive corps can learn more about their adversary (me) through reports against other shitty corps due to the aggregation under one handle.
So each report should really be under a unique one-time-use handle (or no handle at all). Lemmy nodes have made it increasingly painful to create burner accounts (CAPTCHA, interviews, fussy email domain criteria, waiting for approval followed by denial). It’s understandable that unpaid charitable admins need to resist abusers.
Couldn’t this be solved by allowing anonymous posts? The anonymous post would be untrusted and hidden from normal view. Something like Spamassassin could score it. If the score is favorable enough it could go to a moderation queue where a registered account (not just mods) could vote it up or down if the voting account has a certain reputation level, so that an anonymous msg could then possibly reach a stage of general publication.
It could even be someone up voting their own msg. E.g. if soloActivist is has established a history of civil conduct and thus has a reputation fit for voting, soloActivist could rightfully vote on their own anonymous posts that were submitted when logged-out. The (pseudo)anonymous posts would only be attributable to soloActivist by the admin (I think).
A spammer blasting their firehose of sewage could be mitigated by a tar pit -- one msg at a time policy, so you cannot submit an anonymous msg until SA finishes scoring the previous msg. SA could be artificially slowed down as volume increases.
As it stands, I just don’t report a lot of things because it’s not worth the effort that the current design imposes.
That story is focused on #CloudSTRIKE but the bigger more remarkable demon here is #CloudFLARE.
This story demonstrates Cloudflare acting as a proxy bully of their own customer, on behalf of CloudStrike by pushing a frivilous #DMCA take-down demand. CF took the spineless route as it sees CloudStrike as having more muscle than their customer. After CF joins the Goliath side of the David vs. Goliath battle, CF ignores Senk’s responses and keeps proxying threats.
Senk bounced from Cloudflare and went to a provider who has his back. #ArsTechnica publishes Cloudflare’s conduct. As embarrassment hits Cloudflare and David (Senk) starts winning against Goliath (CloudStrike), CF changes their tune. Suddenly they are on Senk’s side, saying “come back, we’ll protect you -- we promise we didn’t get your messages”. LOL. Senk should do a parody site for Cloudflare too.
Senk’s mistake: leaving CF. He should have waited until CF actually booted him. Then that would have more thoroughly exposed CF’s shitty actions. Senk gave CF an easy out.
Interesting to note how a human on the side of civil rights who advocates decentralisation was treated with hostility by Cloudflare. Yet CF is fine with sheltering actual criminals.
Customers should take several proactive steps to protect their personal information and reduce potential risks: Be Wary of Phishing Attempts
Customers should rethink their stupid ass decision to use AT&T in the first place since it has been known for over a decade that AT&T is the most privacy abusive of all US telecoms, most notably their role in project Fairview (archive for clearnet users and wikipedia).
AT&T customers don’t give a shit about privacy. But I do have some sympathy for all the non-AT&T people who communicated with AT&T pawns.
BTW, the OP’s link avoids reclaimthenet’s shitty popup if proxied through 12ft.io:
https://12ft.io/https://reclaimthenet.org/nearly-all-at
Not sure it matters since the text is in the OP anyway.. guess if someone wants to share it around.
EU-based ATMs tend to charge a fee of ~€4—6 on non-EU cards. I’m fine with that because my bank rebates those fees anyway. However something seems off with some French ATMs.
France has a reputation for having the highest banking fees in Europe and their ATMs seem consistent with that reputation. Some French ATMs charge €6 and that gets printed on the ATM receipt. As expected my bank sees the fee on their side in that case and they credit it back to me -- so no problem there. But then other ATMs in France do not print any fee on the receipt. Consequently my bank sees no fee on the transaction so they rebate nothing back to me. Are those ATMs reeaaally giving up the opportunity to charge a fee to non-EU cards? Certainly no Dutch ATMs ever pass up that opportunity. When calculating the xe.com rate of that day and comparing to the money drawn from my bank account, there is a discrepancy of ~$5.50 USD.
So it looks like the ATM is adding their fee into the euro amount. E.g. I pull out €400 & decline DCC, and the ATM prints a receipt showing €400 but then draws something like €405. In principle it should be evident from the bank statement. But my bank lacks transparency and omits from the statement the euro amount and also withholds the exchange rate they applied (which the contract says is the straight interbank rate with 0% markup).
I see two possible theories here:
- my bank’s so called fee-free FX rate is really ~1%; OR
- the French ATMs add the fee to the amount charged and hiding the fee. They do not benefit from it but could be sloppy programming. Maybe they think it does not matter because they are still charging whatever the customer agrees to anyway.
While I struggle to believe that 3 different French ATMs would pass up the chance to take a fee, I ran the numbers on a transaction that actually does transparently take a fee and result in a rebate. I still paid almost 1% more than the xe.com rate.
All fees must be disclosed on the ATM screen by law. But my memory is not so reliable.
Folks, FedEx has always been on the extreme right. Some basic facts:
- FedEx is an ALEC member (extreme right lobby and bill mill), largely as an anti-union measure
- FedEx founded by an ex military serviceman
- FedEx gives discounts for NRA membership (though I heard this was recently discontinued). NRA is obviously an extreme right org who also finances ALEC.
- During the NFL take-a-knee protest, FedEx is one of very few die-hard corps that refused to give in to the boycott. FedEx continued supporting the NFL against all the Black Lives Matter athletes taking knees and getting punished.
- FedEx ships shark fins, slave dolphins and hunting trophies. Does not give a shit about harm to animals (even when endangered) or environment.
I have been boycotting FedEx for over a decade. Certainly being pro-surveillance is fitting with their history and should not be a surprise to anyone who is aware of this background.
The only moral inconsistency is that FedEx has a reputation for not snooping on your packages and seems to be favored by people shipping contraband. But to find the consistency it’s just about the bottom line. They make no money by ratting out their customers who break the law. But installing a surveillance system on their trucks is probably yielding revenue for FedEx.
Sounds mostly reasonable.. but I don’t see the alternate citizenship helping, unless you mean to go as far as renouncing because all FATCA regions (~130+ countries) look at the birthplace, not nationality, and you can never get a new birthplace. It’s probably hard to find a non-FATCA region where you can trust the banks. But indeed.. getting your 4th amendment rights has come to extremes.
That makes some sense.
In my case I think I have credit that I’ve never actually used; and I think I’ve also put on their file that I am unemployed. So in principle consumers who either don’t care for the credit, or are happy to be in the highest risk category, they should not be harassed with this. I will just ignore it and see what happens.
In the past I have only seen PayPal spontaneously demand at arbitrary/unexpected moments that I jump their their hoops – to login and give them more info about me. I reluctantly did what they wanted, and they kept my account frozen and kept my money anyway. So I’ve been boycotting PayPal ever since....
(cross-posting is broken on links.hackliberty.org, so the following is manually copied from the original post)
---
When your bank/CU/brokerage demands that you login to their portal to update KYC info soloActivist to Privacy@fedia.io ·
In the past I have only seen PayPal spontaneously demand at arbitrary/unexpected moments that I jump their their hoops -- to login and give them more info about me. I reluctantly did what they wanted, and they kept my account frozen and kept my money anyway.
So I’ve been boycotting PayPal ever since. Not worth it for to work hard to find out why they kept my account frozen and to work hard to twist their arm to so that I can give them my business.
Now an actual financial institution is trying something similar. They are not as hostile as PayPal was (they did not pre-emptively freeze my account until I dance for them), but they sent an email demanding that I login and update my employment information (even though it has not changed). Presumably they will eventually freeze my account if I do not dance for them to satisfy their spontaneous demand.
I just wonder how many FIs are pulling this shit. And what are people doing about it? Normally I would walk.. pull my money out and go elsewhere. But the FI that is pushing KYC harassment has a lot of power because they offer some features I need that I cannot get elsewhere, and I have some stocks through them, which makes it costly/non-trivial to bounce.
I feel like we should be keeping a public database on FIs who pull this shit, so new customers can be made aware of who to avoid.
I doubt it. It will probably show the clearnet address. I just now logged in via the onion, so this reply will be a test.
Replacement link to a privacy-respecting host:
This article seems to suggest the KYC rules only apply to foreign customers:
https://www.bankinfosecurity.com/commerce-proposes-rule-to-fight-foreign-cloud-cyber-threats-a-24219
but then you have to wonder how they will know you’re domestic without a bit of KYC on Americans as well.
BTW, a good way to find privacy-respecting links is to search using this service:
https://ombrelo.im5wixghmfmt7gf7wb4xrgdm6byx2gj26zn47da6nwo7xvybgxnqryid.onion/
That search tool will not return Cloudflare MitMd links.
The U.S. Department of Commerce (“Commerce”), Bureau of Industry and Security (“BIS”), recently issued a proposed rule aimed at preventing foreign actors from utilizing U.S.
Pushover consumers accepted “Know Your Customer” abuses to their 4th Amendment rights in the banking sector, so why wouldn’t the same work when it comes to internet service? I have no doubt that the privacy apathetic masses will accept this in a heartbeat.
I’m not on a good enough connection to watch videos but when I read “How the Religion called Atheism…” I know it cannot be coming from any sort of credible source. Atheism is absence of religion, not a religion in itself. It includes both agnostics and gnostics (both those who are convinced there is no god and those who are unconvinced either way). So I don’t suppose it’s worth it to note the URL and try to fetch the video when I have a good connection.
Lawmakers have figured out they can circumvent 4A by forcing the private sector and external governments to do their surveillance. It worked for banking KYC and it worked for FATCA. The industry is apparently not worried at all about losing customers. And they won’t. To circumvent 4A, just outsource governance to a non-government entity.
Love the irony of being blocked from reading that article because I am anonymous and the #reclaimthenet hypocrits insist on using Cloudflare.
So I can only comment on the title and what the OP (apparently) copied. Judging by how the masses happily continue using banks who voluntarily abuse KYC by collecting more info than required, internet users will also be pushovers who give in to whatever KYC comes their way.
This policy will actually create victims. Just like GSM registration creates victims. In regions that require GSM registration phone theft goes up because criminals will steal a phone just for a live SIM chip. So KYC creates incentive for criminals to run their services from someone else’s PC.
This is a double-edged sword. In the US, banking is really optional. You can live an unbanked life in the US and get paid in cash, if you want. And you can force creditors to accept your cash payment on debts. That’s an important freedom.
In Europe, where banking is treated as a public service that all people are entitled to, they have created a system where you must use a bank. They have banned cash payment for wages. So you have a right to a bank acct but then you are forced to use it.
#warOnCash #forcedBanking
You’ve misunderstood the problem if you fail to see that ruling in favor of one party necessarily violates the rights of the other party. The decision was a compromise on which party’s rights carry more weight to prevail over the rights of the other party. Both parties had rights worthy of defending.
Of course I have biases, but the bias does not reflect in my thesis (which is the opposite of what you realize). In particular, just because I find the bakers to be bigots does not mean I expect them to lose in court. I still actually believe the bigoted bakers rightfully won the case (thus, this does not prove your point, which is that you think there should have been no court case). The court case was not about whether they are bigots. It’s about whether an artist should be forced to produce art that favorably expresses people/ideas they hate against their 1st amendment rights also amid their right to choose who to do business with.
So the court was right to rule in favor of the bakers. But your claim that there should not have been a court case at all remains unsupported. The case had merit. The rights of people in a protected group (sexual orientation) were discriminated against and so they were rightfully given a forum to have their legitimate complaint heard.
IMO, it’s a fucked up extreme bias that brings you to consider the case frivolous, as if one side of the debate did not have enough merit to even warrant a court case.
They were still fined a lot of money
No they weren’t. Read the first line of your own referenced article. The fine was dropped. And the original payment came from other people’s crowd-funded donations toward the case anyway, which was returned.
Also, precedence matters and court ranking matters. Lower courts in certain regions can have all kinds of bizarre judgments but higher courts take precedence. The Oregon Court of Appeals is not representative of the US. The US Supreme Court is. The Bank of America case would be in a federal court as many states are involved.
And spent a considerable amount of time and energy defending themselves for no damn reason
So you not only misunderstood the outcome, but you object to rights of one party being tried against rights of another party in court? Bizarre to have sympathy for bigots being dragged through the court system, despite getting off the hook.
The Oregon Court of Appeals is a lower court than the US Supreme Court. The Bank of America case is federal.
Love the irony and hypocrisy. What self-respecting conservative promotes regulation, particularly that would take control away from a business on who they do business with?
There’s also quite a bit of hypocrisy from a privacy standpoint. It’s the conservatives to don’t value privacy and take the “if you have nothing to hide…” line of reasoning. When a giant corporation voluntarily shares sensitive information about customers, it’s always the right-leaning corporations who do that; ALEC members.
Funnily enough, I boycott Bank of America for supporting conservative values (private prisons, xenophobia, fossil fuel investment, privacy-disrespect):
https://git.disroot.org/cyberMonk/liberethos_paradigm/src/branch/master/usa_banks.md
while the conservatives want to cancel Bank of America for essentially for being conservative. Apparently it’s not conservative enough for BofA to apply conservative values uniformly, as opposed to giving conservative individuals preferential treatment.
How bizarre. I boycott #JPMorgan/Chase in part because they heavily invest in fossil fuels (among countless other evils):
https://git.disroot.org/cyberMonk/liberethos_paradigm/src/branch/master/usa_banks.md
And according to your linked article, the state of Texas is boycotting JPMorgan/Chase for not investing in fossil fuel. How confusing. Maybe the state of Texas should read the Banking on Climate Chaos paper.
The bank requires customers who use their phone app to:
- buy a new recent smartphone, repeatedly (because the bank’s app detects when it is running on an Android emulator and denies service)
- subscribe to mobile phone service (which also costs money and also in some regions requires supplying national ID to the mobile carrier to copy for their records which customers then must trust them to secure)
- share their mobile phone number with a power abusing surveillance capitalist who promotes the oil industry (Google / Totaal)
- create a Google account and agree to their terms (which includes not sharing software that was fetched from the Playstore jail)
- share their IMEI# with Google
- share all their app versions with Google, thus keeping Google informed of known vulns for which they are vulnerable
- share with Google where they bank and trust Google not to sell that info to debt collectors
- install proprietary non-free software and trust the security of non-reviewable code
- share the mobile phone number with the bank
Why are so many people okay with this?
The state of medical privacy has become quite appalling lately. I started using a young doctor in a new office and they are gung ho on modern tech. That’s fine to some extent but they want to send me invoices and all correspondence via e-mail. No PGP of course. I did an MX lookup on their vanity email address & it resolves to an MS Outlook server.
I asked them for my test results. They offered to email them.
My response: I do not want sensitive medical info coming by e-mail via Microsoft’s servers. I did not give you a copy of my email address for that reason. It needs to be snail-mailed to me.
Perhaps of greater concern is that the receptionist acted like I am making a unusual request, and that they do not mail things. Apparently I am the only patient who has a problem with sensitive medical info going to Microsoft. So the receptionist is investigating whether she can get approval to mail me my results by post.
I wonder if someone in that clinic will have to run out and buy stamps because I have a problem with Microsoft.
Microsoft faces criticism for funding Israeli facial recognition company AnyVision, reportedly carrying out surveillance on Palestinians and working in Hong Kong and Russia.
cross-posted from: https://links.hackliberty.org/post/984895
> Microsoft finances #AnyVision to produce facial recognition technology that the Israeli military uses against the Palestinian people. > > So if you oppose Israel’s brutality then #Microsoft should be on your boycott list. > > If you are undecided, these stories might help with your decision: > > * snipers target a red-cross medic for execution (2018) → https://edition.cnn.com/2018/06/03/middleeast/razan-al-najjar-gaza-nurse-killed/index.html > * Hind Rajab (6 year old; 2024) → https://www.guardian2zotagl6tmjucg3lrhxdk4dw3lhbqnkvvkywawy3oqfoprid.onion/world/2024/feb/10/im-so-scared-please-come-hind-rajab-six-found-dead-in-gaza-12-days-after-cry-for-help > > For Hind Rajab, my boycott is on until I die.
cross-posted from: https://links.hackliberty.org/post/125466
> My credit card issuer apparently never gets to know what I purchased at stores, cafes, & restaurants -- and rightfully so. The statement just shows the shop name, location, and amount. > > Exceptionally, if I purchase airfare the bank statement reveals disclosures: > * airline who sold the ticket > * carrier > * passenger name > * ticket number > * city pairs > > So that’s a disturbing over-share. In some cases the airline is a European flag carrier, so IIUC the GDPR applies, correct? Doesn’t this violate the data minimization principle? > > Airlines no longer accept cash, which is also quite disturbing (and illegal in jurisdictions where legal tender must be accepted when presented for PoS transactions). > > Has anyone switched to using a travel agent just to be able to pay cash for airfare? > > UPDATE > > A relatively convincing theory has been suggested in this other cross-posted community: > > https://links.hackliberty.org/comment/414338 > > Apparently it’s because credit cards offer travel insurance & airlines have incentive to have another insurer involved. Would be useful if this were documented somewhere in a less refutable form.
There is a common theme pushed by fanatics of capitalism that never dies: that a profit-driven commercial project ensures higher quality products than products under non-profit projects. Some hard-right people I know never miss the chance to use the phrase “good enough for government work” to convey this idea.
I’m not looking to preach to the choir here, but rather to establish a thread of scenarios that correspond to quality for the purpose of countering inaccurate narratives. This is the thread to share your stories.
In my day job I’m paid to write code. Then I go home write code I was not paid for. My best work is done without pay.
Commercial software development
When I have to satisfy an employer, they don’t want quality code. They want fast code. They want band-aid fixes. The corporate structure is too myopic to optimize for quality.
Anti-gold-plating:
I was once back-roomed by a manager and lectured for “gold plating”. That means I was producing code that was higher quality than what management perceives as economically optimal.
Bug fixes hindered:
I was caught fixing some bugs conveniently as I spotted them when I happened to have a piece of code checked out in Clearcase. I was told I was “cheating the company out of profits” because they prefer if the bugs each go through a documentation procedure so the customer can ultimately be made to pay separately for the bug fix. Nevermind the fact that my time was already charged anyway (but they can get more money if there’s a bigger paper trail involving more staff). This contrasts with the “you get what you pay for” narrative since money is diverted to busy work (IOW: working hard, not smart).
Bugs added for “consistent quality”:
One employer was so insistent on “consistent quality” that when one module was higher quality than another, they insisted on lowering the quality of the better module because improving the style or design pattern of the lower quality piece would be “gold plating”. This meant injecting bugs to achieve consistency. The bugs were non-serious varieties; more along the lines of needless complexity, reduced performance, coding standard non-compliances, etc, but nonetheless something that could potentially be charged to the customer to fix.
Syntactic dumbing-down:
When making full use of the language constructs (as intended by the language designers), I am often forced by an employer to use a more basic subset of constructs. Employers are concerned that junior engineers or early senior engineers who might have to maintain my code will encounter language constructs that are less common and it will slow them down to have to look up the syntax they encounter. Managers assume that future devs will not fully know the language they are working in. IMO employers under-estimate the value of developers learning on the job. So I am often forced avoid using the more advanced constructs to accommodate some subset of perceived lowest common denominator. E.g. if I were to use an array in bash, an employer might object because some bash maintainers may not be familiar with an array.
Non-commercial software development
Free software developers have zero schedule pressure. They are not forced to haphazardly rush some sloppy work into an integration in order to meet a deadline that was promised to a customer by a manager who was pressured to give an overly optimistic timeline due to a competitive bidding process. #FOSS devs are free to gold-plate all they want. And because it’s a labor of love and not labor for a paycheck, FOSS devs naturally take more pride in their work.
I’m often not proud of the commercial software I was forced to write by a corporation fixated on the bottom line. When I’m consistently pressured to write poor quality code for a profit-driven project, I hit a breaking point and leave the company. I’ve left 3 employers for this reason.
Commercial software from a user PoV
Whenever I encounter a bug in commercial software there is almost never a publicly accessible bug tracker and it’s rare that the vendor has the slightest interest in passing along my bug report to the devs. The devs are unreachable by design (cost!). I’m just one user so my UX is unimportant. Obviously when I cannot even communicate a bug to a commercial vendor, I am wholly at the mercy of their testers eventually rediscovering the same bug I found, which is unlikely in complex circumstances.
Non-commercial software from a user PoV
Almost every FOSS app has a bug tracker, forum, or IRC channel where bugs can be reported and treated. I once wrote a feature request whereby the unpaid FOSS developer implemented my feature request and sent me a patch the same day I reported it. It was the best service I ever encountered and certainly impossible in the COTS software world for anyone who is not a multi-millionaire.
Some Lemmy instances (e.g. Beehaw) do not support down votes. When an instance does support down-votes, authors often get zero feedback with the down votes which ultimately supports obtuse expression, shenanigans and haters. The status quo suffers from these problems:
- down voters do not need to read the comment they are down voting
- down votes empower non-moderators to suppress comments and posts
- some communities struggle to get content because of some malicious down voters who down vote every post to discourage activity and effectively sabotage the community; voting privacy shields malicious down-voters from discovery and supports their attack
- silent down votes are non-constructive
- some people make heavy use of down votes to suppress civil comments purely because of disagreement; other (more civil) users only use down votes to suppress uncivil dialog. This inequality ultimately manifests to reduce civility.
- transparency: kids and adults are accessing the same forums and adults are blind as to whether down votes are coming from kids (the rationale can reveal this)
The fix:
An instance admin should be able to flip a switch that requires every down vote to collect a 1-line rationale from the voter. These one-liners should be visible to everyone on a separate page. Upvotes do not need rationale. So instance owners should have 3 configuration options:
- down votes disabled (beehaw)
- down votes require rationale (proposed)
- down votes out of control (the most common status quo)
Perhaps overkill, but it might be useful if a moderator can cancel or suppress uncivil down votes.
---
BTW, the reason this enhancement request is not in the official bug trackers:
- Lemmy’s bug tracker is in MS Github (#deleteGithub)
- Kbin’s bug tracker is on codeberg, who silently deleted my account without warning or reason, and #Codeberg reg forces a graphical CAPTCHA (which fails on my non-graphical browser).
#lemmyBug #KbinBug
It would be useful to have more refined control over participation in a group. Someone should be able to create a group that gives permissions to specific individuals. A variety of permissions would be useful:
- permission to see that a community/mag exists (some groups may or may not want to be listed in searchable a public directory)
- permission to read the posts in a community/mag
- permission to vote in the community/mag
- permission to start a new thread in the community/mag
- permission to comment on an existing thread in the community/mag
A forum creator should be able to set the above perms on:
- individual accounts
- all users on an instance (e.g. users on an instance
@weH8privacy.commight be unfit for voting and writing comments in the community “fightForPrivacy”) - all users not on an instance (e.g. local users only for example)
- instance IP-based (e.g. users from Cloudflared instances might be unfit to participate in a group called “decentralizationAdvocacy”)
Settings for individuals should override instance-specific settings. So e.g. a “fightForPrivacy” forum might allow all forms of participation from an instance stop1984.org, but if antiprivacyMallory@stop1984.org is uncivil, a mod should be able to block all inputs from that user yet perhaps still allow antiprivacyMallory to just read the posts on the off chance of influencing the user to be more civil through exposure to civil chatter.
More background on the rationale - why the fedi needs this (click to expand)
The fedi has undergone a huge flood of new users, largely moderates from Twitter. The moderates dilute movements.
Consider the evolution of raves and Burning Man. The beginning was a rich subculture that briefly evolved in isolation apart from the ordinary world. These subcultures became more enriched within their own world whereby the core ideas spawned more culture. Then word got out and spread like brush fire. Masses of uninitiated crowds flooded into raves and Burning Man faster than they could be integrated. Commercialization took hold faster than people could be integrated. The scene became diluted with clubbers and conservatives who essentially turned raves into clubs. The way to promote raves that resembled the original experience was to selectively flyer party goers who overtly embraced the experience, who were not merely there to be seen. IOW, the fix was invite-only events.
The flood of moderates into the fedi has crippled the decentralization movement and corrupted the vision. The fedi is now swamped with people from huge instances that are centralized on Cloudflare (lemmy.world, sh.itjust.works, lemmy.ca, lemm.ee, programming.dev, zerobytes.monster) and lemmy.ml. People without a firm grasp on the meaning, purpose, and benefits of decentralization and privacy still find their way into “privacy” communities and make foolish remarks (e.g. not sharing personal correspondence with Google and Microsoft “is tinfoil-hattery”). Sure, it’s favorable that the “I have nothing to hide” crowd intermingle with more sophisticated privacy-aware folks. It’s important that there be a venue where ignorance can be reversed. But--
Moderates are a drag on activism. A “PrivacyAction” forum does not benefit from a mob of idiots who see those practicing established infosec principles as “tinfoil hat” nutters to heckle. Security-wise people with infosec degrees naturally and unavoidably appear “paranoid” to normies. These normies and hecklers can only get in the way in a workshop-centric forum with the mission of strategizing activist movements and protests. Fair enough if a “climate” forum has climate deniers butting heads with those who accept the climate-relevant science. That dialog is needed. But we don’t want climate deniers in a “climate ACTION” forum. They are only there to dilute and sabotage.. to side-track the discussion. A workshop is not interested in rhetoric from those who oppose their mission.
So the status quo of #Lemmy and #Kbin disservices activism.
---
Workaround 1 (Lemmy only):
Make an announcement community and make all participants a moderator. Bit crazy unless you really trust everyone involved.
Workaround 2 (Lemmy):
One community per instance using instance-specific registration control. Still too blunt, cumbersome, excludes mods who don’t have their own instance.
Question
Sometimes I click to subscribe to a community which then goes into a “subscription pending” state. What does that mean? As a moderator of some groups I never receive a signal that someone is requesting to subscribe.
---
BTW, the reason this enhancement request is not in the official bug trackers:
- Lemmy’s bug tracker is in MS Github (#deleteGithub)
- Kbin’s bug tracker is on codeberg, who silently deleted my account without warning or reason, and #Codeberg reg forces a graphical CAPTCHA (which fails on my non-graphical browser).
#lemmyBug #KbinBug
cross-posted from: https://links.hackliberty.org/post/609883
> This BBC interview has a #Cloudflare rep David Bellson who describes CF’s observations on internet traffic. CF tracks for example the popularity of Facebook vs. Tiktok. Neither of those services are Cloudflared, so how is CF tracking this? Apparently they are snooping on traffic that traverses their servers to record what people are talking about. Or is there a more legit way Cloudflare could be monitoring this activity?
There’s a widespread nuisance of shared e-scooters (which do not need to be locked) taking up bicycle stalls that cyclists need to lock their bikes. Are e-scooter platforms instructing users to use bicycle racks? Or are people doing that against policy?
Some banks will annually mail a paper “welcome” letter to all customers purely for the purpose of collecting bounced mail ultimately to verify if anyone has moved without telling them. The letters never state that’s the purpose.. they take that opportunity to talk about their service in arbitrary ways. Some banks even charge customers a fee for their cost in doing that. If you ask the banker about it they readily admit that it’s an address verification technique.
That’s it.. just a PSA so folks are aware, as it is a bit sneaky.
Some national postal services (e.g. USPS) sell your mail forwarding information which is how you get tracked to your new location by various entities even when you did not inform them of your new address. So obviously a good defensive measure is to never use the mail forwarding service. Select the entities you want to know your new address and inform them directly. But then to get some immunity to the sneaky trick in the 1st paragraph, perhaps give the next resident a stack of addressed envelopes and stamps and ask the next resident to forward (remail) for you.. or just ask them to trash your mail instead of returning it.
If you try to download video lU4vv7qCQvg on a variety of #Invidious instances, some (most?) redirect you to a realtime player instead of serving up the file. Those instances that cause the wrong action work correctly for other videos.
works → https://invidious.fdn.fr/watch?v=lU4vv7qCQvg
broken → https://iv.ggtyler.dev/watch?v=lU4vv7qCQvg
cross-posted from: https://links.hackliberty.org/post/454425
> When I visit this post: > > https://jlai.lu/post/2250911 > > the embedded short abstract intro to the article is “403 Blocked www.lecho.be” When I try visiting the link directly I get “403 bot detection”. This suggests that everyone who opens that thread independently visits that webpage by way of some javascript that’s not under the user’s control. If 1000 people open that thread, then 1000 separate fetches are made. That’s a poor design. The server could do that job just once and the results would be more reliable. As opposed to everyone getting different results. > > This is also a #privacy #security bug. Someone who opens a thread does not necessarily intend to fetch the linked article. Non-tor users are under surveillance in some countries (e.g. the US, where Trump enacted law s.t. ISPs can collect data on users without consent). So they should have control over what sites they visit. Merely opening a thread is an abuse because it makes users actions instantly trackable. IOW, users share information with their ISP without their knowledge or control. > > Note that the example thread shows the full text of the article because the author was diligent about copying it. But that’s not the general case. > > #bug #lemmyBug