octosphere

> other stuff like open image in new window

Well you can open an image in a new tab by holding down control as you click the 'view image' button. Right click on any image and hold control.

> but I'm sure there are concerns that people here would know something about. Please educate me!

Even though DoH encrypts the DNS metadata, it is still visible to the provider so you have to trust the provider not to expose your DNS requests to third parties. Since Cloudflare is currently used as the default, they act as a huge choke-point for users who have opted into DoH and there's no real way of knowing if such a provider is not sharing this data with unscrupulous third parties.

> Or modifying the html form

You used to be able to send a POST request containing a comment for sites with comments disabled, and the comment still got submitted for the article. Newer versions of Wordpress don't let the comment through anymore. You used to be able to spam the admin area of Wordpress against the admin's wishes.

That article was way above my head. I just glossed over it and have no other takeaway other than: Why are people not scared shitless of quantum computers? Are they even aware of the implications for privacy that quantum computers have? I am aware that intelligence agencies will be the first to possess such a computer, but what happens when it gets in the hands of hackers and bad actors? You could cause some serious violations of privacy when the day comes when you can fit a quantum computer into a laptop form factor.

But then I guess, by then, we would have suitable algorithms which are resistant to a quantum attack, so it's only a matter of switching over to new cipher suites.

This is why Tor and onionland is a lawless wild west. All so that journalists can report and trade documents, and so that repressive regimes can't easily censor access to news and information. This is the cost of encryption: you get all sorts of scoundrels in the mix in the name of privacy and security for the masses. Some might say this cost is too high: that scoundrels are running rampant and won't stop their criminal actions. But without this we get a broken backdoored Internet where no such privacy/security exists and could actually cause more damage to society since spying would be rampant.

> Funneling all your Internet access through a single entity

You don't have to funnel it all, only data crossing hostile networks like free wifi hotspots (The only real use-case for VPNs in the first place). Alongside this is choice of geolocation so you can watch things like HBO even when in Europe.

DNS was always a thorn in my side. I never liked the way it was a single point of failure and the first thing attackers looked at when analyzing traffic. Luckily with things like DoH[0], looking at DNS traffic is a lot less invasive in terms of privacy.

And even more lucky, and something that serves us all is Mozilla's attempt to bake this as the default (DoH) in their mainline browsers. My only complaint being that they use Cloudflare as the default & Cloudflare acts as a honeypot for Internet traffic. If they (Mozilla) could move away from Cloudflare as a partner then that would be great. (Of course this demands a new privacy-respecting provider to serve requests for the user :p)

[0] https://en.wikipedia.org/wiki/DNS_over_HTTPS

There are still some things you can do to mitigate the damage caused by surveillance capitalism, or in some events, logs being kept against your best interest. One of the major ones is installing an adblocker like uBlock origin, and the other major one is compartmented browsing. Compartmented browsing is becoming more popular due to various addons like Facebook Container (Which I use daily) and silos your facebook session away from other sites you may be visiting. On top of these addons, you can use apps like Jumbo[0] that delete old Facebook posts to mitigate against potential employers scouring your profile looking for red flags to not hiring you. Of course that depends on your threat model.

[0] https://apps.apple.com/us/app/jumbo-privacy/id1454039975

I also like to do it through diet. My natural 'Nootropics' consist of walnuts, blueberries, raw cacao powder, fish oils (salmon, cod liver oil etc) and Pure MCT oil, mixed with strong coffee.

Looking forward to creating an encrypted filesystem with ZFS. The snapshots thing seems to be a good unique selling point of ZFS. Will be interesting to see how I go about creating an encrypted ZFS filesystem. Does anyone know - does the encrypted filesystem use LUKS as an abstraction layer on top of ZFS? (Or is the crypto a specific ZFS thing?)

I haven't had a Google account for over 5 years now, after my account got suspended for no apparent reason. The only thing I can think of that raised the alarm at Google was that I created two other accounts using the same IP and device, and Google must have thought I was gaming their system and engaging in some sort of Sybil attack[0] on their network. Two other accounts is hardly grounds for suspension. But 100 or even 1000 other accounts and Google are within their rights to ban me.

Anyways I since switched to Protonmail for frivolous web signups & registering on sites, and then I use Fastmail for various business dealings / freelancing / anything related to finance like Paypal, online banking, etc. I simply can't afford to be arbitrarily banned by Google again.

[0] https://en.wikipedia.org/wiki/Sybil_attack

Most people know this, but still continue to upload images without stripping the EXIF data. I think it's just convenient to not strip it, but they pay with an invasion into their privacy. If I recall correctly, Twitter strips EXIF information so you don't accidentally reveal your location and other metadata.

Single serving site by Brad Frost on bullshit in terms of web design: http://www.deathtobullshit.com (Dug it up from my bookmarks)

I use a diceware[0] passphrase for my Keepass database. I was inspired heavily by XKCD comic 936[1]. My only issue with password managers is that they are a single point of failure and are juicy targets for hackers, so I usually vet them and audit them thoroughly before I use them. I am one of those rare people that actually looks at the source code of password managers to look for flaws in the implementation (I sometimes spot flaws and duly report them to the maintainers).

One caveat to diceware I never liked is how it wears out the keyboard over time as you have to type the same passphrase each time to open the vault (You would be surprised how many times I need to do this each day). I sometimes have to lock my database to avoid evil maid attacks when in a hotel for example. Of course I go through about three keyboards a year because of this, but I don't mind the cost if it gives me a crispy fresh keyboard each time. And did I mention I don't own merely one encrypted database, but many depending on different contexts and different devices?

[0] https://en.wikipedia.org/wiki/Diceware

[1] https://www.xkcd.com/936/

I loathe the way Youtube is this big gatekeeper and can make arbitrary decisions on what is/isn't allowed. We need to build alternatives to Youtube which are not subject to arbitrary interference.

> 55% of respondents agreed their emotions become heightened when on a flight

Of course everything is heightened on a plane flight

Recycled comment of mine from a few weeks ago here. Note: I was told NLP[0] (Neuro Linguistic Programming) was not cast in a good light in its Wikipedia entry, and I admit it has its weaknesses, but I was inspired by the fact Tony Robbins used elements of it in his seminars. Certain parts of NLP appeal to me, but some don't and can be denounced as pseudoscience/quackery.

Below is the original comment:

____________________________________________

I tend to stay away from Instagram as I once read a study (too lazy to find the paper) that Instagram is more detrimental to mental health than other social networks and is generally to be avoided (partly this is because you are comparing other people's highlight reel to your boring drab life).

I use Facebook, albeit sparingly and only ever to make meaningful interactions with my family, and nothing else. I don't feverishly 'check in' to locations, don't engage in 'groups', don't 'like' a million-and-one things, or otherwise engage in the Facebook app in any big way. It means Facebook can't build a dossier of my interests, although they do know my social graph, but then: I'm not a person of interest anyway. I am actually very forgettable.

For Twitter, I have a locked down account and only follow what I'm interested in. I don't actively seek to get more followers, and have literally nothing in my bio that is about me. I don't use my real name. My account is purely for discovery of positive news, and content that stimulates me intellectually.

I recently started to experiment with Neuro Linguistic Programming[0] and a big part of that is deciding what you pay attention to (especially online) and feeding your brain with content that enables you to grow as a person and not be bogged down with negative content that only appeals to your 'monkey brain'. I haven't gone to extremes by cutting out all social media, instead I just use it mindfully and by carefully choosing the types of content I consume.

[0] https://en.wikipedia.org/wiki/Neuro-linguistic_programming

This might have issues. It wasn't well received in infosec Twitter where famed researcher @notdan gave out about the VPN potentially leaking your real IP through a http header

https://twitter.com/notdan/status/1178339685795598336

https://twitter.com/notdan/status/1178388380918439944

https://twitter.com/notdan/status/1178405386585608193

I do an exercise each day where I try to (for at least 10 minutes) look at very distant objects like the horizon or a tree in the distance. I do this because it relaxes the eye especially if you work with screens all day (which I do).

I suppose it could be done a lot cheaper and easier, but don't forget the initial research required to figure out how to do it efficiently. All the trial and error required to create a set of OPSEC rules to abide by as you operate.

In terms of useragents, you are right that they are easy to spoof; I actually meant the device fingerprints aren't easy to spoof (Twitter probably looks at heuristics like screen resolution for example) which is why I would suggest getting a variety of different phones like a mix of legacy Android, newer model Samsungs, iPhones, etc So you have different screen resolutions (which are not trivial to spoof) even different timezones, along with a mix of other unique specs

One caveat to using hundreds (if not thousands of phones) is the cost. I get that. But remember these are the army we are talking about that have a large budget to spend on psyops and can actually pull something like that off. Another caveat to using phones is the lack of dexterity; using a phone is slower than using a desktop environment with keyboard, mouse, et al, although you can extend a phone with a keyboard for faster typing.

You need more than one single solitary account to do psyops on Twitter (I know - I regularly play around with Twitter sockpuppet accounts because I have inordinate amounts of free time to do research on the effects of a campaign, albeit small experimental campaigns :p). Twitter have since made it very difficult to keep an account in good standing if you are suspected of doing psyop-type things like auto-liking specific keywords, 'pouncing' on tweets that have just been sent so that you have the first few replies, constantly monitoring their search feature for specific keywords and engaging with others and spreading some sort of repeated message. Gaming the retweet and like count with several bot-accounts that all use the same IP and useragent will surely get you banned.

I think over the last few years Twitter have done a good job at filtering out bad actors, though like some game of whack-a-mole - bad actors continue to crop up and game Twitter using more novel methods. I suspect the new way of doing psyops is to buy multiple smartphones which all have separate IPs due to a GSM/4G network, and have different and distinct device fingerprints due to different Android versions in use. Then it's a case of constantly feeding the sim-cards with credit (to keep them registered on the network) and if prompted to verify a Twitter account with a phone number, you have a dedicated device for that.

I meant having a sufficient amount of time before certain crypto schemes are broken. Maybe I really meant reasonable. In a reasonable amount of time we can expect quantum computers to attack crypto schemes.

If you mean brute forcing an encrypted message, then yeah: that could take until the heat death of the universe for complex passphrases. Infact you might even need several universes of time to crack some passphrases.

> I don't think money is the issue

Interesting reading the Wikipedia entry regarding SpaceX's funding: https://en.wikipedia.org/wiki/SpaceX#Ownership,_funding_and_...

Seems to be a lot of capital 'raised' which I usually read as money out of thin air, or money otherwise provided because of a certain hype attached to the company.

Yes but isn't there a competition to find an algo that can be widely deployed and not subject to weird requirements? A sort of 'goldilocks' algo. For example, I can't recall the name of the algo, but one such candidate for a post-quantum algo required keysizes to be 1TB in size. Another had large computation requirements and so thus couldn't do on-the-fly crypto (which is needed to do LUKS style encryption of disks for example). (Sorry for my lack of sources but it was a Youtube video of some talk about post-quantum crypto algos I randomly stumbled upon and forgot to bookmark)

> in particular, they can't run Shor's algorithm to factorize numbers and break a big part of encryption methods

Given a sufficient time horizon, large swathes of crypto will be broken by such a computer and has many people worried. NIST is working on algorithms resistant to quantum attacks, but we're still far off.

I remember removing roughly 10,000 tweets once using a similar tool and it broke Twitter for me. Every time I tweeted, it didn't appear in my timeline. Oddly an old tweet from a previous account (with the same handle as mine) showed up too, as if I owned it, but I didn't; I merely reclaimed the handle.

Infinite growth in terms of capitalism is not sustainable into the future and as decades go on it will only do more harm than good. I see this weird behavior in our world where growth is equated with progress when infact in a late-capitalism world, growth is actually the opposite of progress.

SO it's not about actual Reverse Engineering which is tearing the wings off software to understand it better

For those needing to know more about Neuralink: https://en.m.wikipedia.org/wiki/Neuralink

Well to some degree you might be right, but don't forget the USG is in bed with the private sector and regularly sends out NSLs[0] to companies asking for back doors and full access to customer/user data

[0] https://en.wikipedia.org/wiki/National_security_letter