oil25

> it insists on me giving more permissions to Google services

Can you clarify what you mean? I use Signal without Google Play Store/Services and am curious about said requirement.

> it relies on me a phone number as an ID

I dislike this also, but what's the alternative? A phone number is (usually) a long-lived, relatively immutable identifier which is convenient, memorable and portable. It is highly usable and that may be more important than other considerations.

So glad Firefox has recently started blocking third-party cookies. It's comforting to know there's still a web browser which put thought into guarding our privacy.

https://blog.mozilla.org/blog/2019/06/04/when-it-comes-to-pr...

You're not missing anything - Tor is not designed to defend against a global passive network observer.

> A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary. Instead, we assume an adversary who can observe some fraction of network traffic; who can generate, modify, delete, or delay traffic […]

https://svn.torproject.org/svn/projects/design-paper/tor-des...

> Do you think that ad blockers are reducing the quality of the web

Not my concern as a user.

> should they be limited?

How and by whom would they be limited? Ad blockers - essentially user agents - are already open source and freely available to use, modify and redistribute. The proverbial cat is out of the bag, and you're not getting him back in.

> I use a third party VPN service to get around the fact that my residence comes with broadband that hijacks all DNS and routes all HTTP (port 80) connections through a Squid...

You could set up a local resolver to NXDOMAIN specific IP address replies. Dnsmasq has an option for this. Regarding Squid, what makes you sure your VPN services doesn't do the same?

> I also feel sharing an IP with many other users adds to the level of anonymity.

Can you explain how you feel this adds anonymity? There is still potentially a record of you using that shared IP at a certain time to do a certain thing, so what is your threat model in which the VPN helps anonymity?

Either xfce or dwm. Here's a great guide to OpenBSD on a 5th generation X1 carbon: https://jcs.org/2017/09/01/thinkpad_x1c

When I asked in IRC, I was told U2F was not implemented in browsers on OpenBSD because, "do you really want browsers to have full access to your USB stack?"

I've really been enjoying using OpenBSD full time, both on my desktop (AMD Ryzen build) as well as laptops (Lenovo X230, X1 Carbon). Everything literally "just works", the documentation is impeccable, and I love being able to install a new kernel and base system with one simple command ("sysupgrade"). About the only thing I still use Linux for is a browser with U2F support and Bluetooth - both are disabled in OpenBSD for security.

I've been using LineageOS on a Nexus 6P for a good while now. No Google Services/Play Store was especially challenging to adapt to. But overall the experience has been pleasant, rewarding and surprisingly trouble-free. As for missed calls, isn't that what voicemail is for?

Improving privacy is reducing the quantity and quality of data collected about you. Making changes to Firefox improves privacy because web sites can collect less data about you.

Improving anonymity is reducing the odds that data can uniquely identify you. Making changes to Firefox harms anonymity because very few people deviate from defaults.

For example, turning off Javascript prevents a site from knowing much at all except header information like User-Agent. So it can't draw a canvas fingerprint nor measure your screen resolution, but it can still record the fact Javascript was disabled - a rare event.

OP is correct: the changes make one 'stick out like a sore thumb'; but incorrect in asserting users are 'more fingerprintable'. Improving privacy may reduce anonymity, but losing anonymity does not necessarily affect privacy.

Does Twitter not allow connection from the Tor network any more? What a depressing reality.

> 403 Forbidden: The server understood the request, but is refusing to fulfill it.

> making changes like this makes you far, far more fingerprintable, as the vast majority of users don't make changes like this.

You're confusing privacy and anonymity. They can be mutually exclusive.

Enabling DNT is worth it, but not for the reason which seems obvious. The DNT header was created so Internet advertisers could point and say, "only 0.1% of users have enabled DNT - this is evidence that people don't care about or even WANT to be tracked" in the face of scrutiny by regulators. It's a single extra bit of information about your request; I wouldn't worry about "de-anonymization" resulting from enabling it, but would suggest enabling it as a token gesture anyway.

Fat has more calories and is more easily stored by the body than carbohydrates. Processed carbs, simple sugars give a greater rise in the hormone insulin, which basically puts fat into fat cells. It is not carbs' conversion to fat which causes weight gain, but their consumption in the presence of a high-fat diet.

Fruit is absolutely healthy for humans - physiologically we are frugivorous apes, after all. Hence why nearly all evidence-based nutritional guidelines from all around the world encourage whole fruit consumption, as part of a diet with other whole plant foods like grains, legumes and vegetables.

> gulp down a liter of Gatorade. So the effect 99% is to just fatten you up.

This could not be further from the truth. Humans are notoriously inefficient at de novo lipogenesis - the process of turning sugar into fat. The myth that sugar causes weight gain (on its own, not accompanied by a high-fat diet) is just that - a myth. Not to say gulping down Gatorade is a good idea, but it isn't nearly as harmful as consuming a steak, or a stick of butter, when it comes to weight gain.

Regarding them as distinct actors is a mistake. Both enable each other: Apple enables pervasive surveillance; in turn China enables huge profits. How bottomless is the guile of a corporation willing to put lives at risk to make some money?

An application capable of reading the clipboard is just as capable of covertly taking screenshots, recording keystrokes and otherwise compromising data being executed in the context of the same system user. Is gives a false sense of security guarding the clipboard when the real threat is untrustworthy (usually closed-source and proprietary) software itself, executed as a user with privileges.

One possible solution is to block access to Microsoft IP ranges on your firewall:

    $ whois -h whois.radb.net '!AS8075'

    $ pfctl -t drophosts -T add <results>

Or on Linux:

    $ for range in <results> ; do sudo iptables -A INPUT -s $range -j DROP ; done

Of course this will break a lot of Windows native system functionality, perhaps even Azure hosting, but this may not be an issue for someone just wishing to game in peace and privacy, unmolested by Microsoft telemetry.

This is the absolute reality with closed source proprietary software: the user has no say nor ownership in the product; they are in effect granted a revocable license to use a set of features for some indeterminate period of time. The owners of the software licenses may modify, without the user's consent, or even knowledge, the software for any reason and any purpose. On modern closed source operating systems with automatic updates, it's often even impossible to revert to a prior version. I'm not against this type of software, it has its place and purpose, but why trust it for something as critical as personal identity management and authentication? Especially when there are so many free (as in freedom, not price) and open source alternatives on the market?

Some software components are open source, others are not.

> Let me introduce you to the nice folks over at Objective See.. https://objective-see.com/products.html

The "nice folks" at Objective-See is Patrick Wardle, a former NSA rootkit expert who would like nothing more than to install various close-sourced components on your computer.

> A program that surreptitiously reinstalls software when you uninstall it is by definition malware.

Not quite. Malware is short for "malicious software" and malice has a specific legal definition: the intent to harm. By your standard, removing a Mac system daemon only to have it re-installed by a software update would classify the entire OS as "malware" - which is an unfair, emotionally-driven characterization.

> Yes, Apple does have the power to change every bit on your hard disk if you let it. Things like EULAs are supposed to govern to what extent they can use that power.

Please help me understand this. Where in the EULA or elsewhere have users allowed Apple to remotely install a U2 album, or delete third-party software? What of the fact the EULA itself can change at any time without any posted notice? Or worse, what if Apple is forced or breached to deliver a "security update" which steals personal information or bricks your device? Why is this not a legitimate concern to technical professionals? Or, where is the documentation which at least explains this behavior to put curious minds at ease?

> iMessage is end-to-end encrypted. The keys are managed by the devices themselves. There is no facility to backdoor or intercept the messages.

That is only a half-truth. Apple controls the key infrastructure; they may replace your keys with arbitrary ones at the demand, coercion or compromise by any number of bad actors. The software is closed source, making it impossible to verify any actual claims made otherwise. If they truly valued privacy, why not open source iMessage, allow users to verify iMessage keys, hire an independent third party to audit their infrastructure, or all of the above?

Moreover, Apple has moved iCloud infrastructure to Chinese data centers to enable spying on millions of innocent people. They have removed apps from their store which circumvent Chinese censorship. These are truly shameful acts which has appropriately drawn criticism from human rights watch organizations.

https://techcrunch.com/2018/02/25/apple-moves-icloud-encrypt...

https://www.cnbc.com/2018/02/24/apple-moves-to-store-icloud-...

https://www.nytimes.com/2017/07/29/technology/china-apple-ce...

https://blog.cryptographyengineering.com/2013/06/26/can-appl...

Well said. Apple loves to flex muscle as a show of force - virtue signaling - when there is some great drama going on. It is terrifying to know they have covert remote root code execution on Macs and iPhones at all times, which they may use without your consent of even knowledge. To me, that is a greater security risk and the reason I will not use their products in favor of open source operating systems only. It saddens me to see how soon people forget Apple participates in PRISM surveillance and has been literally criticized for human rights violations in China, yet invite them to control their computers. I expect people will down-vote this comment, but expressing my disgust for such an authoritarian world view is more important to me, and should be recognized as such by the hacker community. Unfortunately it seems too many of us will sacrifice autonomy and control for the promise of centrally-administered, ominous "security" working in the shadows.

Apple only does so when it's also convenient to their bottom line. They provide the Chinese government backdoor access to iMessage, remove VPN apps from their store to enable censorship, and have we all forgotten they are a PRISM partner? These actions seem pretty "evil" to me.

A macOS "app" is just a directory with an executable binary and some convenient helper files for Finder. Dragging it to the trash does not remove artifacts, such as logs, supporting binaries, even methods of persistence, which may get placed somewhere else on the filesystem as part of a typical installation. This is not unique to Zoom or even Apple operating systems.

Qubes OS is an operating system which pursues exactly these design goals, and unlike iOS, it is free and open source.

> It was secretly installing webservers that dont even remove themselves when you uninstall the app that makes them scum.

To be fair, dragging an "app" to Trash does not constitute un-installation. It was a poor design decision to implement features using a local web server, but let's not be so quick to attribute covert, malicious intentions.

I don't understand. If you don't trust Skype so much that you're paranoid over the quit behavior, why not use another program to communicate? Not that your paranoia is unjustified - the Snowden leaks made it abundantly clear that service is not secure nor private.